@superglue/cli 1.1.10 → 1.1.12

package/dist/cli.js

@@ -1742,21 +1742,67 @@ var require_json_schema = __commonJS({
   }
 });
 
+// ../shared/dist/rbac-utils.js
+var require_rbac_utils = __commonJS({
+  "../shared/dist/rbac-utils.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.RESERVED_ROLE_NAMES = exports2.RESERVED_ROLE_IDS = exports2.PREDEFINED_ROLE_IDS = void 0;
+    exports2.isCustomRulePermission = isCustomRulePermission;
+    exports2.getSystemRules = getSystemRules;
+    exports2.isPredefinedRole = isPredefinedRole;
+    exports2.isReservedRoleId = isReservedRoleId;
+    exports2.isReservedRoleName = isReservedRoleName;
+    exports2.hasRole = hasRole;
+    exports2.getRoleIds = getRoleIds;
+    exports2.getBaseRole = getBaseRole;
+    exports2.getBaseRoleId = getBaseRoleId;
+    function isCustomRulePermission(p) {
+      return typeof p === "object" && p !== null && "rules" in p;
+    }
+    function getSystemRules(systems2, systemId) {
+      if (systems2 === "ALL" || !systems2[systemId])
+        return [];
+      const p = systems2[systemId];
+      return isCustomRulePermission(p) ? p.rules : [];
+    }
+    exports2.PREDEFINED_ROLE_IDS = ["admin", "member", "enduser"];
+    exports2.RESERVED_ROLE_IDS = ["admin", "member", "enduser", "__admin__"];
+    exports2.RESERVED_ROLE_NAMES = ["member", "end user", "enduser", "admin"];
+    function isPredefinedRole(roleId) {
+      return exports2.PREDEFINED_ROLE_IDS.includes(roleId);
+    }
+    function isReservedRoleId(roleId) {
+      return exports2.RESERVED_ROLE_IDS.includes(roleId);
+    }
+    function isReservedRoleName(name) {
+      return exports2.RESERVED_ROLE_NAMES.includes(name.toLowerCase().trim());
+    }
+    function hasRole(roles, roleId) {
+      return roles.some((r) => r.id === roleId);
+    }
+    function getRoleIds(roles) {
+      return roles.map((r) => r.id);
+    }
+    function getBaseRole(roles) {
+      const baseRoles = roles.filter((r) => r.isBaseRole);
+      return baseRoles.length === 1 ? baseRoles[0] : null;
+    }
+    function getBaseRoleId(roles) {
+      const base = getBaseRole(roles);
+      return base ? base.id : null;
+    }
+  }
+});
+
 // ../shared/dist/types.js
 var require_types = __commonJS({
   "../shared/dist/types.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.ConfirmationAction = exports2.FileStatus = exports2.DiscoveryRunStatus = exports2.RemoveScope = exports2.FilterAction = exports2.FilterTarget = exports2.RequestSource = exports2.RunStatus = exports2.CredentialMode = exports2.UpsertMode = exports2.LogLevel = exports2.PaginationType = exports2.DecompressionMethod = exports2.AuthType = exports2.FileType = exports2.CacheMode = exports2.HttpMethod = exports2.SupportedFileType = exports2.UserRole = void 0;
+    exports2.SystemAccessLevel = exports2.ConfirmationAction = exports2.FileStatus = exports2.DiscoveryRunStatus = exports2.RemoveScope = exports2.FilterAction = exports2.FilterTarget = exports2.RequestSource = exports2.RunStatus = exports2.CredentialMode = exports2.UpsertMode = exports2.LogLevel = exports2.PaginationType = exports2.DecompressionMethod = exports2.AuthType = exports2.FileType = exports2.CacheMode = exports2.HttpMethod = exports2.SupportedFileType = void 0;
     exports2.isRequestConfig = isRequestConfig;
     exports2.isTransformConfig = isTransformConfig;
-    exports2.getToolSystemIds = getToolSystemIds;
-    exports2.isProductionSystem = isProductionSystem;
-    var UserRole;
-    (function(UserRole2) {
-      UserRole2["ADMIN"] = "admin";
-      UserRole2["MEMBER"] = "member";
-    })(UserRole || (exports2.UserRole = UserRole = {}));
     var SupportedFileType;
     (function(SupportedFileType2) {
       SupportedFileType2["JSON"] = "JSON";
@@ -1884,20 +1930,6 @@ var require_types = __commonJS({
     function isTransformConfig(config) {
       return config?.type === "transform";
     }
-    function getToolSystemIds(tool) {
-      if (!tool.steps)
-        return [];
-      const ids = /* @__PURE__ */ new Set();
-      for (const step of tool.steps) {
-        if (step.config && isRequestConfig(step.config) && step.config.systemId) {
-          ids.add(step.config.systemId);
-        }
-      }
-      return Array.from(ids);
-    }
-    function isProductionSystem(system) {
-      return system.environment !== "dev";
-    }
     var DiscoveryRunStatus;
     (function(DiscoveryRunStatus2) {
       DiscoveryRunStatus2["PENDING"] = "PENDING";
@@ -1922,6 +1954,12 @@ var require_types = __commonJS({
       ConfirmationAction2["OAUTH_SUCCESS"] = "oauth_success";
       ConfirmationAction2["OAUTH_FAILURE"] = "oauth_failure";
     })(ConfirmationAction || (exports2.ConfirmationAction = ConfirmationAction = {}));
+    var SystemAccessLevel;
+    (function(SystemAccessLevel2) {
+      SystemAccessLevel2["NONE"] = "none";
+      SystemAccessLevel2["READ_ONLY"] = "read-only";
+      SystemAccessLevel2["READ_WRITE"] = "read-write";
+    })(SystemAccessLevel || (exports2.SystemAccessLevel = SystemAccessLevel = {}));
   }
 });
 
@@ -6349,12 +6387,12 @@ var init_size = __esm({
       increment,
       maxSize,
       truncatedProps,
-      path: path6,
+      path: path7,
       value
     }) => {
       const newSize = size + increment;
       const stop = newSize > maxSize;
-      return stop ? { size, stop, truncatedProps: [...truncatedProps, { path: path6, value }] } : { size: newSize, stop, truncatedProps };
+      return stop ? { size, stop, truncatedProps: [...truncatedProps, { path: path7, value }] } : { size: newSize, stop, truncatedProps };
     };
     getValueSize = (value) => getJsonLength(value);
     getArrayItemSize = (empty, indent, depth) => {
@@ -6392,7 +6430,7 @@ var init_prop = __esm({
     truncateProp = ({
       parent,
       truncatedProps,
-      path: path6,
+      path: path7,
       increment,
       maxSize,
       key,
@@ -6403,7 +6441,7 @@ var init_prop = __esm({
       depth
     }) => {
       const value = parent[key];
-      const pathA = [...path6, key];
+      const pathA = [...path7, key];
       const {
         size: newSize,
         stop,
@@ -6432,7 +6470,7 @@ var init_prop = __esm({
     truncatePropValue = ({
       value,
       truncatedProps,
-      path: path6,
+      path: path7,
       maxSize,
       empty,
       size,
@@ -6448,7 +6486,7 @@ var init_prop = __esm({
       } = truncateValue2({
         value,
         truncatedProps,
-        path: path6,
+        path: path7,
         size: newSize,
         maxSize,
         indent,
@@ -6474,7 +6512,7 @@ var init_array = __esm({
     truncateArray = ({
       array: array2,
       truncatedProps,
-      path: path6,
+      path: path7,
       size,
       maxSize,
       truncateValue: truncateValue2,
@@ -6488,7 +6526,7 @@ var init_array = __esm({
         state = truncateProp({
           parent: array2,
           truncatedProps: state.truncatedProps,
-          path: path6,
+          path: path7,
           increment,
           maxSize,
           key: index,
@@ -6521,7 +6559,7 @@ var init_object = __esm({
     truncateObject = ({
       object: object2,
       truncatedProps,
-      path: path6,
+      path: path7,
       size,
       maxSize,
       truncateValue: truncateValue2,
@@ -6540,7 +6578,7 @@ var init_object = __esm({
         state = truncateProp({
           parent: object2,
           truncatedProps: state.truncatedProps,
-          path: path6,
+          path: path7,
           increment,
           maxSize,
           key,
@@ -6574,7 +6612,7 @@ var init_value = __esm({
     truncateValue = ({
       value,
       truncatedProps,
-      path: path6,
+      path: path7,
       size,
       maxSize,
       indent,
@@ -6590,13 +6628,13 @@ var init_value = __esm({
         increment,
         maxSize,
         truncatedProps,
-        path: path6,
+        path: path7,
         value
       });
       return stop ? { value: void 0, size: sizeA, truncatedProps: truncatedPropsA } : recurseValue({
         value,
         truncatedProps: truncatedPropsA,
-        path: path6,
+        path: path7,
         size: sizeA,
         maxSize,
         indent,
@@ -6606,7 +6644,7 @@ var init_value = __esm({
     recurseValue = ({
       value,
       truncatedProps,
-      path: path6,
+      path: path7,
       size,
       maxSize,
       indent,
@@ -6618,7 +6656,7 @@ var init_value = __esm({
       return Array.isArray(value) ? truncateArray({
         array: value,
         truncatedProps,
-        path: path6,
+        path: path7,
         size,
         maxSize,
         truncateValue,
@@ -6627,7 +6665,7 @@ var init_value = __esm({
       }) : truncateObject({
         object: value,
         truncatedProps,
-        path: path6,
+        path: path7,
         size,
         maxSize,
         truncateValue,
@@ -15758,8 +15796,8 @@ var require_CronFileParser = __commonJS({
        * @throws If file cannot be read
        */
       static parseFileSync(filePath) {
-        const { readFileSync: readFileSync9 } = require("fs");
-        const data = readFileSync9(filePath, "utf8");
+        const { readFileSync: readFileSync10 } = require("fs");
+        const data = readFileSync10(filePath, "utf8");
         return _CronFileParser.#parseContent(data);
       }
       /**
@@ -16386,9 +16424,9 @@ var require_property_expr = __commonJS({
       Cache,
       split: split2,
       normalizePath: normalizePath2,
-      setter: function(path6) {
-        var parts = normalizePath2(path6);
-        return setCache.get(path6) || setCache.set(path6, function setter(obj, value) {
+      setter: function(path7) {
+        var parts = normalizePath2(path7);
+        return setCache.get(path7) || setCache.set(path7, function setter(obj, value) {
           var index = 0;
           var len = parts.length;
           var data = obj;
@@ -16402,9 +16440,9 @@ var require_property_expr = __commonJS({
           data[parts[index]] = value;
         });
       },
-      getter: function(path6, safe) {
-        var parts = normalizePath2(path6);
-        return getCache.get(path6) || getCache.set(path6, function getter2(data) {
+      getter: function(path7, safe) {
+        var parts = normalizePath2(path7);
+        return getCache.get(path7) || getCache.set(path7, function getter2(data) {
           var index = 0, len = parts.length;
           while (index < len) {
             if (data != null || !safe) data = data[parts[index++]];
@@ -16414,24 +16452,24 @@ var require_property_expr = __commonJS({
         });
       },
       join: function(segments) {
-        return segments.reduce(function(path6, part) {
-          return path6 + (isQuoted(part) || DIGIT_REGEX.test(part) ? "[" + part + "]" : (path6 ? "." : "") + part);
+        return segments.reduce(function(path7, part) {
+          return path7 + (isQuoted(part) || DIGIT_REGEX.test(part) ? "[" + part + "]" : (path7 ? "." : "") + part);
         }, "");
       },
-      forEach: function(path6, cb, thisArg) {
-        forEach2(Array.isArray(path6) ? path6 : split2(path6), cb, thisArg);
+      forEach: function(path7, cb, thisArg) {
+        forEach2(Array.isArray(path7) ? path7 : split2(path7), cb, thisArg);
       }
     };
-    function normalizePath2(path6) {
-      return pathCache.get(path6) || pathCache.set(
-        path6,
-        split2(path6).map(function(part) {
+    function normalizePath2(path7) {
+      return pathCache.get(path7) || pathCache.set(
+        path7,
+        split2(path7).map(function(part) {
           return part.replace(CLEAN_QUOTES_REGEX, "$2");
         })
       );
     }
-    function split2(path6) {
-      return path6.match(SPLIT_REGEX) || [""];
+    function split2(path7) {
+      return path7.match(SPLIT_REGEX) || [""];
     }
     function forEach2(parts, iter, thisArg) {
       var len = parts.length, part, idx, isArray, isBracket;
@@ -16469,15 +16507,15 @@ var require_tiny_case = __commonJS({
     var reWords = /[A-Z\xc0-\xd6\xd8-\xde]?[a-z\xdf-\xf6\xf8-\xff]+(?:['’](?:d|ll|m|re|s|t|ve))?(?=[\xac\xb1\xd7\xf7\x00-\x2f\x3a-\x40\x5b-\x60\x7b-\xbf\u2000-\u206f \t\x0b\f\xa0\ufeff\n\r\u2028\u2029\u1680\u180e\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u2008\u2009\u200a\u202f\u205f\u3000]|[A-Z\xc0-\xd6\xd8-\xde]|$)|(?:[A-Z\xc0-\xd6\xd8-\xde]|[^\ud800-\udfff\xac\xb1\xd7\xf7\x00-\x2f\x3a-\x40\x5b-\x60\x7b-\xbf\u2000-\u206f \t\x0b\f\xa0\ufeff\n\r\u2028\u2029\u1680\u180e\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u2008\u2009\u200a\u202f\u205f\u3000\d+\u2700-\u27bfa-z\xdf-\xf6\xf8-\xffA-Z\xc0-\xd6\xd8-\xde])+(?:['’](?:D|LL|M|RE|S|T|VE))?(?=[\xac\xb1\xd7\xf7\x00-\x2f\x3a-\x40\x5b-\x60\x7b-\xbf\u2000-\u206f \t\x0b\f\xa0\ufeff\n\r\u2028\u2029\u1680\u180e\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u2008\u2009\u200a\u202f\u205f\u3000]|[A-Z\xc0-\xd6\xd8-\xde](?:[a-z\xdf-\xf6\xf8-\xff]|[^\ud800-\udfff\xac\xb1\xd7\xf7\x00-\x2f\x3a-\x40\x5b-\x60\x7b-\xbf\u2000-\u206f \t\x0b\f\xa0\ufeff\n\r\u2028\u2029\u1680\u180e\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u2008\u2009\u200a\u202f\u205f\u3000\d+\u2700-\u27bfa-z\xdf-\xf6\xf8-\xffA-Z\xc0-\xd6\xd8-\xde])|$)|[A-Z\xc0-\xd6\xd8-\xde]?(?:[a-z\xdf-\xf6\xf8-\xff]|[^\ud800-\udfff\xac\xb1\xd7\xf7\x00-\x2f\x3a-\x40\x5b-\x60\x7b-\xbf\u2000-\u206f \t\x0b\f\xa0\ufeff\n\r\u2028\u2029\u1680\u180e\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u2008\u2009\u200a\u202f\u205f\u3000\d+\u2700-\u27bfa-z\xdf-\xf6\xf8-\xffA-Z\xc0-\xd6\xd8-\xde])+(?:['’](?:d|ll|m|re|s|t|ve))?|[A-Z\xc0-\xd6\xd8-\xde]+(?:['’](?:D|LL|M|RE|S|T|VE))?|\d*(?:1ST|2ND|3RD|(?![123])\dTH)(?=\b|[a-z_])|\d*(?:1st|2nd|3rd|(?![123])\dth)(?=\b|[A-Z_])|\d+|(?:[\u2700-\u27bf]|(?:\ud83c[\udde6-\uddff]){2}|[\ud800-\udbff][\udc00-\udfff])[\ufe0e\ufe0f]?(?:[\u0300-\u036f\ufe20-\ufe2f\u20d0-\u20ff]|\ud83c[\udffb-\udfff])?(?:\u200d(?:[^\ud800-\udfff]|(?:\ud83c[\udde6-\uddff]){2}|[\ud800-\udbff][\udc00-\udfff])[\ufe0e\ufe0f]?(?:[\u0300-\u036f\ufe20-\ufe2f\u20d0-\u20ff]|\ud83c[\udffb-\udfff])?)*/g;
     var words = (str) => str.match(reWords) || [];
     var upperFirst = (str) => str[0].toUpperCase() + str.slice(1);
-    var join6 = (str, d) => words(str).join(d).toLowerCase();
+    var join7 = (str, d) => words(str).join(d).toLowerCase();
     var camelCase2 = (str) => words(str).reduce(
       (acc, next) => `${acc}${!acc ? next.toLowerCase() : next[0].toUpperCase() + next.slice(1).toLowerCase()}`,
       ""
     );
     var pascalCase = (str) => upperFirst(camelCase2(str));
-    var snakeCase2 = (str) => join6(str, "_");
-    var kebabCase = (str) => join6(str, "-");
-    var sentenceCase = (str) => upperFirst(join6(str, " "));
+    var snakeCase2 = (str) => join7(str, "_");
+    var kebabCase = (str) => join7(str, "-");
+    var sentenceCase = (str) => upperFirst(join7(str, " "));
     var titleCase = (str) => words(str).map(upperFirst).join(" ");
     module2.exports = {
       words,
@@ -16637,7 +16675,7 @@ function create$9(key, options) {
 function createValidation(config) {
   function validate({
     value,
-    path: path6 = "",
+    path: path7 = "",
     options,
     originalValue,
     schema
@@ -16665,7 +16703,7 @@ function createValidation(config) {
         value,
         originalValue,
         label: schema.spec.label,
-        path: overrides.path || path6,
+        path: overrides.path || path7,
         spec: schema.spec,
         disableStackTrace: overrides.disableStackTrace || disableStackTrace
       }, params, overrides.params), resolveOptions);
@@ -16675,7 +16713,7 @@ function createValidation(config) {
     }
     const invalid = abortEarly ? panic : next;
     let ctx = {
-      path: path6,
+      path: path7,
       parent,
       type: name,
       from: options.from,
@@ -16729,14 +16767,14 @@ function resolveParams(params, options) {
 function resolveMaybeRef(item, options) {
   return Reference.isRef(item) ? item.getValue(options.value, options.parent, options.context) : item;
 }
-function getIn(schema, path6, value, context = value) {
+function getIn(schema, path7, value, context = value) {
   let parent, lastPart, lastPartDebug;
-  if (!path6) return {
+  if (!path7) return {
     parent,
-    parentPath: path6,
+    parentPath: path7,
     schema
   };
-  (0, import_property_expr.forEach)(path6, (_part, isBracket, isArray) => {
+  (0, import_property_expr.forEach)(path7, (_part, isBracket, isArray) => {
     let part = isBracket ? _part.slice(1, _part.length - 1) : _part;
     schema = schema.resolve({
       context,
@@ -16748,14 +16786,14 @@ function getIn(schema, path6, value, context = value) {
     if (schema.innerType || isTuple) {
       if (isTuple && !isArray) throw new Error(`Yup.reach cannot implicitly index into a tuple type. the path part "${lastPartDebug}" must contain an index to the tuple element, e.g. "${lastPartDebug}[0]"`);
       if (value && idx >= value.length) {
-        throw new Error(`Yup.reach cannot resolve an array item at index: ${_part}, in the path: ${path6}. because there is no value at that index. `);
+        throw new Error(`Yup.reach cannot resolve an array item at index: ${_part}, in the path: ${path7}. because there is no value at that index. `);
       }
       parent = value;
       value = value && value[idx];
       schema = isTuple ? schema.spec.types[idx] : schema.innerType;
     }
     if (!isArray) {
-      if (!schema.fields || !schema.fields[part]) throw new Error(`The schema does not contain the path: ${path6}. (failed at: ${lastPartDebug} which is a type: "${schema.type}")`);
+      if (!schema.fields || !schema.fields[part]) throw new Error(`The schema does not contain the path: ${path7}. (failed at: ${lastPartDebug} which is a type: "${schema.type}")`);
       parent = value;
       value = value && value[part];
       schema = schema.fields[part];
@@ -16769,8 +16807,8 @@ function getIn(schema, path6, value, context = value) {
     parentPath: lastPart
   };
 }
-function reach(obj, path6, value, context) {
-  return getIn(obj, path6, value, context).schema;
+function reach(obj, path7, value, context) {
+  return getIn(obj, path7, value, context).schema;
 }
 function clone(src, seen = /* @__PURE__ */ new Map()) {
   if (isSchema(src) || !src || typeof src !== "object") return src;
@@ -16803,16 +16841,16 @@ function clone(src, seen = /* @__PURE__ */ new Map()) {
   }
   return copy;
 }
-function createStandardPath(path6) {
-  if (!(path6 != null && path6.length)) {
+function createStandardPath(path7) {
+  if (!(path7 != null && path7.length)) {
     return void 0;
   }
   const segments = [];
   let currentSegment = "";
   let inBrackets = false;
   let inQuotes = false;
-  for (let i = 0; i < path6.length; i++) {
-    const char = path6[i];
+  for (let i = 0; i < path7.length; i++) {
+    const char = path7[i];
     if (char === "[" && !inQuotes) {
       if (currentSegment) {
         segments.push(...currentSegment.split(".").filter(Boolean));
@@ -16852,10 +16890,10 @@ function createStandardPath(path6) {
   return segments;
 }
 function createStandardIssues(error2, parentPath) {
-  const path6 = parentPath ? `${parentPath}.${error2.path}` : error2.path;
+  const path7 = parentPath ? `${parentPath}.${error2.path}` : error2.path;
   return error2.errors.map((err) => ({
     message: err,
-    path: createStandardPath(path6)
+    path: createStandardPath(path7)
   }));
 }
 function issuesFromValidationError(error2, parentPath) {
@@ -16863,8 +16901,8 @@ function issuesFromValidationError(error2, parentPath) {
   if (!((_error$inner = error2.inner) != null && _error$inner.length) && error2.errors.length) {
     return createStandardIssues(error2, parentPath);
   }
-  const path6 = parentPath ? `${parentPath}.${error2.path}` : error2.path;
-  return error2.inner.flatMap((err) => issuesFromValidationError(err, path6));
+  const path7 = parentPath ? `${parentPath}.${error2.path}` : error2.path;
+  return error2.inner.flatMap((err) => issuesFromValidationError(err, path7));
 }
 function create$8(spec) {
   return new MixedSchema(spec);
@@ -16932,7 +16970,7 @@ function sortFields(fields, excludedEdges = []) {
     let value = fields[key];
     nodes.add(key);
     if (Reference.isRef(value) && value.isSibling) addNode(value.path, key);
-    else if (isSchema(value) && "deps" in value) value.deps.forEach((path6) => addNode(path6, key));
+    else if (isSchema(value) && "deps" in value) value.deps.forEach((path7) => addNode(path7, key));
   }
   return import_toposort.default.array(Array.from(nodes), edges).reverse();
 }
@@ -17059,9 +17097,9 @@ var init_index_esm = __esm({
     _Symbol$toStringTag2 = Symbol.toStringTag;
     ValidationError = class _ValidationError extends Error {
       static formatError(message, params) {
-        const path6 = params.label || params.path || "this";
+        const path7 = params.label || params.path || "this";
         params = Object.assign({}, params, {
-          path: path6,
+          path: path7,
           originalPath: params.path
         });
         if (typeof message === "string") return message.replace(strReg, (_, key) => printValue(params[key]));
@@ -17107,13 +17145,13 @@ var init_index_esm = __esm({
       oneOf: "${path} must be one of the following values: ${values}",
       notOneOf: "${path} must not be one of the following values: ${values}",
       notType: ({
-        path: path6,
+        path: path7,
         type,
         value,
         originalValue
       }) => {
         const castMsg = originalValue != null && originalValue !== value ? ` (cast from the value \`${printValue(originalValue, true)}\`).` : ".";
-        return type !== "mixed" ? `${path6} must be a \`${type}\` type, but the final value was: \`${printValue(value, true)}\`` + castMsg : `${path6} must match the configured type. The validated value was: \`${printValue(value, true)}\`` + castMsg;
+        return type !== "mixed" ? `${path7} must be a \`${type}\` type, but the final value was: \`${printValue(value, true)}\`` + castMsg : `${path7} must match the configured type. The validated value was: \`${printValue(value, true)}\`` + castMsg;
       }
     };
     string = {
@@ -17159,14 +17197,14 @@ var init_index_esm = __esm({
     tuple = {
       notType: (params) => {
         const {
-          path: path6,
+          path: path7,
           value,
           spec
         } = params;
         const typeLen = spec.types.length;
         if (Array.isArray(value)) {
-          if (value.length < typeLen) return `${path6} tuple value has too few items, expected a length of ${typeLen} but got ${value.length} for value: \`${printValue(value, true)}\``;
-          if (value.length > typeLen) return `${path6} tuple value has too many items, expected a length of ${typeLen} but got ${value.length} for value: \`${printValue(value, true)}\``;
+          if (value.length < typeLen) return `${path7} tuple value has too few items, expected a length of ${typeLen} but got ${value.length} for value: \`${printValue(value, true)}\``;
+          if (value.length > typeLen) return `${path7} tuple value has too many items, expected a length of ${typeLen} but got ${value.length} for value: \`${printValue(value, true)}\``;
         }
         return ValidationError.formatError(mixed.notType, params);
       }
@@ -17283,10 +17321,10 @@ var init_index_esm = __esm({
         }
         return description;
       }
-      resolveAll(resolve4) {
+      resolveAll(resolve5) {
         let result = [];
         for (const item of this.values()) {
-          result.push(resolve4(item));
+          result.push(resolve5(item));
         }
         return result;
       }
@@ -17458,7 +17496,7 @@ attempted value: ${formattedValue}
       }
       _validate(_value, options = {}, panic, next) {
         let {
-          path: path6,
+          path: path7,
           originalValue = _value,
           strict = this.spec.strict
         } = options;
@@ -17473,7 +17511,7 @@ attempted value: ${formattedValue}
           if (test) initialTests.push(test);
         }
         this.runTests({
-          path: path6,
+          path: path7,
           value,
           originalValue,
           options,
@@ -17483,7 +17521,7 @@ attempted value: ${formattedValue}
             return next(initialErrors, value);
           }
           this.runTests({
-            path: path6,
+            path: path7,
             value,
             originalValue,
             options,
@@ -17501,7 +17539,7 @@ attempted value: ${formattedValue}
           tests,
           value,
           originalValue,
-          path: path6,
+          path: path7,
           options
         } = runOptions;
         let panicOnce = (arg) => {
@@ -17520,7 +17558,7 @@ attempted value: ${formattedValue}
         let args = {
           value,
           originalValue,
-          path: path6,
+          path: path7,
           options,
           schema: this
         };
@@ -17573,12 +17611,12 @@ attempted value: ${formattedValue}
           value
         }));
         let disableStackTrace = (_options$disableStack2 = options == null ? void 0 : options.disableStackTrace) != null ? _options$disableStack2 : schema.spec.disableStackTrace;
-        return new Promise((resolve4, reject) => schema._validate(value, options, (error2, parsed) => {
+        return new Promise((resolve5, reject) => schema._validate(value, options, (error2, parsed) => {
           if (ValidationError.isError(error2)) error2.value = parsed;
           reject(error2);
         }, (errors, validated) => {
           if (errors.length) reject(new ValidationError(errors, validated, void 0, void 0, disableStackTrace));
-          else resolve4(validated);
+          else resolve5(validated);
         }));
       }
       validateSync(value, options) {
@@ -17882,15 +17920,15 @@ attempted value: ${formattedValue}
       }
     };
     Schema.prototype.__isYupSchema__ = true;
-    for (const method of ["validate", "validateSync"]) Schema.prototype[`${method}At`] = function(path6, value, options = {}) {
+    for (const method of ["validate", "validateSync"]) Schema.prototype[`${method}At`] = function(path7, value, options = {}) {
       const {
         parent,
         parentPath,
         schema
-      } = getIn(this, path6, value, options.context);
+      } = getIn(this, path7, value, options.context);
       return schema[method](parent && parent[parentPath], Object.assign({}, options, {
         parent,
-        path: path6
+        path: path7
       }));
     };
     for (const alias of ["equals", "is"]) Schema.prototype[alias] = Schema.prototype.oneOf;
@@ -18372,10 +18410,10 @@ attempted value: ${formattedValue}
       return schema.isType(parsed) ? parsed : value;
     };
     deepHas = (obj, p) => {
-      const path6 = [...(0, import_property_expr.normalizePath)(p)];
-      if (path6.length === 1) return path6[0] in obj;
-      let last = path6.pop();
-      let parent = (0, import_property_expr.getter)((0, import_property_expr.join)(path6), true)(obj);
+      const path7 = [...(0, import_property_expr.normalizePath)(p)];
+      if (path7.length === 1) return path7[0] in obj;
+      let last = path7.pop();
+      let parent = (0, import_property_expr.getter)((0, import_property_expr.join)(path7), true)(obj);
       return !!(parent && last in parent);
     };
     isObject = (obj) => Object.prototype.toString.call(obj) === "[object Object]";
@@ -18978,11 +19016,11 @@ attempted value: ${formattedValue}
       validateSync(value, options) {
         return this._resolve(value, options).validateSync(value, options);
       }
-      validateAt(path6, value, options) {
-        return catchValidationError(() => this._resolve(value, options).validateAt(path6, value, options));
+      validateAt(path7, value, options) {
+        return catchValidationError(() => this._resolve(value, options).validateAt(path7, value, options));
       }
-      validateSyncAt(path6, value, options) {
-        return this._resolve(value, options).validateSyncAt(path6, value, options);
+      validateSyncAt(path7, value, options) {
+        return this._resolve(value, options).validateSyncAt(path7, value, options);
       }
       isValid(value, options) {
         try {
@@ -20098,7 +20136,6 @@ var require_utils = __commonJS({
     exports2.generateUniqueId = generateUniqueId;
     exports2.waitForSystemProcessing = waitForSystemProcessing;
     exports2.inferJsonSchema = inferJsonSchema;
-    exports2.mapUserRole = mapUserRole;
     exports2.resolveOAuthCertAndKey = resolveOAuthCertAndKey;
     exports2.isArrowFunction = isArrowFunction;
     exports2.assertValidArrowFunction = assertValidArrowFunction;
@@ -20115,6 +20152,8 @@ var require_utils = __commonJS({
     exports2.normalizeToolDiffs = normalizeToolDiffs;
     exports2.composeUrl = composeUrl;
     exports2.truncateRunResult = truncateRunResult;
+    exports2.getToolSystemIds = getToolSystemIds;
+    exports2.isProductionSystem = isProductionSystem;
     var json_schema_js_1 = require_json_schema();
     var types_js_1 = require_types();
     var truncate_json_1 = __importDefault((init_main5(), __toCommonJS(main_exports)));
@@ -20347,7 +20386,7 @@ var require_utils = __commonJS({
         const hasPendingDocs = systems2.some((i) => i.documentationPending === true);
         if (!hasPendingDocs)
           return systems2;
-        await new Promise((resolve4) => setTimeout(resolve4, 4e3));
+        await new Promise((resolve5) => setTimeout(resolve5, 4e3));
       }
       throw new Error(`Waiting for documentation processing to complete timed out after ${timeoutMs / 1e3} seconds for: ${systemIds.join(", ")}. Please try again in a few minutes.`);
     }
@@ -20364,16 +20403,6 @@ var require_utils = __commonJS({
       }
       return buildArraySchemaFromData(data);
     }
-    function mapUserRole(role) {
-      switch (role) {
-        case "admin":
-          return types_js_1.UserRole.ADMIN;
-        case "member":
-          return types_js_1.UserRole.MEMBER;
-        default:
-          return types_js_1.UserRole.MEMBER;
-      }
-    }
     function resolveOAuthCertAndKey(oauthCert, oauthKey) {
       let parsedCert = null;
       let parsedKey = null;
@@ -20606,16 +20635,16 @@ var require_utils = __commonJS({
     function normalizeToolDiffs(diffs) {
       return diffs.map((diff) => normalizeToolDiff(diff));
     }
-    function composeUrl(host, path6) {
+    function composeUrl(host, path7) {
       if (!host)
         host = "";
-      if (!path6)
-        path6 = "";
+      if (!path7)
+        path7 = "";
       if (!/^(https?|postgres(ql)?|ftp(s)?|sftp|smb|file):\/\//i.test(host)) {
         host = `https://${host}`;
       }
       const cleanHost = host.endsWith("/") ? host.slice(0, -1) : host;
-      const cleanPath = path6.startsWith("/") ? path6.slice(1) : path6;
+      const cleanPath = path7.startsWith("/") ? path7.slice(1) : path7;
       return `${cleanHost}/${cleanPath}`;
     }
     var detectSystemAuthType = (credentials) => {
@@ -20767,6 +20796,20 @@ var require_utils = __commonJS({
         };
       }
     }
+    function getToolSystemIds(tool) {
+      if (!tool.steps)
+        return [];
+      const ids = /* @__PURE__ */ new Set();
+      for (const step of tool.steps) {
+        if (step.config && (0, types_js_1.isRequestConfig)(step.config) && step.config.systemId) {
+          ids.add(step.config.systemId);
+        }
+      }
+      return Array.from(ids);
+    }
+    function isProductionSystem(system) {
+      return system.environment !== "dev";
+    }
   }
 });
 
@@ -21354,8 +21397,8 @@ var require_superglue_client = __commonJS({
           return true;
         return false;
       }
-      async restRequest(method, path6, body, extraHeaders) {
-        const url = `${this.apiEndpoint.replace(/\/$/, "")}${path6}`;
+      async restRequest(method, path7, body, extraHeaders) {
+        const url = `${this.apiEndpoint.replace(/\/$/, "")}${path7}`;
         const headers = {
           Authorization: `Bearer ${this.apiKey}`,
           ...extraHeaders
@@ -21433,8 +21476,8 @@ var require_superglue_client = __commonJS({
        * Optionally creates a run record when `createRun` is true.
        */
       async runToolConfig(params) {
-        const path6 = params.createRun ? "/v1/tools/run?createRun=true" : "/v1/tools/run";
-        const response = await this.restRequest("POST", path6, {
+        const path7 = params.createRun ? "/v1/tools/run?createRun=true" : "/v1/tools/run";
+        const response = await this.restRequest("POST", path7, {
           tool: params.tool,
           payload: params.payload,
           credentials: params.credentials,
@@ -21611,15 +21654,19 @@ var require_superglue_client = __commonJS({
           if (err.message?.includes("404") || err.message?.includes("not found")) {
             return null;
           }
+          if (err.message?.includes("403") || err.message?.includes("not allowed")) {
+            return null;
+          }
           throw err;
         }
       }
       async archiveWorkflow(id, archived = true) {
         return this.upsertWorkflow(id, { archived });
       }
-      async listWorkflows(limit = 10, offset = 0) {
+      async listWorkflows(limit = 10, offset = 0, includeArchived = false) {
         const page = Math.floor(offset / limit) + 1;
-        const response = await this.restRequest("GET", `/v1/tools?limit=${limit}&page=${page}`);
+        const archiveParam = includeArchived ? "&includeArchived=true" : "";
+        const response = await this.restRequest("GET", `/v1/tools?limit=${limit}&page=${page}${archiveParam}`);
         return { items: response.data, total: response.total };
       }
       async upsertWorkflow(id, input) {
@@ -21657,11 +21704,6 @@ var require_superglue_client = __commonJS({
         const response = await this.restRequest("GET", `/v1/systems?${params.toString()}`);
         return { items: response.data, total: response.total };
       }
-      async findRelevantTools(searchTerms) {
-        const params = searchTerms ? `?q=${encodeURIComponent(searchTerms)}` : "";
-        const response = await this.restRequest("GET", `/v1/tools/search${params}`);
-        return response.data;
-      }
       async getSystem(id, options) {
         const queryParams = options?.environment ? `?env=${options.environment}` : "";
         const response = await this.restRequest("GET", `/v1/systems/${encodeURIComponent(id)}${queryParams}`);
@@ -21817,6 +21859,7 @@ var require_dist2 = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.SSELogSubscriptionManager = exports2.SuperglueClient = void 0;
     __exportStar(require_json_schema(), exports2);
+    __exportStar(require_rbac_utils(), exports2);
     __exportStar(require_seed_config(), exports2);
     __exportStar(require_templates(), exports2);
     __exportStar(require_type_utils(), exports2);
@@ -21836,7 +21879,7 @@ var require_dist2 = __commonJS({
 });
 
 // src/cli.ts
-var import_commander5 = require("commander");
+var import_commander6 = require("commander");
 
 // src/config.ts
 var fs = __toESM(require("fs"));
@@ -21922,6 +21965,7 @@ function createClient(config) {
 var fs2 = __toESM(require("fs"));
 var path2 = __toESM(require("path"));
 var os2 = __toESM(require("os"));
+var import_commander = require("commander");
 var import_shared2 = __toESM(require_dist2());
 
 // src/output.ts
@@ -21934,7 +21978,7 @@ var import_node_util = require("util");
 // package.json
 var package_default = {
   name: "@superglue/cli",
-  version: "1.1.10",
+  version: "1.1.12",
   bin: {
     sg: "./dist/cli.js"
   },
@@ -22030,8 +22074,8 @@ function startBackgroundUpdateCheck() {
 async function printUpdateNotification() {
   if (!updateCheckPromise) return;
   try {
-    const timeout = new Promise((resolve4) => {
-      const timer = setTimeout(() => resolve4(null), 2e3);
+    const timeout = new Promise((resolve5) => {
+      const timer = setTimeout(() => resolve5(null), 2e3);
       timer.unref();
     });
     const latest = await Promise.race([updateCheckPromise, timeout]);
@@ -22355,21 +22399,21 @@ function renderDiffs(diffs) {
 async function prompt(message, defaultValue) {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
   const suffix = defaultValue ? ` ${c.dim}[${defaultValue}]${c.reset}` : "";
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     rl.question(`  ${message}${suffix}: `, (answer) => {
       rl.close();
-      resolve4(answer.trim() || defaultValue || "");
+      resolve5(answer.trim() || defaultValue || "");
     });
   });
 }
 async function promptHidden(message) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     process.stdout.write(`${message}: `);
     if (!process.stdin.isTTY) {
       const rl = readline.createInterface({ input: process.stdin });
       rl.once("line", (line) => {
         rl.close();
-        resolve4(line.trim());
+        resolve5(line.trim());
       });
       return;
     }
@@ -22384,7 +22428,7 @@ async function promptHidden(message) {
           process.stdin.removeListener("data", onData);
           process.stdin.pause();
           process.stdout.write("\n");
-          resolve4(input);
+          resolve5(input);
           return;
         } else if (char === "") {
           process.stdin.setRawMode(false);
@@ -22427,7 +22471,7 @@ async function choose(message, options, defaultIndex = 0) {
   ${c.bold}${message}${c.reset} ${c.dim}(\u2191/\u2193 to select, enter to confirm)${c.reset}`
   );
   render();
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     process.stdin.setRawMode(true);
     process.stdin.resume();
     const onData = (ch) => {
@@ -22436,7 +22480,7 @@ async function choose(message, options, defaultIndex = 0) {
         process.stdin.setRawMode(false);
         process.stdin.removeListener("data", onData);
         process.stdin.pause();
-        resolve4(selected);
+        resolve5(selected);
         return;
       }
       if (s === "") {
@@ -22459,8 +22503,13 @@ async function choose(message, options, defaultIndex = 0) {
 
 // src/commands/init.ts
 function registerInitCommand(program2) {
-  program2.command("init").description("Set up superglue CLI configuration").option("--api-key <key>", "API key (skips interactive prompt)").option("--endpoint <url>", "API endpoint", "https://api.superglue.cloud").option("--web-endpoint <url>", "Web endpoint for OAuth callbacks").option("--output-mode <mode>", "Output mode: stdout or stdout+file", "stdout").option("--output-dir <dir>", "Output directory for stdout+file mode", ".superglue/output").option("--global", "Save config globally (~/.superglue/) instead of locally").action(async (opts) => {
-    const isNonInteractive = opts.apiKey || !process.stdin.isTTY;
+  program2.command("init").description("Set up superglue CLI configuration").option("--web-endpoint <url>", "Web endpoint for OAuth callbacks").addOption(
+    new import_commander.Option("--output-mode <mode>", "Output mode: stdout or stdout+file").choices(["stdout", "stdout+file"]).default("stdout")
+  ).option("--output-dir <dir>", "Output directory for stdout+file mode", ".superglue/output").option("--global", "Save config globally (~/.superglue/) instead of locally").action(async function(opts) {
+    const parentOpts = this.parent?.opts() ?? {};
+    const resolvedApiKey = parentOpts.apiKey || process.env.SUPERGLUE_API_KEY;
+    const resolvedEndpoint = parentOpts.endpoint || process.env.SUPERGLUE_API_ENDPOINT;
+    const isNonInteractive = resolvedApiKey || !process.stdin.isTTY;
     let apiKey;
     let endpoint;
     let webEndpoint;
@@ -22468,12 +22517,12 @@ function registerInitCommand(program2) {
     let outputDir;
     let preferLocal;
     if (isNonInteractive) {
-      apiKey = opts.apiKey || process.env.SUPERGLUE_API_KEY;
+      apiKey = resolvedApiKey;
       if (!apiKey) {
         error("API key is required (--api-key or SUPERGLUE_API_KEY)");
         process.exit(1);
       }
-      endpoint = opts.endpoint;
+      endpoint = resolvedEndpoint || "https://api.superglue.cloud";
       const defaultWeb = endpoint.replace(/:3002\b/, ":3001").replace(/api\.superglue/, "app.superglue");
       webEndpoint = opts.webEndpoint || defaultWeb;
       outputMode = opts.outputMode === "stdout+file" ? "stdout+file" : "stdout";
@@ -22504,7 +22553,10 @@ function registerInitCommand(program2) {
         error("API key is required");
         process.exit(1);
       }
-      endpoint = await prompt("  API Endpoint", opts.endpoint);
+      endpoint = await prompt(
+        "  API Endpoint",
+        resolvedEndpoint || "https://api.superglue.cloud"
+      );
       const defaultWeb = endpoint.replace(/:3002\b/, ":3001").replace(/api\.superglue/, "app.superglue");
       webEndpoint = await prompt("  Web Endpoint (for OAuth callbacks)", defaultWeb);
       const spin = spinner("Verifying connection...");
@@ -23030,10 +23082,9 @@ function registerFindCommand(parent, getContext2) {
   parent.command("list").description("List all tools").action(async () => {
     const { client } = getContext2();
     try {
-      const { items } = await client.listWorkflows(100);
-      const tools = items.filter((t) => !t.archived);
+      const { items } = await client.listWorkflows(1e3);
       table(
-        tools.map((t) => ({
+        items.map((t) => ({
           id: t.id,
           instruction: (t.instruction || "").slice(0, 60),
           steps: t.steps?.length || 0
@@ -23058,25 +23109,29 @@ function registerFindCommand(parent, getContext2) {
         return;
       }
       const searchQuery = (query || "").trim() || "*";
-      if (searchQuery === "*") {
-        const { items } = await client.listWorkflows(100);
-        const tools = items.filter((t) => !t.archived).map((t) => ({
+      const { items } = await client.listWorkflows(1e3);
+      const filtered = searchQuery === "*" ? items : (() => {
+        const keywords = searchQuery.toLowerCase().split(/\s+/).filter((k) => k.length > 0);
+        const scored = items.map((t) => {
+          const text = [t.id, t.name, t.instruction].filter(Boolean).join(" ").toLowerCase();
+          return {
+            tool: t,
+            score: keywords.filter((kw) => text.includes(kw)).length
+          };
+        });
+        const matches = scored.filter((s) => s.score > 0);
+        if (matches.length === 0) return items;
+        matches.sort((a, b) => b.score - a.score);
+        return matches.map((m) => m.tool);
+      })();
+      output({
+        success: true,
+        tools: filtered.map((t) => ({
           id: t.id,
           instruction: (t.instruction || "").slice(0, 80),
           steps: t.steps?.length || 0
-        }));
-        output({ success: true, tools });
-      } else {
-        const tools = await client.findRelevantTools(searchQuery);
-        output({
-          success: true,
-          tools: tools.map((t) => ({
-            id: t.id,
-            instruction: (t.instruction || "").slice(0, 80),
-            steps: t.steps?.length || 0
-          }))
-        });
-      }
+        }))
+      });
     } catch (err) {
       error(err.message);
       process.exit(1);
@@ -23096,7 +23151,7 @@ function registerToolCommands(program2, getContext2) {
 
 // src/commands/system/create.ts
 var fs8 = __toESM(require("fs"));
-var import_commander = require("commander");
+var import_commander2 = require("commander");
 var import_shared6 = __toESM(require_dist2());
 async function collectSensitiveCredentials(fields) {
   const creds = {};
@@ -23119,7 +23174,7 @@ function registerCreateCommand(parent, getContext2) {
     "--template <id>",
     "Template ID \u2014 auto-fills URL, OAuth config, and credentials. Auto-detected from URL if omitted."
   ).option("--instructions <text>", "Specific instructions").option("--credentials <json>", "Non-sensitive credentials JSON").option("--sensitive-credentials <fields>", "Comma-separated sensitive credential field names").option("--docs-url <url>", "Documentation URL to scrape").option("--openapi-url <url>", "OpenAPI spec URL").addOption(
-    new import_commander.Option("--env <environment>", "Environment: dev or prod (default: prod)").choices([
+    new import_commander2.Option("--env <environment>", "Environment: dev or prod (default: prod)").choices([
       "dev",
       "prod"
     ])
@@ -23258,10 +23313,10 @@ ${oauthTemplates}
 }
 
 // src/commands/system/edit.ts
-var import_commander2 = require("commander");
+var import_commander3 = require("commander");
 function registerEditCommand2(parent, getContext2) {
   parent.command("edit").description("Edit an existing system").requiredOption("--id <id>", "System ID").option("--name <name>", "New name").option("--url <url>", "New URL").option("--instructions <text>", "New specific instructions").option("--credentials <json>", "Non-sensitive credentials JSON to merge").option("--sensitive-credentials <fields>", "Comma-separated sensitive credential field names").option("--scrape-url <url>", "Documentation URL to scrape").option("--scrape-keywords <keywords>", "Space-separated scrape keywords").addOption(
-    new import_commander2.Option("--env <environment>", "Environment: dev or prod").choices(["dev", "prod"])
+    new import_commander3.Option("--env <environment>", "Environment: dev or prod").choices(["dev", "prod"])
   ).action(async (opts) => {
     const { client } = getContext2();
     const patchPayload = { id: opts.id };
@@ -23332,7 +23387,7 @@ function registerEditCommand2(parent, getContext2) {
 }
 
 // src/commands/system/find.ts
-var import_commander3 = require("commander");
+var import_commander4 = require("commander");
 var import_shared7 = __toESM(require_dist2());
 function filterSystemFields(system) {
   const credentialKeys = Object.keys(system.credentials || {});
@@ -23366,7 +23421,7 @@ function registerFindCommand2(parent, getContext2) {
     }
   });
   parent.command("find [query]").description("Find systems by query or exact ID").option("--id <exactId>", "Exact system ID lookup").addOption(
-    new import_commander3.Option("--env <environment>", "Environment: dev or prod").choices(["dev", "prod"])
+    new import_commander4.Option("--env <environment>", "Environment: dev or prod").choices(["dev", "prod"])
   ).action(async (query, opts) => {
     const { client } = getContext2();
     try {
@@ -23412,7 +23467,7 @@ function registerFindCommand2(parent, getContext2) {
 }
 
 // src/commands/system/call.ts
-var import_commander4 = require("commander");
+var import_commander5 = require("commander");
 var import_shared8 = __toESM(require_dist2());
 function registerCallCommand(parent, getContext2) {
   parent.command("call").description("Call a system (API, database, file server)").requiredOption("--url <url>", "Full URL including protocol").option("--system-id <id>", "System ID for credential injection").option("--method <method>", "HTTP method", "GET").option("--headers <json>", "HTTP headers JSON").option("--body <string>", "Request body").option(
@@ -23424,7 +23479,7 @@ function registerCallCommand(parent, getContext2) {
     },
     []
   ).addOption(
-    new import_commander4.Option("--env <environment>", "Environment: dev or prod").choices(["dev", "prod"])
+    new import_commander5.Option("--env <environment>", "Environment: dev or prod").choices(["dev", "prod"])
   ).action(async (opts) => {
     const { client } = getContext2();
     const method = opts.method || "GET";
@@ -23850,11 +23905,47 @@ function registerUpdateCommand(program2) {
   });
 }
 
+// src/commands/skill.ts
+var fs9 = __toESM(require("fs"));
+var path6 = __toESM(require("path"));
+var SKILLS_DIR = fs9.existsSync(path6.resolve(__dirname, "skills/superglue")) ? path6.resolve(__dirname, "skills/superglue") : path6.resolve(__dirname, "../../skills/superglue");
+function registerSkillCommand(program2) {
+  program2.command("skill").description("Print the superglue skill reference (SKILL.md) for AI agents").argument("[topic]", "Optional topic: references/<topic>.md (e.g. databases, integration)").action((topic) => {
+    const file = topic ? path6.join(SKILLS_DIR, "references", `${topic}.md`) : path6.join(SKILLS_DIR, "SKILL.md");
+    if (!fs9.existsSync(file)) {
+      if (topic) {
+        const refsDir = path6.join(SKILLS_DIR, "references");
+        const available = fs9.existsSync(refsDir) ? fs9.readdirSync(refsDir).filter((f) => f.endsWith(".md")).map((f) => f.replace(".md", "")) : [];
+        error(`Topic not found: ${topic}. Available: ${available.join(", ") || "none"}`);
+      } else {
+        error(`Skill file not found: ${file}`);
+      }
+      process.exit(1);
+    }
+    process.stdout.write(fs9.readFileSync(file, "utf-8"));
+  });
+}
+
 // src/cli.ts
-var program = new import_commander5.Command();
+var program = new import_commander6.Command();
 program.name("sg").description("superglue CLI \u2014 build, run, and manage integration tools").version(CLI_VERSION).option("--api-key <key>", "superglue API key").option("--endpoint <url>", "superglue API endpoint").option("--json", "force JSON output").addHelpText(
   "after",
   `
+IMPORTANT FOR AI AGENTS:
+  Before using the sg CLI, you MUST read the skill reference for complete usage
+  instructions, patterns, and examples:
+
+    sg skill                        Print the main SKILL.md reference
+    sg skill databases              Print the databases reference
+    sg skill integration            Print the SDK/REST/webhook reference
+    sg skill file-servers           Print the file servers reference
+    sg skill transforms-and-output  Print the transforms reference
+    sg skill redis                  Print the Redis reference
+
+  The main skill reference covers: tool building, system setup, OAuth flows,
+  credential handling, variable syntax, data selectors, and common pitfalls.
+  DO NOT attempt to use sg commands without reading the skill reference first.
+
 All Commands:
   sg init                                        Set up CLI configuration
 
@@ -23883,6 +23974,7 @@ All Commands:
   sg run list [toolId]                           List runs, optionally filtered by tool
   sg run get <runId>                             Get details of a specific run
 
+  sg skill [topic]                                Print skill reference for AI agents
   sg update                                      Update CLI to latest version
   sg update --check                              Check for available updates
 
@@ -23900,6 +23992,7 @@ var getContext = () => {
 };
 registerInitCommand(program);
 registerUpdateCommand(program);
+registerSkillCommand(program);
 registerToolCommands(program, getContext);
 registerSystemCommands(program, getContext);
 registerRunCommands(program, getContext);