@wave-ai-os/wave-cli 0.1.60 → 0.1.62

package/dist/index.cjs

@@ -3,7 +3,7 @@
 
 // src/index.ts
 var import_commander2 = require("commander");
-var import_zod19 = require("zod");
+var import_zod20 = require("zod");
 
 // src/cli.ts
 var import_commander = require("commander");
@@ -1759,6 +1759,21 @@ async function runGraphqlMutationCommand(input) {
       variableTypes: input.variableTypes,
       selectionSet: input.selectionSet ?? "{ ok status errorCode data errors }"
     });
+    if (result.envelope.ok && input.transformMutationPayload) {
+      const envelopeData = result.envelope.data;
+      if (!isRecord(envelopeData) || !Object.prototype.hasOwnProperty.call(envelopeData, input.field)) {
+        throw new CliError({
+          message: "Mutation response was missing its expected payload.",
+          kind: "malformed_response",
+          status: 502,
+          exitCode: EXIT_CODES.networkOrUpstream
+        });
+      }
+      result.envelope.data = {
+        ...envelopeData,
+        [input.field]: input.transformMutationPayload(envelopeData[input.field])
+      };
+    }
     printEnvelopeAndExit(result);
   } catch (error) {
     if (isEnvelopeEmittedSignal(error)) {
@@ -2137,13 +2152,18 @@ function resolveFromSources(options, stdin, config, env) {
     normalize3(env.WAVE_API_URL),
     normalize3(config.baseUrl)
   );
-  const organizationId = firstDefined(
-    normalize3(options.organizationId),
-    normalize3(stdin.organizationId),
-    normalize3(env.WAVE_ORGANIZATION_ID),
-    normalize3(env.WAVE_ORG_ID),
-    normalize3(config.organizationId)
-  );
+  const organizationCandidates = [
+    { organizationId: normalize3(options.organizationId), source: "flag" },
+    { organizationId: normalize3(stdin.organizationId), source: "stdin" },
+    { organizationId: normalize3(env.WAVE_ORGANIZATION_ID), source: "env" },
+    { organizationId: normalize3(env.WAVE_ORG_ID), source: "env" },
+    { organizationId: normalize3(config.organizationId), source: "config" }
+  ];
+  const resolvedOrganization = organizationCandidates.find((candidate) => candidate.organizationId) ?? {
+    organizationId: void 0,
+    source: "none"
+  };
+  const organizationId = resolvedOrganization.organizationId;
   const timeoutMs = firstDefined(options.timeoutMs, stdin.timeoutMs, env.WAVE_TIMEOUT_MS, config.timeoutMs);
   const debug = firstDefined(
     options.debug,
@@ -2232,6 +2252,7 @@ function resolveFromSources(options, stdin, config, env) {
   const resolvedAuth = resolveAuthToken(options, stdin, config, env);
   return {
     organizationId,
+    organizationIdSource: resolvedOrganization.source,
     runtimeOptions: {
       token: resolvedAuth.token,
       tokenSource: resolvedAuth.token ? resolvedAuth.source : "none",
@@ -2441,6 +2462,140 @@ function registerGraphqlSearchCommand(command, config) {
   });
 }
 
+// src/authClient.ts
+var import_node_crypto2 = require("crypto");
+
+// src/redaction.ts
+var TOKENISH_PATTERNS = [
+  /\b(?:cli|wave|token|secret|bearer)[A-Za-z0-9._~+/=-]{8,}\b/gi,
+  /\b[A-Za-z0-9._~+/=-]{24,}\b/g
+];
+function redactOne(value) {
+  if (value.length <= 8) {
+    return "[redacted]";
+  }
+  return `${value.slice(0, 4)}...[redacted]...${value.slice(-4)}`;
+}
+function redactSecrets(input, knownSecrets = []) {
+  let output = input;
+  for (const secret of knownSecrets) {
+    if (!secret) continue;
+    output = output.split(secret).join(redactOne(secret));
+  }
+  for (const pattern of TOKENISH_PATTERNS) {
+    output = output.replace(pattern, (match) => redactOne(match));
+  }
+  return output;
+}
+function redactUnknown(input, knownSecrets = []) {
+  if (typeof input === "string") {
+    return redactSecrets(input, knownSecrets);
+  }
+  if (Array.isArray(input)) {
+    return input.map((entry2) => redactUnknown(entry2, knownSecrets));
+  }
+  if (!input || typeof input !== "object") {
+    return input;
+  }
+  const output = {};
+  for (const [key, value] of Object.entries(input)) {
+    if (/token|secret|authorization|bearer/i.test(key)) {
+      output[key] = typeof value === "string" ? redactSecrets(value, knownSecrets) : "[redacted]";
+      continue;
+    }
+    output[key] = redactUnknown(value, knownSecrets);
+  }
+  return output;
+}
+
+// src/authClient.ts
+function parseJsonSafely2(input) {
+  try {
+    return JSON.parse(input);
+  } catch {
+    return null;
+  }
+}
+function graphqlErrors(payload, knownSecrets) {
+  const errors = payload.errors;
+  if (!Array.isArray(errors) || errors.length === 0) return null;
+  return {
+    code: "upstream_error",
+    message: "GraphQL request failed.",
+    status: 400,
+    details: {
+      errors: redactUnknown(errors, knownSecrets)
+    }
+  };
+}
+async function authGraphqlRequest(params) {
+  const requestId = (0, import_node_crypto2.randomUUID)();
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), params.timeoutMs);
+  const knownSecrets = [params.token, ...params.knownSecrets ?? []].filter(
+    (secret) => typeof secret === "string" && secret.length > 0
+  );
+  try {
+    const url = new URL("/graphql", params.baseUrl);
+    const response = await fetch(url, {
+      method: "POST",
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/json",
+        "X-Origin": "wave-cli",
+        "X-Request-Id": requestId,
+        ...params.token ? { Authorization: `Bearer ${params.token}` } : {}
+      },
+      body: JSON.stringify({ query: params.query, variables: params.variables ?? {} }),
+      signal: controller.signal
+    });
+    const responseRequestId = response.headers.get("x-request-id") ?? requestId;
+    const text = await response.text();
+    const payload = text ? parseJsonSafely2(text) : null;
+    const graph = payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
+    const gqlError = graphqlErrors(graph, knownSecrets);
+    if (gqlError) {
+      return { ok: false, error: gqlError, requestId: responseRequestId };
+    }
+    if (!response.ok) {
+      return {
+        ok: false,
+        requestId: responseRequestId,
+        error: {
+          code: `http_${response.status}`,
+          message: "Auth request failed.",
+          status: response.status,
+          details: { body: redactUnknown(graph, knownSecrets) }
+        }
+      };
+    }
+    const data = graph.data && typeof graph.data === "object" && !Array.isArray(graph.data) ? graph.data : {};
+    return {
+      ok: true,
+      result: {
+        status: response.status,
+        requestId: responseRequestId,
+        data
+      }
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Network error.";
+    const timedOut = error instanceof Error && error.name === "AbortError";
+    return {
+      ok: false,
+      requestId,
+      error: {
+        code: timedOut ? "timeout" : "network_error",
+        message: redactSecrets(timedOut ? "Auth request timed out." : message, knownSecrets),
+        status: timedOut ? 408 : 503,
+        details: {}
+      }
+    };
+  } finally {
+    clearTimeout(timeoutId);
+  }
+}
+
 // src/commands/tasks.ts
 var projectIdSchema = import_zod2.z.string().min(1);
 var idSchema = import_zod2.z.string().min(1);
@@ -2469,6 +2624,44 @@ function parseTaskUpdateJson(raw) {
 function parseLabelIds(raw) {
   return raw.split(",").map((labelId) => labelId.trim()).filter((labelId) => labelId.length > 0);
 }
+function asRecord3(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  return value;
+}
+function asNonEmptyString2(value) {
+  if (typeof value !== "string") {
+    return void 0;
+  }
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+async function resolveTaskReadOrganizationId(params) {
+  const resolvedOrganizationId = asNonEmptyString2(params.organizationId);
+  if (params.organizationIdSource === "flag" && resolvedOrganizationId) {
+    return resolvedOrganizationId;
+  }
+  const baseUrl = asNonEmptyString2(params.runtimeOptions.baseUrl);
+  const token = asNonEmptyString2(params.runtimeOptions.token);
+  if (baseUrl && token) {
+    const result = await authGraphqlRequest({
+      baseUrl,
+      token,
+      timeoutMs: typeof params.runtimeOptions.timeoutMs === "number" ? params.runtimeOptions.timeoutMs : 1e4,
+      query: "query WaveCliTaskReadOrganization { cliAuthStatus { authenticated baseAuthStatus organization { id slug } } }"
+    });
+    if (result.ok) {
+      const status = asRecord3(result.result.data.cliAuthStatus);
+      const organization = status ? asRecord3(status.organization) : null;
+      const organizationId = organization ? asNonEmptyString2(organization.id) : void 0;
+      if (organizationId) {
+        return organizationId;
+      }
+    }
+  }
+  return resolveOrganizationId(resolvedOrganizationId);
+}
 function registerTaskCommands(program) {
   const tasks = program.command("tasks").description("Task operations");
   tasks.command("list").option("--project-id <projectId>").option("--page <page>").option("--per <per>").option("--team-id <teamId>").option("--team-ids <teamIds>").option("--member-id <memberId>").option("--meeting-id <meetingId>").option("--field-name <fieldName>").option("--field-value <fieldValue>").option("--field-blank <fieldBlank>").option("--open <open>").option("--rank-direction <rankDirection>").option("--include-archived <includeArchived>").action(async (opts, cmd) => {
@@ -2505,7 +2698,11 @@ function registerTaskCommands(program) {
   tasks.command("show").requiredOption("--id <id>").action(async (opts, cmd) => {
     const parsed = idSchema.parse(opts.id);
     const context = await resolveCommandContext(cmd.optsWithGlobals());
-    const organizationId = resolveOrganizationId(context.organizationId);
+    const organizationId = await resolveTaskReadOrganizationId({
+      organizationId: context.organizationId,
+      organizationIdSource: context.organizationIdSource,
+      runtimeOptions: context.runtimeOptions
+    });
     await runGraphqlQueryCommand({
       command: "tasks.show",
       runtimeOptions: context.runtimeOptions,
@@ -3407,16 +3604,16 @@ var displayPreferenceAttributesSelectionSet = "attributes { id viewType favorite
 var filterPreferenceAttributesSelectionSet = "attributes { id filterType filter memberId focusMemberId focusTeamId filterableId filterableType preferenceType agendaItemId }";
 var healthUpdateSummarySelectionSet = "id type value memberId status createdAt updatedAt updatableType updatableId parentUpdateId emojis { id name memberId } resources { ...ResourceSummaryFull }";
 var projectShowFullSelectionSet = `{ id type name slug description status priority createdAt updatedAt startDate targetDate archivedAt memberId organizationId teamIds emoji { id name memberId } backgroundImage { backgroundType gradientStart gradientEnd gradientDegrees color imageUrl image { url lowUrl } } favorites { id memberId } resources { ...ResourceSummaryFull } displayPreference { id type ${displayPreferenceAttributesSelectionSet} viewType favorite groupingField groupToggleState memberId focusMemberId focusTeamId displayableId displayableType preferenceType agendaItemId } filterPreferences { id type ${filterPreferenceAttributesSelectionSet} filterType filter memberId focusMemberId focusTeamId filterableId filterableType preferenceType agendaItemId } healthUpdates { ${healthUpdateSummarySelectionSet} replies { ${healthUpdateSummarySelectionSet} replies { id type } } } } fragment ResourceSummaryFull on ResourceSummary { id resourceType slug url skillId skill { id name slug emoji scope description } metadata { urlName imageUrl siteName providerName mediaType skillId skillName skillSlug skillScope skillEmoji skillDescription } attachment { id fileKey filename url } content { id name slug type firstChildSlug childCount } }`;
-function asRecord3(value) {
+function asRecord4(value) {
   return value && typeof value === "object" ? value : null;
 }
 function toNonEmptyString(value) {
   return typeof value === "string" && value.trim() !== "" ? value : void 0;
 }
 function normalizeProjectRowForDisplay(row) {
-  const record = asRecord3(row);
+  const record = asRecord4(row);
   if (!record) return row;
-  const attributes = asRecord3(record.attributes);
+  const attributes = asRecord4(record.attributes);
   const topLevelName = toNonEmptyString(record.name);
   const topLevelTitle = toNonEmptyString(record.title);
   const attributeName = toNonEmptyString(attributes?.name);
@@ -3431,7 +3628,7 @@ function normalizeProjectRowForDisplay(row) {
   };
 }
 function normalizeProjectsListForDisplay(payload) {
-  const record = asRecord3(payload);
+  const record = asRecord4(payload);
   if (!record || !Array.isArray(record.data)) return payload;
   return {
     ...record,
@@ -3639,7 +3836,7 @@ var MEETING_STATUSES = /* @__PURE__ */ new Set(["upcoming", "active", "completed
 var MEETING_REPEATS = /* @__PURE__ */ new Set(["never", "weekly", "biweekly", "monthly", "quarterly"]);
 var createHelp2 = buildDataJsonHelp("meeting", "create") ?? 'JSON object for meeting or {"meeting": {...}}';
 var updateHelp2 = buildDataJsonHelp("meeting", "update") ?? 'JSON object for meeting or {"meeting": {...}}';
-function asNonEmptyString2(value) {
+function asNonEmptyString3(value) {
   if (typeof value !== "string") {
     return void 0;
   }
@@ -3697,7 +3894,7 @@ function normalizeMeetingCreateBody(body) {
     });
   }
   const meeting = { ...entity };
-  const type = asNonEmptyString2(meeting.type);
+  const type = asNonEmptyString3(meeting.type);
   if (!type || !MEETING_TYPES.has(type)) {
     throw new CliError({
       message: "Invalid meeting.type. Use one of: TeamMeeting, OneOnOneMeeting.",
@@ -3707,8 +3904,8 @@ function normalizeMeetingCreateBody(body) {
       details: { field: "meeting.type", allowed: Array.from(MEETING_TYPES) }
     });
   }
-  const memberId = asNonEmptyString2(meeting.member_id);
-  const date = asNonEmptyString2(meeting.date);
+  const memberId = asNonEmptyString3(meeting.member_id);
+  const date = asNonEmptyString3(meeting.date);
   const startTime = toFiniteNumber(meeting.start_time, "meeting.start_time");
   const missingRequired = [];
   if (!memberId) missingRequired.push("member_id");
@@ -3723,7 +3920,7 @@ function normalizeMeetingCreateBody(body) {
       details: { requiredFields: ["member_id", "date", "start_time"], rootKey: "meeting" }
     });
   }
-  const status = asNonEmptyString2(meeting.status);
+  const status = asNonEmptyString3(meeting.status);
   if (status && !MEETING_STATUSES.has(status)) {
     throw new CliError({
       message: "Invalid meeting.status. Use one of: upcoming, active, completed.",
@@ -3733,7 +3930,7 @@ function normalizeMeetingCreateBody(body) {
       details: { field: "meeting.status", allowed: Array.from(MEETING_STATUSES) }
     });
   }
-  const repeats = asNonEmptyString2(meeting.repeats) ?? "never";
+  const repeats = asNonEmptyString3(meeting.repeats) ?? "never";
   if (!MEETING_REPEATS.has(repeats)) {
     throw new CliError({
       message: "Invalid meeting.repeats. Use one of: never, weekly, biweekly, monthly, quarterly.",
@@ -4022,7 +4219,7 @@ var SKILL_SELECTION = `{
   createdAt
   updatedAt
 }`;
-function asRecord4(value) {
+function asRecord5(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function findSkillById(id) {
@@ -4030,11 +4227,11 @@ function findSkillById(id) {
     if (!Array.isArray(payload)) {
       return null;
     }
-    return payload.find((entry2) => String(asRecord4(entry2)?.id ?? "") === id) ?? null;
+    return payload.find((entry2) => String(asRecord5(entry2)?.id ?? "") === id) ?? null;
   };
 }
 function registerSkillCommands(program) {
-  const skills = program.command("skills").description("Read Skill records");
+  const skills = program.command("skills").description("Skill record operations");
   skills.command("list").description("List Skill records").option("--scope <scope>", "Filter skills by scope").option("--query <query>", "Filter skills by search query").option("--limit <limit>", "Limit skills returned").requiredOption("--json", "Emit the stable JSON envelope").action(async (opts, cmd) => {
     const context = await resolveCommandContext(cmd.optsWithGlobals());
     const organizationId = resolveOrganizationId(context.organizationId);
@@ -4060,7 +4257,7 @@ function registerSkillCommands(program) {
       isList: true
     });
   });
-  skills.command("show").description("Read one Skill record by id").requiredOption("--id <id>", "Skill id").requiredOption("--json", "Emit the stable JSON envelope").action(async (opts, cmd) => {
+  skills.command("show").description("Read one persisted Skill record by id").requiredOption("--id <id>", "Skill id").requiredOption("--json", "Emit the stable JSON envelope").action(async (opts, cmd) => {
     const id = idSchema7.parse(opts.id);
     const context = await resolveCommandContext(cmd.optsWithGlobals());
     const organizationId = resolveOrganizationId(context.organizationId);
@@ -4422,7 +4619,7 @@ function normalizeTodosCreateBody(body) {
   }
   return { ...body, todo };
 }
-function asNonEmptyString3(value) {
+function asNonEmptyString4(value) {
   if (typeof value !== "string") {
     return void 0;
   }
@@ -4430,7 +4627,7 @@ function asNonEmptyString3(value) {
   return trimmed.length > 0 ? trimmed : void 0;
 }
 function validateEnumField(params) {
-  const value = asNonEmptyString3(params.rawValue);
+  const value = asNonEmptyString4(params.rawValue);
   if (!value) {
     return void 0;
   }
@@ -4464,7 +4661,7 @@ function normalizeKnowledgeCreateBody(body) {
     message: "Invalid content.status. Use one of: draft, published."
   });
   content.status = status ?? "draft";
-  const memberId = asNonEmptyString3(content.member_id);
+  const memberId = asNonEmptyString4(content.member_id);
   if (!memberId) {
     throwMissingRequiredCreateFields("content", ["member_id"]);
   }
@@ -4473,7 +4670,7 @@ function normalizeKnowledgeCreateBody(body) {
 }
 function normalizeNewsCreateBody(body) {
   const headline = ensureEntityObject(body, "headline");
-  const memberId = asNonEmptyString3(headline.member_id);
+  const memberId = asNonEmptyString4(headline.member_id);
   if (!memberId) {
     throwMissingRequiredCreateFields("headline", ["member_id"]);
   }
@@ -4502,14 +4699,14 @@ function normalizeNewsCreateBody(body) {
 }
 function normalizeQuestionsCreateBody(body) {
   const question = ensureEntityObject(body, "question");
-  const summary = asNonEmptyString3(question.summary);
-  const currentName = asNonEmptyString3(question.name);
+  const summary = asNonEmptyString4(question.summary);
+  const currentName = asNonEmptyString4(question.name);
   if (!currentName && summary) {
     question.name = summary;
   }
   delete question.summary;
-  const name = asNonEmptyString3(question.name);
-  const memberId = asNonEmptyString3(question.member_id);
+  const name = asNonEmptyString4(question.name);
+  const memberId = asNonEmptyString4(question.member_id);
   const missing = [];
   if (!name) missing.push("name");
   if (!memberId) missing.push("member_id");
@@ -4531,13 +4728,13 @@ function normalizeQuestionsCreateBody(body) {
 }
 function normalizeQuestionsUpdateBody(body) {
   const question = ensureEntityObject(body, "question");
-  const summary = asNonEmptyString3(question.summary);
-  const currentName = asNonEmptyString3(question.name);
+  const summary = asNonEmptyString4(question.summary);
+  const currentName = asNonEmptyString4(question.name);
   if (!currentName && summary) {
     question.name = summary;
   }
   delete question.summary;
-  const name = asNonEmptyString3(question.name);
+  const name = asNonEmptyString4(question.name);
   if (name) {
     question.name = name;
   }
@@ -4554,9 +4751,9 @@ function normalizeQuestionsUpdateBody(body) {
 }
 function normalizePulseCreateBody(body) {
   const healthUpdate = ensureEntityObject(body, "health_update");
-  const healthUpdatableId = asNonEmptyString3(healthUpdate.health_updatable_id) ?? asNonEmptyString3(healthUpdate.updatable_id);
-  const healthUpdatableType = asNonEmptyString3(healthUpdate.health_updatable_type) ?? asNonEmptyString3(healthUpdate.updatable_type);
-  const memberId = asNonEmptyString3(healthUpdate.member_id);
+  const healthUpdatableId = asNonEmptyString4(healthUpdate.health_updatable_id) ?? asNonEmptyString4(healthUpdate.updatable_id);
+  const healthUpdatableType = asNonEmptyString4(healthUpdate.health_updatable_type) ?? asNonEmptyString4(healthUpdate.updatable_type);
+  const memberId = asNonEmptyString4(healthUpdate.member_id);
   const status = validateEnumField({
     rawValue: healthUpdate.status,
     field: "health_update.status",
@@ -4581,8 +4778,8 @@ function normalizePulseCreateBody(body) {
 }
 function normalizeSurveysCreateBody(body) {
   const survey = ensureEntityObject(body, "survey");
-  const title = asNonEmptyString3(survey.title);
-  const currentName = asNonEmptyString3(survey.name);
+  const title = asNonEmptyString4(survey.title);
+  const currentName = asNonEmptyString4(survey.name);
   if (!currentName && title) {
     survey.name = title;
   }
@@ -4611,8 +4808,8 @@ function normalizeSurveysCreateBody(body) {
 }
 function normalizeSurveysUpdateBody(body) {
   const survey = ensureEntityObject(body, "survey");
-  const title = asNonEmptyString3(survey.title);
-  const currentName = asNonEmptyString3(survey.name);
+  const title = asNonEmptyString4(survey.title);
+  const currentName = asNonEmptyString4(survey.name);
   if (!currentName && title) {
     survey.name = title;
   }
@@ -4639,8 +4836,8 @@ function normalizeSurveysUpdateBody(body) {
 }
 function normalizeFeedbacksCreateBody(body) {
   const feedback = ensureEntityObject(body, "feedback");
-  const title = asNonEmptyString3(feedback.title);
-  const currentName = asNonEmptyString3(feedback.name);
+  const title = asNonEmptyString4(feedback.title);
+  const currentName = asNonEmptyString4(feedback.name);
   if (!currentName && title) {
     feedback.name = title;
   }
@@ -4657,7 +4854,7 @@ function normalizeFeedbacksCreateBody(body) {
     allowed: FEEDBACK_QUARTERS,
     message: "Invalid feedback.quarter. Use one of: q1, q2, q3, q4."
   });
-  const year = asNonEmptyString3(feedback.year);
+  const year = asNonEmptyString4(feedback.year);
   const missing = [];
   if (!name) missing.push("name");
   if (!quarter) missing.push("quarter");
@@ -4672,8 +4869,8 @@ function normalizeFeedbacksCreateBody(body) {
 }
 function normalizeFeedbacksUpdateBody(body) {
   const feedback = ensureEntityObject(body, "feedback");
-  const title = asNonEmptyString3(feedback.title);
-  const currentName = asNonEmptyString3(feedback.name);
+  const title = asNonEmptyString4(feedback.title);
+  const currentName = asNonEmptyString4(feedback.name);
   if (!currentName && title) {
     feedback.name = title;
   }
@@ -4700,14 +4897,14 @@ function normalizeFeedbacksUpdateBody(body) {
 }
 function normalizeAccountabilityCreateBody(body) {
   const responsibility = ensureEntityObject(body, "responsibility");
-  const summary = asNonEmptyString3(responsibility.summary);
-  const currentName = asNonEmptyString3(responsibility.name);
+  const summary = asNonEmptyString4(responsibility.summary);
+  const currentName = asNonEmptyString4(responsibility.name);
   if (!currentName && summary) {
     responsibility.name = summary;
   }
   delete responsibility.summary;
-  const name = asNonEmptyString3(responsibility.name);
-  const memberId = asNonEmptyString3(responsibility.member_id);
+  const name = asNonEmptyString4(responsibility.name);
+  const memberId = asNonEmptyString4(responsibility.member_id);
   const missing = [];
   if (!name) missing.push("name");
   if (!memberId) missing.push("member_id");
@@ -4722,8 +4919,8 @@ function normalizeAccountabilityCreateBody(body) {
 }
 function normalizeAccountabilityUpdateBody(body) {
   const responsibility = ensureEntityObject(body, "responsibility");
-  const summary = asNonEmptyString3(responsibility.summary);
-  const currentName = asNonEmptyString3(responsibility.name);
+  const summary = asNonEmptyString4(responsibility.summary);
+  const currentName = asNonEmptyString4(responsibility.name);
   if (!currentName && summary) {
     responsibility.name = summary;
   }
@@ -4755,7 +4952,7 @@ function parseSmartKpiViewCreateBody(raw) {
 }
 function normalizeSmartKpiViewCreateBody(body) {
   const smartKpiView = ensureEntityObject(body, "smart_kpi_view");
-  const name = asNonEmptyString3(smartKpiView.name);
+  const name = asNonEmptyString4(smartKpiView.name);
   if (!name) {
     throwMissingRequiredCreateFields("smart_kpi_view", ["name"]);
   }
@@ -4793,9 +4990,9 @@ function buildKpisCreateMutation(params) {
     });
   }
   const smartKpi = { ...entity };
-  const name = asNonEmptyString3(smartKpi.name);
-  const smartKpiViewId = asNonEmptyString3(smartKpi.smart_kpi_view_id);
-  const measurableGroupId = asNonEmptyString3(smartKpi.measurable_group_id);
+  const name = asNonEmptyString4(smartKpi.name);
+  const smartKpiViewId = asNonEmptyString4(smartKpi.smart_kpi_view_id);
+  const measurableGroupId = asNonEmptyString4(smartKpi.measurable_group_id);
   const hasAllowedName = typeof name === "string" && SMART_KPI_NAME_SET.has(name);
   if (!name) {
     throw new CliError({
@@ -4815,7 +5012,7 @@ function buildKpisCreateMutation(params) {
       measurable_type: "number",
       condition: "greater_than_or_equal_to"
     };
-    const notes = asNonEmptyString3(smartKpi.notes);
+    const notes = asNonEmptyString4(smartKpi.notes);
     if (notes) {
       measurable.notes = notes;
     }
@@ -5218,7 +5415,7 @@ function ensureRootObject(body, rootKey) {
   }
   return { ...root };
 }
-function asNonEmptyString4(value) {
+function asNonEmptyString5(value) {
   if (typeof value !== "string") {
     return void 0;
   }
@@ -5228,7 +5425,7 @@ function asNonEmptyString4(value) {
 function normalizeOrganizationUpdateBody(body) {
   const organization = ensureRootObject(body, "organization");
   const detail = isRecord3(organization.organization_detail_attributes) ? { ...organization.organization_detail_attributes } : {};
-  const workspaceName = asNonEmptyString4(organization.workspace_name);
+  const workspaceName = asNonEmptyString5(organization.workspace_name);
   if (workspaceName) {
     detail.workspace_name = workspaceName;
   }
@@ -5241,7 +5438,7 @@ function normalizeOrganizationUpdateBody(body) {
 function normalizeOrganizationMetaProfileUpdateBody(body) {
   const root = ensureRootObject(body, "organization_meta_profile");
   const profile = isRecord3(root.profile) ? { ...root.profile } : {};
-  const title = asNonEmptyString4(root.title);
+  const title = asNonEmptyString5(root.title);
   if (title) {
     const companyIdentity = isRecord3(profile.company_identity) ? { ...profile.company_identity } : {};
     companyIdentity.one_sentence_summary = title;
@@ -5271,7 +5468,7 @@ function normalizeOrganizationMetaProfileUpdateBody(body) {
 function normalizeKeyMetricMetaProfileUpdateBody(body) {
   const root = ensureRootObject(body, "key_metric_meta_profile");
   const profile = isRecord3(root.profile) ? { ...root.profile } : {};
-  const annualRevenue = asNonEmptyString4(root.annual_revenue);
+  const annualRevenue = asNonEmptyString5(root.annual_revenue);
   if (annualRevenue) {
     const financial = isRecord3(profile.financial) ? { ...profile.financial } : {};
     financial.revenue = annualRevenue;
@@ -5442,7 +5639,7 @@ function ensureRootObject2(body, rootKey) {
   }
   return { ...root };
 }
-function asNonEmptyString5(value) {
+function asNonEmptyString6(value) {
   if (typeof value !== "string") {
     return void 0;
   }
@@ -5470,8 +5667,8 @@ function normalizeStrategicPlanUpdateBody(body) {
 }
 function normalizeStrategicObjectiveUpdateBody(body) {
   const strategicObjective = ensureRootObject2(body, "strategic_objective");
-  const title = asNonEmptyString5(strategicObjective.title);
-  if (!asNonEmptyString5(strategicObjective.summary) && title) {
+  const title = asNonEmptyString6(strategicObjective.title);
+  if (!asNonEmptyString6(strategicObjective.summary) && title) {
     strategicObjective.summary = title;
   }
   delete strategicObjective.title;
@@ -5494,8 +5691,8 @@ function normalizeStrategicObjectiveUpdateBody(body) {
 }
 function normalizeAnnualObjectiveCreateBody(body) {
   const annualObjective = ensureRootObject2(body, "annual_objective");
-  const title = asNonEmptyString5(annualObjective.title);
-  if (!asNonEmptyString5(annualObjective.name) && title) {
+  const title = asNonEmptyString6(annualObjective.title);
+  if (!asNonEmptyString6(annualObjective.name) && title) {
     annualObjective.name = title;
   }
   delete annualObjective.title;
@@ -5503,8 +5700,8 @@ function normalizeAnnualObjectiveCreateBody(body) {
 }
 function normalizeQuarterlyObjectiveCreateBody(body) {
   const quarterlyObjective = ensureRootObject2(body, "quarterly_objective");
-  const title = asNonEmptyString5(quarterlyObjective.title);
-  if (!asNonEmptyString5(quarterlyObjective.name) && title) {
+  const title = asNonEmptyString6(quarterlyObjective.title);
+  if (!asNonEmptyString6(quarterlyObjective.name) && title) {
     quarterlyObjective.name = title;
   }
   delete quarterlyObjective.title;
@@ -6305,7 +6502,7 @@ var import_zod16 = require("zod");
 
 // src/internalOptions.ts
 var INTERNAL_OPTIONS_KEY = "__waveInternalOptions";
-function asRecord5(value) {
+function asRecord6(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     return null;
   }
@@ -6319,7 +6516,7 @@ function setInternalCliOptions(program, options) {
 function getInternalCliOptions(command) {
   let current = command;
   while (current) {
-    const record = asRecord5(current[INTERNAL_OPTIONS_KEY]);
+    const record = asRecord6(current[INTERNAL_OPTIONS_KEY]);
     if (record) {
       return {
         enableRetryOnEmptyPhrase: record.enableRetryOnEmptyPhrase === true
@@ -9964,142 +10161,6 @@ function registerOsmdCommands(program) {
 
 // src/commands/auth.ts
 var import_node_child_process2 = require("child_process");
-
-// src/authClient.ts
-var import_node_crypto2 = require("crypto");
-
-// src/redaction.ts
-var TOKENISH_PATTERNS = [
-  /\b(?:cli|wave|token|secret|bearer)[A-Za-z0-9._~+/=-]{8,}\b/gi,
-  /\b[A-Za-z0-9._~+/=-]{24,}\b/g
-];
-function redactOne(value) {
-  if (value.length <= 8) {
-    return "[redacted]";
-  }
-  return `${value.slice(0, 4)}...[redacted]...${value.slice(-4)}`;
-}
-function redactSecrets(input, knownSecrets = []) {
-  let output = input;
-  for (const secret of knownSecrets) {
-    if (!secret) continue;
-    output = output.split(secret).join(redactOne(secret));
-  }
-  for (const pattern of TOKENISH_PATTERNS) {
-    output = output.replace(pattern, (match) => redactOne(match));
-  }
-  return output;
-}
-function redactUnknown(input, knownSecrets = []) {
-  if (typeof input === "string") {
-    return redactSecrets(input, knownSecrets);
-  }
-  if (Array.isArray(input)) {
-    return input.map((entry2) => redactUnknown(entry2, knownSecrets));
-  }
-  if (!input || typeof input !== "object") {
-    return input;
-  }
-  const output = {};
-  for (const [key, value] of Object.entries(input)) {
-    if (/token|secret|authorization|bearer/i.test(key)) {
-      output[key] = typeof value === "string" ? redactSecrets(value, knownSecrets) : "[redacted]";
-      continue;
-    }
-    output[key] = redactUnknown(value, knownSecrets);
-  }
-  return output;
-}
-
-// src/authClient.ts
-function parseJsonSafely2(input) {
-  try {
-    return JSON.parse(input);
-  } catch {
-    return null;
-  }
-}
-function graphqlErrors(payload, knownSecrets) {
-  const errors = payload.errors;
-  if (!Array.isArray(errors) || errors.length === 0) return null;
-  return {
-    code: "upstream_error",
-    message: "GraphQL request failed.",
-    status: 400,
-    details: {
-      errors: redactUnknown(errors, knownSecrets)
-    }
-  };
-}
-async function authGraphqlRequest(params) {
-  const requestId = (0, import_node_crypto2.randomUUID)();
-  const controller = new AbortController();
-  const timeoutId = setTimeout(() => controller.abort(), params.timeoutMs);
-  const knownSecrets = [params.token, ...params.knownSecrets ?? []].filter(
-    (secret) => typeof secret === "string" && secret.length > 0
-  );
-  try {
-    const url = new URL("/graphql", params.baseUrl);
-    const response = await fetch(url, {
-      method: "POST",
-      headers: {
-        Accept: "application/json",
-        "Content-Type": "application/json",
-        "X-Origin": "wave-cli",
-        "X-Request-Id": requestId,
-        ...params.token ? { Authorization: `Bearer ${params.token}` } : {}
-      },
-      body: JSON.stringify({ query: params.query, variables: params.variables ?? {} }),
-      signal: controller.signal
-    });
-    const responseRequestId = response.headers.get("x-request-id") ?? requestId;
-    const text = await response.text();
-    const payload = text ? parseJsonSafely2(text) : null;
-    const graph = payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
-    const gqlError = graphqlErrors(graph, knownSecrets);
-    if (gqlError) {
-      return { ok: false, error: gqlError, requestId: responseRequestId };
-    }
-    if (!response.ok) {
-      return {
-        ok: false,
-        requestId: responseRequestId,
-        error: {
-          code: `http_${response.status}`,
-          message: "Auth request failed.",
-          status: response.status,
-          details: { body: redactUnknown(graph, knownSecrets) }
-        }
-      };
-    }
-    const data = graph.data && typeof graph.data === "object" && !Array.isArray(graph.data) ? graph.data : {};
-    return {
-      ok: true,
-      result: {
-        status: response.status,
-        requestId: responseRequestId,
-        data
-      }
-    };
-  } catch (error) {
-    const message = error instanceof Error ? error.message : "Network error.";
-    const timedOut = error instanceof Error && error.name === "AbortError";
-    return {
-      ok: false,
-      requestId,
-      error: {
-        code: timedOut ? "timeout" : "network_error",
-        message: redactSecrets(timedOut ? "Auth request timed out." : message, knownSecrets),
-        status: timedOut ? 408 : 503,
-        details: {}
-      }
-    };
-  } finally {
-    clearTimeout(timeoutId);
-  }
-}
-
-// src/commands/auth.ts
 var DEFAULT_LOGIN_TIMEOUT_MS = 12e4;
 var DEFAULT_POLL_INTERVAL_MS = 2e3;
 function envelope(params) {
@@ -10127,7 +10188,7 @@ function positiveInt2(raw, fallback) {
 function requestTimeoutMs(totalTimeoutMs) {
   return Math.max(1e3, Math.min(totalTimeoutMs, 1e4));
 }
-function asRecord6(value) {
+function asRecord7(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function asString(value) {
@@ -10174,9 +10235,9 @@ function cliTokenFromPoll(payload) {
   return asString(payload.cliToken) ?? asString(payload.cli_token) ?? asString(payload.token);
 }
 function unwrapMutationResult(value) {
-  const record = asRecord6(value);
+  const record = asRecord7(value);
   if (!record) return null;
-  const data = asRecord6(record.data);
+  const data = asRecord7(record.data);
   if (data && (Object.prototype.hasOwnProperty.call(record, "ok") || Object.prototype.hasOwnProperty.call(record, "errors") || Object.prototype.hasOwnProperty.call(record, "errorCode") || Object.prototype.hasOwnProperty.call(record, "error_code"))) {
     return data;
   }
@@ -10240,7 +10301,7 @@ async function runTokenLogin(cmd, opts) {
       exitCode: mapStatusToExitCode(status.error.status)
     });
   }
-  const statusData = asRecord6(status.result.data.cliAuthStatus) ?? {};
+  const statusData = asRecord7(status.result.data.cliAuthStatus) ?? {};
   const storage = await writeStoredToken(token, baseUrl);
   const configPath2 = opts.saveBaseUrl ? await persistBaseUrl(baseUrl) : void 0;
   return printEnvelopeAndExit({
@@ -10457,7 +10518,7 @@ async function runLogout(cmd) {
     });
     if (result.ok) {
       requestId = result.result.requestId;
-      const payload = asRecord6(result.result.data.revokeCliToken) ?? {};
+      const payload = asRecord7(result.result.data.revokeCliToken) ?? {};
       revokedRemote = payload.ok !== false;
     } else {
       requestId = result.requestId;
@@ -10520,7 +10581,8 @@ async function runAuthStatus(cmd) {
       exitCode: mapStatusToExitCode(result.error.status)
     });
   }
-  const status = asRecord6(result.result.data.cliAuthStatus) ?? {};
+  const status = asRecord7(result.result.data.cliAuthStatus) ?? {};
+  const baseAuthStatus = status.baseAuthStatus;
   return printEnvelopeAndExit({
     envelope: envelope({
       ok: true,
@@ -10529,6 +10591,7 @@ async function runAuthStatus(cmd) {
       requestId: result.result.requestId,
       data: {
         authenticated: Boolean(status.authenticated),
+        baseAuthStatus: typeof baseAuthStatus === "string" ? baseAuthStatus : null,
         baseUrl,
         tokenSource,
         member: redactUnknown(status.member, [token]) ?? null,
@@ -12169,11 +12232,11 @@ function sanitizePlannerJson(value) {
   }
   return output;
 }
-function asRecord7(value) {
+function asRecord8(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function readPlannerStateKey(value, keys) {
-  const record = asRecord7(value);
+  const record = asRecord8(value);
   if (!record) {
     return null;
   }
@@ -14838,6 +14901,259 @@ function registerAiNotesCommands(program) {
   });
 }
 
+// src/commands/atlasAuthoring.ts
+var import_zod19 = require("zod");
+var idSchema14 = import_zod19.z.string().trim().min(1);
+var idempotencyKeySchema = import_zod19.z.string().min(1).refine((value) => value.trim() === value, "Idempotency key must not have leading or trailing whitespace.");
+var skillScopeSchema = import_zod19.z.enum(["ADMIN_GLOBAL", "MEMBER_PERSONAL"]);
+var isoDateSchema = import_zod19.z.iso.date();
+var AGENT_SELECTION = `{
+  id
+  type
+  name
+  slug
+  description
+  notes
+  status
+  visibility
+  model
+  runWhenMentioned
+  webAccessEnabled
+  organizationId
+  memberId
+  createdAt
+  updatedAt
+}`;
+var AUTOMATION_SELECTION = `{
+  id
+  type
+  summary
+  slug
+  description
+  notes
+  status
+  priority
+  taskType
+  aiTaskConfig
+  organizationId
+  memberId
+  createdAt
+  updatedAt
+}`;
+function asRecord9(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function asRequiredString(value) {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+function parseBooleanOption(value, optionName) {
+  if (value === void 0) return void 0;
+  if (value === "true") return true;
+  if (value === "false") return false;
+  throw new CliError({
+    message: `Invalid ${optionName}: expected true or false.`,
+    kind: "invalid_args",
+    status: 400,
+    exitCode: EXIT_CODES.invalidArgs
+  });
+}
+function parseCommaSeparatedStrings(value) {
+  if (value === void 0) return void 0;
+  const entries = String(value).split(",").map((entry2) => entry2.trim()).filter((entry2) => entry2.length > 0);
+  if (entries.length === 0) {
+    throw new CliError({
+      message: "--trusted-urls must include at least one URL.",
+      kind: "invalid_args",
+      status: 400,
+      exitCode: EXIT_CODES.invalidArgs
+    });
+  }
+  return entries;
+}
+function parseJson(value, optionName) {
+  try {
+    return JSON.parse(value);
+  } catch (error) {
+    throw new CliError({
+      message: error instanceof Error ? `Invalid ${optionName}: ${error.message}` : `Invalid ${optionName}.`,
+      kind: "invalid_args",
+      status: 400,
+      exitCode: EXIT_CODES.invalidArgs
+    });
+  }
+}
+function normalizePersistedCreatePayload(payload) {
+  const mutation = asRecord9(payload);
+  const mutationData = asRecord9(mutation?.data);
+  const persisted = asRecord9(mutationData?.data) ?? mutationData;
+  const attributes = asRecord9(persisted?.attributes);
+  const meta = asRecord9(mutationData?.meta);
+  const idempotency = asRecord9(meta?.atlas_idempotency);
+  const id = asRequiredString(persisted?.id);
+  const slug = asRequiredString(persisted?.slug) ?? asRequiredString(attributes?.slug);
+  const replay = idempotency?.replay;
+  if (!mutation || !mutationData || !persisted || !id || !slug || !idempotency || typeof replay !== "boolean") {
+    throw new CliError({
+      message: "Create response did not include persisted id/slug and idempotency metadata.",
+      kind: "malformed_response",
+      status: 502,
+      exitCode: EXIT_CODES.networkOrUpstream
+    });
+  }
+  return {
+    ok: mutation.ok,
+    status: mutation.status,
+    errorCode: mutation.errorCode ?? null,
+    errors: mutation.errors ?? null,
+    persisted: { id, slug },
+    idempotency: {
+      object_type: asRequiredString(idempotency.object_type),
+      id: asRequiredString(idempotency.id),
+      slug: asRequiredString(idempotency.slug),
+      idempotency_key: asRequiredString(idempotency.idempotency_key),
+      fingerprint: asRequiredString(idempotency.fingerprint),
+      replay,
+      action: asRequiredString(idempotency.action)
+    }
+  };
+}
+function registerAtlasAuthoringCommands(program) {
+  const agents = program.command("agents").description("Bounded Agent authoring operations");
+  agents.command("create").description("Create an Agent through the API-owned createAgent contract").requiredOption("--idempotency-key <key>", "Required create idempotency key").option("--name <name>").option("--description <description>").option("--notes <notes>").option("--member-id <memberId>").option("--status <status>").option("--visibility <visibility>").option("--model <model>").option("--run-when-mentioned <boolean>", "true or false").option("--web-access-enabled <boolean>", "true or false").option("--trusted-urls <urls>", "Comma-separated trusted URLs").action(async (opts, cmd) => {
+    const idempotencyKey = idempotencyKeySchema.parse(opts.idempotencyKey);
+    const runWhenMentioned = parseBooleanOption(opts.runWhenMentioned, "--run-when-mentioned");
+    const webAccessEnabled = parseBooleanOption(opts.webAccessEnabled, "--web-access-enabled");
+    const trustedUrls = parseCommaSeparatedStrings(opts.trustedUrls);
+    const context = await resolveCommandContext(cmd.optsWithGlobals());
+    const organizationId = resolveOrganizationId(context.organizationId);
+    await runGraphqlMutationCommand({
+      command: "agents.create",
+      operationName: "AgentsCreate",
+      runtimeOptions: context.runtimeOptions,
+      field: "create_agent",
+      variableTypes: {
+        organization_id: "ID!",
+        params: "CreateAgentParamsInput!",
+        idempotency_key: "String!"
+      },
+      variables: {
+        organization_id: organizationId,
+        params: {
+          agent: {
+            ...opts.name !== void 0 ? { name: String(opts.name) } : {},
+            ...opts.description !== void 0 ? { description: String(opts.description) } : {},
+            ...opts.notes !== void 0 ? { notes: String(opts.notes) } : {},
+            ...opts.memberId !== void 0 ? { member_id: idSchema14.parse(opts.memberId) } : {},
+            ...opts.status !== void 0 ? { status: String(opts.status) } : {},
+            ...opts.visibility !== void 0 ? { visibility: String(opts.visibility) } : {},
+            ...opts.model !== void 0 ? { model: String(opts.model) } : {},
+            ...runWhenMentioned !== void 0 ? { run_when_mentioned: runWhenMentioned } : {},
+            ...webAccessEnabled !== void 0 ? { web_access_enabled: webAccessEnabled } : {},
+            ...trustedUrls !== void 0 ? { trusted_urls: trustedUrls } : {}
+          }
+        },
+        idempotency_key: idempotencyKey
+      },
+      transformMutationPayload: normalizePersistedCreatePayload
+    });
+  });
+  agents.command("show").description("Read one persisted Agent by id").requiredOption("--id <id>", "Agent id").action(async (opts, cmd) => {
+    const id = idSchema14.parse(opts.id);
+    const context = await resolveCommandContext(cmd.optsWithGlobals());
+    const organizationId = resolveOrganizationId(context.organizationId);
+    await runGraphqlQueryCommand({
+      command: "agents.show",
+      operationName: "AgentsShow",
+      runtimeOptions: context.runtimeOptions,
+      field: "agent",
+      variables: { organization_id: organizationId, id },
+      variableTypes: { organization_id: "ID!", id: "ID!" },
+      selectionSet: AGENT_SELECTION,
+      isShow: true
+    });
+  });
+  const automations = program.command("automations").description("Bounded Automation authoring operations");
+  automations.command("create").description("Create an Automation through the API-owned createAutomation contract").requiredOption("--summary <summary>").requiredOption("--ai-task-config <json>", "Valid JSON for the API-owned ai_task_config field").requiredOption("--idempotency-key <key>", "Required create idempotency key").option("--description <description>").option("--notes <notes>").option("--member-id <memberId>").option("--status <status>").option("--priority <priority>").option("--due-date <date>", "ISO-8601 date (YYYY-MM-DD)").action(async (opts, cmd) => {
+    const idempotencyKey = idempotencyKeySchema.parse(opts.idempotencyKey);
+    const context = await resolveCommandContext(cmd.optsWithGlobals());
+    const organizationId = resolveOrganizationId(context.organizationId);
+    await runGraphqlMutationCommand({
+      command: "automations.create",
+      operationName: "AutomationsCreate",
+      runtimeOptions: context.runtimeOptions,
+      field: "create_automation",
+      variableTypes: {
+        organization_id: "ID!",
+        input: "CreateAutomationInput!",
+        idempotency_key: "String!"
+      },
+      variables: {
+        organization_id: organizationId,
+        input: {
+          summary: idSchema14.parse(opts.summary),
+          ai_task_config: parseJson(String(opts.aiTaskConfig), "--ai-task-config"),
+          ...opts.description !== void 0 ? { description: String(opts.description) } : {},
+          ...opts.notes !== void 0 ? { notes: String(opts.notes) } : {},
+          ...opts.memberId !== void 0 ? { member_id: idSchema14.parse(opts.memberId) } : {},
+          ...opts.status !== void 0 ? { status: String(opts.status) } : {},
+          ...opts.priority !== void 0 ? { priority: String(opts.priority) } : {},
+          ...opts.dueDate !== void 0 ? { due_date: isoDateSchema.parse(opts.dueDate) } : {}
+        },
+        idempotency_key: idempotencyKey
+      },
+      transformMutationPayload: normalizePersistedCreatePayload
+    });
+  });
+  automations.command("show").description("Read one persisted Automation by id").requiredOption("--id <id>", "Automation id").action(async (opts, cmd) => {
+    const id = idSchema14.parse(opts.id);
+    const context = await resolveCommandContext(cmd.optsWithGlobals());
+    const organizationId = resolveOrganizationId(context.organizationId);
+    await runGraphqlQueryCommand({
+      command: "automations.show",
+      operationName: "AutomationsShow",
+      runtimeOptions: context.runtimeOptions,
+      field: "automation",
+      variables: { organization_id: organizationId, id },
+      variableTypes: { organization_id: "ID!", id: "ID!" },
+      selectionSet: AUTOMATION_SELECTION,
+      isShow: true
+    });
+  });
+  const skills = program.commands.find((command) => command.name() === "skills");
+  if (!skills) {
+    throw new Error("Skills command must be registered before Atlas authoring commands.");
+  }
+  skills.command("create").description("Create a Skill through the API-owned createSkill contract").requiredOption("--name <name>").requiredOption("--scope <scope>", "ADMIN_GLOBAL or MEMBER_PERSONAL").requiredOption("--idempotency-key <key>", "Required create idempotency key").option("--emoji <emoji>").option("--description <description>").action(async (opts, cmd) => {
+    const idempotencyKey = idempotencyKeySchema.parse(opts.idempotencyKey);
+    const context = await resolveCommandContext(cmd.optsWithGlobals());
+    const organizationId = resolveOrganizationId(context.organizationId);
+    await runGraphqlMutationCommand({
+      command: "skills.create",
+      operationName: "SkillsCreate",
+      runtimeOptions: context.runtimeOptions,
+      field: "create_skill",
+      variableTypes: {
+        organization_id: "ID!",
+        input: "CreateSkillInput!",
+        idempotency_key: "String!"
+      },
+      variables: {
+        organization_id: organizationId,
+        input: {
+          name: idSchema14.parse(opts.name),
+          scope: skillScopeSchema.parse(opts.scope),
+          ...opts.emoji !== void 0 ? { emoji: String(opts.emoji) } : {},
+          ...opts.description !== void 0 ? { description: String(opts.description) } : {}
+        },
+        idempotency_key: idempotencyKey
+      },
+      transformMutationPayload: normalizePersistedCreatePayload
+    });
+  });
+}
+
 // src/commands/discovery.ts
 var import_node_fs4 = require("fs");
 var import_node_path4 = require("path");
@@ -14858,6 +15174,8 @@ var PRIMARY_NAMESPACES = [
   "rocks",
   "meetings",
   "members",
+  "agents",
+  "automations",
   "skills",
   "teams",
   "issues",
@@ -14971,20 +15289,62 @@ var NAMESPACE_DOCS = {
   skills: {
     name: "skills",
     tier: "primary",
-    description: "Read-only Skill record proof surfaces.",
+    description: "Skill record readback and bounded create operations.",
     examples: [
       "wave skills list --json",
       "wave skills list --scope ADMIN_GLOBAL --json",
-      "wave skills show --id 123 --json"
+      "wave skills show --id 123 --json",
+      'wave skills create --name "Weekly planning" --scope MEMBER_PERSONAL --idempotency-key skill-create-001'
     ],
     schema: {
       output: "json-envelope-default",
-      readOnly: true,
+      mutates: true,
       safety: [
         "Uses API-owned Skill GraphQL read fields only.",
-        "Does not create, update, destroy, archive, approve, or apply Skill records."
+        "Create calls only createSkill with an explicit idempotency key.",
+        "Skill create supports the API-defined ADMIN_GLOBAL and MEMBER_PERSONAL scopes.",
+        "Does not update, destroy, archive, approve, or apply Skill records."
       ],
-      commands: ["list", "show"]
+      commands: ["list", "show", "create"]
+    }
+  },
+  agents: {
+    name: "agents",
+    tier: "primary",
+    description: "Bounded Agent create and persisted readback operations.",
+    examples: [
+      'wave agents create --name "Planning helper" --idempotency-key agent-create-001',
+      "wave agents show --id 123"
+    ],
+    schema: {
+      output: "json-envelope-default",
+      mutates: true,
+      safety: [
+        "Create calls only createAgent with an explicit idempotency key.",
+        "Create preserves API-owned defaults by sending only supplied typed Agent fields.",
+        "Show uses the API-owned agent query by id; no slug fallback is implemented."
+      ],
+      commands: ["create", "show"]
+    }
+  },
+  automations: {
+    name: "automations",
+    tier: "primary",
+    description: "Bounded Automation create and persisted readback operations.",
+    examples: [
+      `wave automations create --summary "Weekly review" --ai-task-config '{"prompt":"Review tasks"}' --idempotency-key automation-create-001`,
+      "wave automations show --id 123"
+    ],
+    schema: {
+      output: "json-envelope-default",
+      mutates: true,
+      safety: [
+        "Create calls only createAutomation with an explicit idempotency key.",
+        "Only the API-defined ai_task_config field accepts validated JSON.",
+        "Does not create a project Task, run an Automation, or invoke AI OS actions.",
+        "Show uses the API-owned automation query by id; no slug fallback is implemented."
+      ],
+      commands: ["create", "show"]
     }
   },
   broadcast: {
@@ -15798,7 +16158,7 @@ function attachDiscoveryHelp(program) {
 }
 
 // src/version.ts
-var CLI_VERSION = "0.1.60";
+var CLI_VERSION = "0.1.62";
 
 // src/cli.ts
 function buildCli(options) {
@@ -15853,6 +16213,7 @@ function buildCli(options) {
   registerMeetingCommands(program);
   registerMemberCommands(program);
   registerSkillCommands(program);
+  registerAtlasAuthoringCommands(program);
   registerTeamCommands(program);
   registerOrganizationCommands(program);
   registerIssueCommands(program);
@@ -15932,13 +16293,13 @@ main().catch((error) => {
     });
     return;
   }
-  if (error instanceof import_zod19.ZodError || error instanceof import_commander2.InvalidArgumentError) {
+  if (error instanceof import_zod20.ZodError || error instanceof import_commander2.InvalidArgumentError) {
     printCliFailure({
       status: 400,
       code: "invalid_args",
       message: "Invalid command arguments.",
       details: {
-        issues: error instanceof import_zod19.ZodError ? error.issues : [{ message: error.message, code: "invalid_argument" }]
+        issues: error instanceof import_zod20.ZodError ? error.issues : [{ message: error.message, code: "invalid_argument" }]
       },
       exitCode: EXIT_CODES.invalidArgs
     });