@wave-ai-os/wave-cli 0.1.61 → 0.1.63

package/dist/index.js

@@ -106,10 +106,10 @@ function parseDebug(rawDebugEnv) {
   return lowered === "1" || lowered === "true" || lowered === "yes";
 }
 function getConfig(options) {
-  const token = options.token ?? options.jwt ?? process.env.WAVE_API_TOKEN ?? process.env.WAVE_JWT;
+  const token = options.token ?? process.env.WAVE_API_TOKEN;
   if (!token) {
     throw new CliError({
-      message: "Missing API token. Pass --token/--jwt, use --token-stdin/--auth-json-stdin, or set WAVE_API_TOKEN/WAVE_JWT.",
+      message: "Missing API token. Pass --token, use --token-stdin/--auth-json-stdin, or set WAVE_API_TOKEN.",
       kind: "missing_auth",
       status: 401,
       exitCode: EXIT_CODES.missingOrInvalidAuth
@@ -1758,6 +1758,21 @@ async function runGraphqlMutationCommand(input) {
       variableTypes: input.variableTypes,
       selectionSet: input.selectionSet ?? "{ ok status errorCode data errors }"
     });
+    if (result.envelope.ok && input.transformMutationPayload) {
+      const envelopeData = result.envelope.data;
+      if (!isRecord(envelopeData) || !Object.prototype.hasOwnProperty.call(envelopeData, input.field)) {
+        throw new CliError({
+          message: "Mutation response was missing its expected payload.",
+          kind: "malformed_response",
+          status: 502,
+          exitCode: EXIT_CODES.networkOrUpstream
+        });
+      }
+      result.envelope.data = {
+        ...envelopeData,
+        [input.field]: input.transformMutationPayload(envelopeData[input.field])
+      };
+    }
     printEnvelopeAndExit(result);
   } catch (error) {
     if (isEnvelopeEmittedSignal(error)) {
@@ -2001,7 +2016,142 @@ async function getAuthStorageInfo(baseUrl) {
   return { kind: "file", available, path };
 }
 
+// src/authClient.ts
+import { randomUUID as randomUUID2 } from "crypto";
+
+// src/redaction.ts
+var TOKENISH_PATTERNS = [
+  /\b(?:cli|wave|token|secret|bearer)[A-Za-z0-9._~+/=-]{8,}\b/gi,
+  /\b[A-Za-z0-9._~+/=-]{24,}\b/g
+];
+function redactOne(value) {
+  if (value.length <= 8) {
+    return "[redacted]";
+  }
+  return `${value.slice(0, 4)}...[redacted]...${value.slice(-4)}`;
+}
+function redactSecrets(input, knownSecrets = []) {
+  let output = input;
+  for (const secret of knownSecrets) {
+    if (!secret) continue;
+    output = output.split(secret).join(redactOne(secret));
+  }
+  for (const pattern of TOKENISH_PATTERNS) {
+    output = output.replace(pattern, (match) => redactOne(match));
+  }
+  return output;
+}
+function redactUnknown(input, knownSecrets = []) {
+  if (typeof input === "string") {
+    return redactSecrets(input, knownSecrets);
+  }
+  if (Array.isArray(input)) {
+    return input.map((entry2) => redactUnknown(entry2, knownSecrets));
+  }
+  if (!input || typeof input !== "object") {
+    return input;
+  }
+  const output = {};
+  for (const [key, value] of Object.entries(input)) {
+    if (/token|secret|authorization|bearer/i.test(key)) {
+      output[key] = typeof value === "string" ? redactSecrets(value, knownSecrets) : "[redacted]";
+      continue;
+    }
+    output[key] = redactUnknown(value, knownSecrets);
+  }
+  return output;
+}
+
+// src/authClient.ts
+function parseJsonSafely2(input) {
+  try {
+    return JSON.parse(input);
+  } catch {
+    return null;
+  }
+}
+function graphqlErrors(payload, knownSecrets) {
+  const errors = payload.errors;
+  if (!Array.isArray(errors) || errors.length === 0) return null;
+  return {
+    code: "upstream_error",
+    message: "GraphQL request failed.",
+    status: 400,
+    details: {
+      errors: redactUnknown(errors, knownSecrets)
+    }
+  };
+}
+async function authGraphqlRequest(params) {
+  const requestId = randomUUID2();
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), params.timeoutMs);
+  const knownSecrets = [params.token, ...params.knownSecrets ?? []].filter(
+    (secret) => typeof secret === "string" && secret.length > 0
+  );
+  try {
+    const url = new URL("/graphql", params.baseUrl);
+    const response = await fetch(url, {
+      method: "POST",
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/json",
+        "X-Origin": "wave-cli",
+        "X-Request-Id": requestId,
+        ...params.token ? { Authorization: `Bearer ${params.token}` } : {}
+      },
+      body: JSON.stringify({ query: params.query, variables: params.variables ?? {} }),
+      signal: controller.signal
+    });
+    const responseRequestId = response.headers.get("x-request-id") ?? requestId;
+    const text = await response.text();
+    const payload = text ? parseJsonSafely2(text) : null;
+    const graph = payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
+    const gqlError = graphqlErrors(graph, knownSecrets);
+    if (gqlError) {
+      return { ok: false, error: gqlError, requestId: responseRequestId };
+    }
+    if (!response.ok) {
+      return {
+        ok: false,
+        requestId: responseRequestId,
+        error: {
+          code: `http_${response.status}`,
+          message: "Auth request failed.",
+          status: response.status,
+          details: { body: redactUnknown(graph, knownSecrets) }
+        }
+      };
+    }
+    const data = graph.data && typeof graph.data === "object" && !Array.isArray(graph.data) ? graph.data : {};
+    return {
+      ok: true,
+      result: {
+        status: response.status,
+        requestId: responseRequestId,
+        data
+      }
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Network error.";
+    const timedOut = error instanceof Error && error.name === "AbortError";
+    return {
+      ok: false,
+      requestId,
+      error: {
+        code: timedOut ? "timeout" : "network_error",
+        message: redactSecrets(timedOut ? "Auth request timed out." : message, knownSecrets),
+        status: timedOut ? 408 : 503,
+        details: {}
+      }
+    };
+  } finally {
+    clearTimeout(timeoutId);
+  }
+}
+
 // src/commands/runtimeOptions.ts
+var CLI_AUTH_STATUS_QUERY = "query WaveCliAuthenticatedOrganization { cliAuthStatus { authenticated baseAuthStatus organization { id slug } } }";
 var stdinPromise = null;
 function normalize3(raw) {
   if (typeof raw !== "string") {
@@ -2035,7 +2185,6 @@ function parseAuthJson(raw) {
     const obj = parsed;
     return {
       token: normalize3(obj.token),
-      jwt: normalize3(obj.jwt),
       baseUrl: normalize3(obj.baseUrl ?? obj.base_url),
       organizationId: normalize3(obj.organizationId ?? obj.organization_id),
       timeoutMs: typeof obj.timeoutMs === "number" || typeof obj.timeoutMs === "string" ? obj.timeoutMs : typeof obj.timeout_ms === "number" || typeof obj.timeout_ms === "string" ? obj.timeout_ms : void 0,
@@ -2118,13 +2267,10 @@ function firstDefined(...values) {
 function resolveAuthToken(options, stdin, config, env) {
   const candidates = [
     { token: normalize3(options.token), source: "flag" },
-    { token: normalize3(options.jwt), source: "flag" },
     { token: normalize3(stdin.token), source: "stdin" },
-    { token: normalize3(stdin.jwt), source: "stdin" },
     { token: normalize3(env.WAVE_API_TOKEN), source: "env" },
-    { token: normalize3(env.WAVE_JWT), source: "env" },
     { token: normalize3(config.token), source: "config" },
-    { token: normalize3(config.jwt), source: "config" }
+    { token: normalize3(config.token), source: "config" }
   ];
   return candidates.find((candidate) => candidate.token) ?? { source: "none" };
 }
@@ -2275,6 +2421,34 @@ async function resolveWithStoredToken(context) {
     }
   };
 }
+async function resolveWithAuthenticatedOrganization(context) {
+  if (context.organizationIdSource === "flag" && context.organizationId) {
+    return context;
+  }
+  const baseUrl = normalize3(context.runtimeOptions.baseUrl);
+  const token = normalize3(context.runtimeOptions.token);
+  if (!baseUrl || !token) {
+    return {
+      ...context,
+      organizationId: void 0,
+      organizationIdSource: "none",
+      runtimeOptions: { ...context.runtimeOptions, organizationId: void 0 }
+    };
+  }
+  const response = await authGraphqlRequest({
+    baseUrl,
+    token,
+    timeoutMs: typeof context.runtimeOptions.timeoutMs === "number" ? context.runtimeOptions.timeoutMs : 1e4,
+    query: CLI_AUTH_STATUS_QUERY
+  });
+  const organizationId = response.ok ? organizationIdFromCliAuthStatus(response.result.data) : void 0;
+  return {
+    ...context,
+    organizationId,
+    organizationIdSource: organizationId ? "token" : "none",
+    runtimeOptions: { ...context.runtimeOptions, organizationId }
+  };
+}
 function defaultConfigPath(env) {
   const explicitEnv = normalize3(env.WAVE_CONFIG_PATH);
   if (explicitEnv) return explicitEnv;
@@ -2337,11 +2511,21 @@ async function resolveStdinContext(options) {
   }
   return parseAuthJson(raw);
 }
-async function resolveCommandContext(options) {
+async function resolveUnscopedCommandContext(options) {
   const stdin = await resolveStdinContext(options);
   const config = await resolveConfigFileContext(options, process.env);
   return resolveWithStoredToken(resolveFromSources(options, stdin, config, process.env));
 }
+async function resolveCommandContext(options) {
+  return resolveWithAuthenticatedOrganization(await resolveUnscopedCommandContext(options));
+}
+function organizationIdFromCliAuthStatus(data) {
+  const status = data.cliAuthStatus;
+  if (!status || typeof status !== "object" || Array.isArray(status)) return void 0;
+  const organization = status.organization;
+  if (!organization || typeof organization !== "object" || Array.isArray(organization)) return void 0;
+  return normalize3(organization.id);
+}
 
 // src/commands/organization.ts
 function normalize4(input) {
@@ -2355,10 +2539,14 @@ function resolveOrganizationId(raw) {
   const organizationId = normalize4(raw);
   if (!organizationId) {
     throw new CliError({
-      message: "Missing organization ID. Pass --organization-id, provide via --auth-json-stdin, or set WAVE_ORGANIZATION_ID.",
-      kind: "invalid_args",
-      status: 400,
-      exitCode: EXIT_CODES.invalidArgs
+      message: "Missing authenticated organization scope. Pass --organization-id explicitly or authenticate with a Wave CLI token scoped to an organization.",
+      kind: "missing_auth",
+      status: 401,
+      exitCode: EXIT_CODES.missingOrInvalidAuth,
+      details: {
+        suggestedCommands: ["wave auth status", "wave login"],
+        ignoredOrganizationSources: ["stdin", "env", "config"]
+      }
     });
   }
   return organizationId;
@@ -2446,140 +2634,6 @@ function registerGraphqlSearchCommand(command, config) {
   });
 }
 
-// src/authClient.ts
-import { randomUUID as randomUUID2 } from "crypto";
-
-// src/redaction.ts
-var TOKENISH_PATTERNS = [
-  /\b(?:cli|wave|token|secret|bearer)[A-Za-z0-9._~+/=-]{8,}\b/gi,
-  /\b[A-Za-z0-9._~+/=-]{24,}\b/g
-];
-function redactOne(value) {
-  if (value.length <= 8) {
-    return "[redacted]";
-  }
-  return `${value.slice(0, 4)}...[redacted]...${value.slice(-4)}`;
-}
-function redactSecrets(input, knownSecrets = []) {
-  let output = input;
-  for (const secret of knownSecrets) {
-    if (!secret) continue;
-    output = output.split(secret).join(redactOne(secret));
-  }
-  for (const pattern of TOKENISH_PATTERNS) {
-    output = output.replace(pattern, (match) => redactOne(match));
-  }
-  return output;
-}
-function redactUnknown(input, knownSecrets = []) {
-  if (typeof input === "string") {
-    return redactSecrets(input, knownSecrets);
-  }
-  if (Array.isArray(input)) {
-    return input.map((entry2) => redactUnknown(entry2, knownSecrets));
-  }
-  if (!input || typeof input !== "object") {
-    return input;
-  }
-  const output = {};
-  for (const [key, value] of Object.entries(input)) {
-    if (/token|secret|authorization|bearer/i.test(key)) {
-      output[key] = typeof value === "string" ? redactSecrets(value, knownSecrets) : "[redacted]";
-      continue;
-    }
-    output[key] = redactUnknown(value, knownSecrets);
-  }
-  return output;
-}
-
-// src/authClient.ts
-function parseJsonSafely2(input) {
-  try {
-    return JSON.parse(input);
-  } catch {
-    return null;
-  }
-}
-function graphqlErrors(payload, knownSecrets) {
-  const errors = payload.errors;
-  if (!Array.isArray(errors) || errors.length === 0) return null;
-  return {
-    code: "upstream_error",
-    message: "GraphQL request failed.",
-    status: 400,
-    details: {
-      errors: redactUnknown(errors, knownSecrets)
-    }
-  };
-}
-async function authGraphqlRequest(params) {
-  const requestId = randomUUID2();
-  const controller = new AbortController();
-  const timeoutId = setTimeout(() => controller.abort(), params.timeoutMs);
-  const knownSecrets = [params.token, ...params.knownSecrets ?? []].filter(
-    (secret) => typeof secret === "string" && secret.length > 0
-  );
-  try {
-    const url = new URL("/graphql", params.baseUrl);
-    const response = await fetch(url, {
-      method: "POST",
-      headers: {
-        Accept: "application/json",
-        "Content-Type": "application/json",
-        "X-Origin": "wave-cli",
-        "X-Request-Id": requestId,
-        ...params.token ? { Authorization: `Bearer ${params.token}` } : {}
-      },
-      body: JSON.stringify({ query: params.query, variables: params.variables ?? {} }),
-      signal: controller.signal
-    });
-    const responseRequestId = response.headers.get("x-request-id") ?? requestId;
-    const text = await response.text();
-    const payload = text ? parseJsonSafely2(text) : null;
-    const graph = payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
-    const gqlError = graphqlErrors(graph, knownSecrets);
-    if (gqlError) {
-      return { ok: false, error: gqlError, requestId: responseRequestId };
-    }
-    if (!response.ok) {
-      return {
-        ok: false,
-        requestId: responseRequestId,
-        error: {
-          code: `http_${response.status}`,
-          message: "Auth request failed.",
-          status: response.status,
-          details: { body: redactUnknown(graph, knownSecrets) }
-        }
-      };
-    }
-    const data = graph.data && typeof graph.data === "object" && !Array.isArray(graph.data) ? graph.data : {};
-    return {
-      ok: true,
-      result: {
-        status: response.status,
-        requestId: responseRequestId,
-        data
-      }
-    };
-  } catch (error) {
-    const message = error instanceof Error ? error.message : "Network error.";
-    const timedOut = error instanceof Error && error.name === "AbortError";
-    return {
-      ok: false,
-      requestId,
-      error: {
-        code: timedOut ? "timeout" : "network_error",
-        message: redactSecrets(timedOut ? "Auth request timed out." : message, knownSecrets),
-        status: timedOut ? 408 : 503,
-        details: {}
-      }
-    };
-  } finally {
-    clearTimeout(timeoutId);
-  }
-}
-
 // src/commands/tasks.ts
 var projectIdSchema = z2.string().min(1);
 var idSchema = z2.string().min(1);
@@ -2608,44 +2662,6 @@ function parseTaskUpdateJson(raw) {
 function parseLabelIds(raw) {
   return raw.split(",").map((labelId) => labelId.trim()).filter((labelId) => labelId.length > 0);
 }
-function asRecord3(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    return null;
-  }
-  return value;
-}
-function asNonEmptyString2(value) {
-  if (typeof value !== "string") {
-    return void 0;
-  }
-  const trimmed = value.trim();
-  return trimmed.length > 0 ? trimmed : void 0;
-}
-async function resolveTaskReadOrganizationId(params) {
-  const resolvedOrganizationId = asNonEmptyString2(params.organizationId);
-  if (params.organizationIdSource === "flag" && resolvedOrganizationId) {
-    return resolvedOrganizationId;
-  }
-  const baseUrl = asNonEmptyString2(params.runtimeOptions.baseUrl);
-  const token = asNonEmptyString2(params.runtimeOptions.token);
-  if (baseUrl && token) {
-    const result = await authGraphqlRequest({
-      baseUrl,
-      token,
-      timeoutMs: typeof params.runtimeOptions.timeoutMs === "number" ? params.runtimeOptions.timeoutMs : 1e4,
-      query: "query WaveCliTaskReadOrganization { cliAuthStatus { authenticated baseAuthStatus organization { id slug } } }"
-    });
-    if (result.ok) {
-      const status = asRecord3(result.result.data.cliAuthStatus);
-      const organization = status ? asRecord3(status.organization) : null;
-      const organizationId = organization ? asNonEmptyString2(organization.id) : void 0;
-      if (organizationId) {
-        return organizationId;
-      }
-    }
-  }
-  return resolveOrganizationId(resolvedOrganizationId);
-}
 function registerTaskCommands(program) {
   const tasks = program.command("tasks").description("Task operations");
   tasks.command("list").option("--project-id <projectId>").option("--page <page>").option("--per <per>").option("--team-id <teamId>").option("--team-ids <teamIds>").option("--member-id <memberId>").option("--meeting-id <meetingId>").option("--field-name <fieldName>").option("--field-value <fieldValue>").option("--field-blank <fieldBlank>").option("--open <open>").option("--rank-direction <rankDirection>").option("--include-archived <includeArchived>").action(async (opts, cmd) => {
@@ -2682,11 +2698,7 @@ function registerTaskCommands(program) {
   tasks.command("show").requiredOption("--id <id>").action(async (opts, cmd) => {
     const parsed = idSchema.parse(opts.id);
     const context = await resolveCommandContext(cmd.optsWithGlobals());
-    const organizationId = await resolveTaskReadOrganizationId({
-      organizationId: context.organizationId,
-      organizationIdSource: context.organizationIdSource,
-      runtimeOptions: context.runtimeOptions
-    });
+    const organizationId = resolveOrganizationId(context.organizationId);
     await runGraphqlQueryCommand({
       command: "tasks.show",
       runtimeOptions: context.runtimeOptions,
@@ -2698,9 +2710,9 @@ function registerTaskCommands(program) {
       isShow: true
     });
   });
-  tasks.command("create").requiredOption("--project-id <projectId>").option("--title <title>", "Legacy alias for --summary").option("--summary <summary>").action(async (opts, cmd) => {
+  tasks.command("create").requiredOption("--project-id <projectId>").option("--summary <summary>").action(async (opts, cmd) => {
     const projectId = projectIdSchema.parse(opts.projectId);
-    const summary = summarySchema.parse(opts.summary ?? opts.title);
+    const summary = summarySchema.parse(opts.summary);
     const context = await resolveCommandContext(cmd.optsWithGlobals());
     const organizationId = resolveOrganizationId(context.organizationId);
     await runGraphqlMutationCommand({
@@ -3588,16 +3600,16 @@ var displayPreferenceAttributesSelectionSet = "attributes { id viewType favorite
 var filterPreferenceAttributesSelectionSet = "attributes { id filterType filter memberId focusMemberId focusTeamId filterableId filterableType preferenceType agendaItemId }";
 var healthUpdateSummarySelectionSet = "id type value memberId status createdAt updatedAt updatableType updatableId parentUpdateId emojis { id name memberId } resources { ...ResourceSummaryFull }";
 var projectShowFullSelectionSet = `{ id type name slug description status priority createdAt updatedAt startDate targetDate archivedAt memberId organizationId teamIds emoji { id name memberId } backgroundImage { backgroundType gradientStart gradientEnd gradientDegrees color imageUrl image { url lowUrl } } favorites { id memberId } resources { ...ResourceSummaryFull } displayPreference { id type ${displayPreferenceAttributesSelectionSet} viewType favorite groupingField groupToggleState memberId focusMemberId focusTeamId displayableId displayableType preferenceType agendaItemId } filterPreferences { id type ${filterPreferenceAttributesSelectionSet} filterType filter memberId focusMemberId focusTeamId filterableId filterableType preferenceType agendaItemId } healthUpdates { ${healthUpdateSummarySelectionSet} replies { ${healthUpdateSummarySelectionSet} replies { id type } } } } fragment ResourceSummaryFull on ResourceSummary { id resourceType slug url skillId skill { id name slug emoji scope description } metadata { urlName imageUrl siteName providerName mediaType skillId skillName skillSlug skillScope skillEmoji skillDescription } attachment { id fileKey filename url } content { id name slug type firstChildSlug childCount } }`;
-function asRecord4(value) {
+function asRecord3(value) {
   return value && typeof value === "object" ? value : null;
 }
 function toNonEmptyString(value) {
   return typeof value === "string" && value.trim() !== "" ? value : void 0;
 }
 function normalizeProjectRowForDisplay(row) {
-  const record = asRecord4(row);
+  const record = asRecord3(row);
   if (!record) return row;
-  const attributes = asRecord4(record.attributes);
+  const attributes = asRecord3(record.attributes);
   const topLevelName = toNonEmptyString(record.name);
   const topLevelTitle = toNonEmptyString(record.title);
   const attributeName = toNonEmptyString(attributes?.name);
@@ -3612,7 +3624,7 @@ function normalizeProjectRowForDisplay(row) {
   };
 }
 function normalizeProjectsListForDisplay(payload) {
-  const record = asRecord4(payload);
+  const record = asRecord3(payload);
   if (!record || !Array.isArray(record.data)) return payload;
   return {
     ...record,
@@ -3820,7 +3832,7 @@ var MEETING_STATUSES = /* @__PURE__ */ new Set(["upcoming", "active", "completed
 var MEETING_REPEATS = /* @__PURE__ */ new Set(["never", "weekly", "biweekly", "monthly", "quarterly"]);
 var createHelp2 = buildDataJsonHelp("meeting", "create") ?? 'JSON object for meeting or {"meeting": {...}}';
 var updateHelp2 = buildDataJsonHelp("meeting", "update") ?? 'JSON object for meeting or {"meeting": {...}}';
-function asNonEmptyString3(value) {
+function asNonEmptyString2(value) {
   if (typeof value !== "string") {
     return void 0;
   }
@@ -3878,7 +3890,7 @@ function normalizeMeetingCreateBody(body) {
     });
   }
   const meeting = { ...entity };
-  const type = asNonEmptyString3(meeting.type);
+  const type = asNonEmptyString2(meeting.type);
   if (!type || !MEETING_TYPES.has(type)) {
     throw new CliError({
       message: "Invalid meeting.type. Use one of: TeamMeeting, OneOnOneMeeting.",
@@ -3888,8 +3900,8 @@ function normalizeMeetingCreateBody(body) {
       details: { field: "meeting.type", allowed: Array.from(MEETING_TYPES) }
     });
   }
-  const memberId = asNonEmptyString3(meeting.member_id);
-  const date = asNonEmptyString3(meeting.date);
+  const memberId = asNonEmptyString2(meeting.member_id);
+  const date = asNonEmptyString2(meeting.date);
   const startTime = toFiniteNumber(meeting.start_time, "meeting.start_time");
   const missingRequired = [];
   if (!memberId) missingRequired.push("member_id");
@@ -3904,7 +3916,7 @@ function normalizeMeetingCreateBody(body) {
       details: { requiredFields: ["member_id", "date", "start_time"], rootKey: "meeting" }
     });
   }
-  const status = asNonEmptyString3(meeting.status);
+  const status = asNonEmptyString2(meeting.status);
   if (status && !MEETING_STATUSES.has(status)) {
     throw new CliError({
       message: "Invalid meeting.status. Use one of: upcoming, active, completed.",
@@ -3914,7 +3926,7 @@ function normalizeMeetingCreateBody(body) {
       details: { field: "meeting.status", allowed: Array.from(MEETING_STATUSES) }
     });
   }
-  const repeats = asNonEmptyString3(meeting.repeats) ?? "never";
+  const repeats = asNonEmptyString2(meeting.repeats) ?? "never";
   if (!MEETING_REPEATS.has(repeats)) {
     throw new CliError({
       message: "Invalid meeting.repeats. Use one of: never, weekly, biweekly, monthly, quarterly.",
@@ -4203,7 +4215,7 @@ var SKILL_SELECTION = `{
   createdAt
   updatedAt
 }`;
-function asRecord5(value) {
+function asRecord4(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function findSkillById(id) {
@@ -4211,11 +4223,11 @@ function findSkillById(id) {
     if (!Array.isArray(payload)) {
       return null;
     }
-    return payload.find((entry2) => String(asRecord5(entry2)?.id ?? "") === id) ?? null;
+    return payload.find((entry2) => String(asRecord4(entry2)?.id ?? "") === id) ?? null;
   };
 }
 function registerSkillCommands(program) {
-  const skills = program.command("skills").description("Read Skill records");
+  const skills = program.command("skills").description("Skill record operations");
   skills.command("list").description("List Skill records").option("--scope <scope>", "Filter skills by scope").option("--query <query>", "Filter skills by search query").option("--limit <limit>", "Limit skills returned").requiredOption("--json", "Emit the stable JSON envelope").action(async (opts, cmd) => {
     const context = await resolveCommandContext(cmd.optsWithGlobals());
     const organizationId = resolveOrganizationId(context.organizationId);
@@ -4241,7 +4253,7 @@ function registerSkillCommands(program) {
       isList: true
     });
   });
-  skills.command("show").description("Read one Skill record by id").requiredOption("--id <id>", "Skill id").requiredOption("--json", "Emit the stable JSON envelope").action(async (opts, cmd) => {
+  skills.command("show").description("Read one persisted Skill record by id").requiredOption("--id <id>", "Skill id").requiredOption("--json", "Emit the stable JSON envelope").action(async (opts, cmd) => {
     const id = idSchema7.parse(opts.id);
     const context = await resolveCommandContext(cmd.optsWithGlobals());
     const organizationId = resolveOrganizationId(context.organizationId);
@@ -4603,7 +4615,7 @@ function normalizeTodosCreateBody(body) {
   }
   return { ...body, todo };
 }
-function asNonEmptyString4(value) {
+function asNonEmptyString3(value) {
   if (typeof value !== "string") {
     return void 0;
   }
@@ -4611,7 +4623,7 @@ function asNonEmptyString4(value) {
   return trimmed.length > 0 ? trimmed : void 0;
 }
 function validateEnumField(params) {
-  const value = asNonEmptyString4(params.rawValue);
+  const value = asNonEmptyString3(params.rawValue);
   if (!value) {
     return void 0;
   }
@@ -4645,7 +4657,7 @@ function normalizeKnowledgeCreateBody(body) {
     message: "Invalid content.status. Use one of: draft, published."
   });
   content.status = status ?? "draft";
-  const memberId = asNonEmptyString4(content.member_id);
+  const memberId = asNonEmptyString3(content.member_id);
   if (!memberId) {
     throwMissingRequiredCreateFields("content", ["member_id"]);
   }
@@ -4654,7 +4666,7 @@ function normalizeKnowledgeCreateBody(body) {
 }
 function normalizeNewsCreateBody(body) {
   const headline = ensureEntityObject(body, "headline");
-  const memberId = asNonEmptyString4(headline.member_id);
+  const memberId = asNonEmptyString3(headline.member_id);
   if (!memberId) {
     throwMissingRequiredCreateFields("headline", ["member_id"]);
   }
@@ -4683,14 +4695,14 @@ function normalizeNewsCreateBody(body) {
 }
 function normalizeQuestionsCreateBody(body) {
   const question = ensureEntityObject(body, "question");
-  const summary = asNonEmptyString4(question.summary);
-  const currentName = asNonEmptyString4(question.name);
+  const summary = asNonEmptyString3(question.summary);
+  const currentName = asNonEmptyString3(question.name);
   if (!currentName && summary) {
     question.name = summary;
   }
   delete question.summary;
-  const name = asNonEmptyString4(question.name);
-  const memberId = asNonEmptyString4(question.member_id);
+  const name = asNonEmptyString3(question.name);
+  const memberId = asNonEmptyString3(question.member_id);
   const missing = [];
   if (!name) missing.push("name");
   if (!memberId) missing.push("member_id");
@@ -4712,13 +4724,13 @@ function normalizeQuestionsCreateBody(body) {
 }
 function normalizeQuestionsUpdateBody(body) {
   const question = ensureEntityObject(body, "question");
-  const summary = asNonEmptyString4(question.summary);
-  const currentName = asNonEmptyString4(question.name);
+  const summary = asNonEmptyString3(question.summary);
+  const currentName = asNonEmptyString3(question.name);
   if (!currentName && summary) {
     question.name = summary;
   }
   delete question.summary;
-  const name = asNonEmptyString4(question.name);
+  const name = asNonEmptyString3(question.name);
   if (name) {
     question.name = name;
   }
@@ -4735,9 +4747,9 @@ function normalizeQuestionsUpdateBody(body) {
 }
 function normalizePulseCreateBody(body) {
   const healthUpdate = ensureEntityObject(body, "health_update");
-  const healthUpdatableId = asNonEmptyString4(healthUpdate.health_updatable_id) ?? asNonEmptyString4(healthUpdate.updatable_id);
-  const healthUpdatableType = asNonEmptyString4(healthUpdate.health_updatable_type) ?? asNonEmptyString4(healthUpdate.updatable_type);
-  const memberId = asNonEmptyString4(healthUpdate.member_id);
+  const healthUpdatableId = asNonEmptyString3(healthUpdate.health_updatable_id) ?? asNonEmptyString3(healthUpdate.updatable_id);
+  const healthUpdatableType = asNonEmptyString3(healthUpdate.health_updatable_type) ?? asNonEmptyString3(healthUpdate.updatable_type);
+  const memberId = asNonEmptyString3(healthUpdate.member_id);
   const status = validateEnumField({
     rawValue: healthUpdate.status,
     field: "health_update.status",
@@ -4762,8 +4774,8 @@ function normalizePulseCreateBody(body) {
 }
 function normalizeSurveysCreateBody(body) {
   const survey = ensureEntityObject(body, "survey");
-  const title = asNonEmptyString4(survey.title);
-  const currentName = asNonEmptyString4(survey.name);
+  const title = asNonEmptyString3(survey.title);
+  const currentName = asNonEmptyString3(survey.name);
   if (!currentName && title) {
     survey.name = title;
   }
@@ -4792,8 +4804,8 @@ function normalizeSurveysCreateBody(body) {
 }
 function normalizeSurveysUpdateBody(body) {
   const survey = ensureEntityObject(body, "survey");
-  const title = asNonEmptyString4(survey.title);
-  const currentName = asNonEmptyString4(survey.name);
+  const title = asNonEmptyString3(survey.title);
+  const currentName = asNonEmptyString3(survey.name);
   if (!currentName && title) {
     survey.name = title;
   }
@@ -4820,8 +4832,8 @@ function normalizeSurveysUpdateBody(body) {
 }
 function normalizeFeedbacksCreateBody(body) {
   const feedback = ensureEntityObject(body, "feedback");
-  const title = asNonEmptyString4(feedback.title);
-  const currentName = asNonEmptyString4(feedback.name);
+  const title = asNonEmptyString3(feedback.title);
+  const currentName = asNonEmptyString3(feedback.name);
   if (!currentName && title) {
     feedback.name = title;
   }
@@ -4838,7 +4850,7 @@ function normalizeFeedbacksCreateBody(body) {
     allowed: FEEDBACK_QUARTERS,
     message: "Invalid feedback.quarter. Use one of: q1, q2, q3, q4."
   });
-  const year = asNonEmptyString4(feedback.year);
+  const year = asNonEmptyString3(feedback.year);
   const missing = [];
   if (!name) missing.push("name");
   if (!quarter) missing.push("quarter");
@@ -4853,8 +4865,8 @@ function normalizeFeedbacksCreateBody(body) {
 }
 function normalizeFeedbacksUpdateBody(body) {
   const feedback = ensureEntityObject(body, "feedback");
-  const title = asNonEmptyString4(feedback.title);
-  const currentName = asNonEmptyString4(feedback.name);
+  const title = asNonEmptyString3(feedback.title);
+  const currentName = asNonEmptyString3(feedback.name);
   if (!currentName && title) {
     feedback.name = title;
   }
@@ -4881,14 +4893,14 @@ function normalizeFeedbacksUpdateBody(body) {
 }
 function normalizeAccountabilityCreateBody(body) {
   const responsibility = ensureEntityObject(body, "responsibility");
-  const summary = asNonEmptyString4(responsibility.summary);
-  const currentName = asNonEmptyString4(responsibility.name);
+  const summary = asNonEmptyString3(responsibility.summary);
+  const currentName = asNonEmptyString3(responsibility.name);
   if (!currentName && summary) {
     responsibility.name = summary;
   }
   delete responsibility.summary;
-  const name = asNonEmptyString4(responsibility.name);
-  const memberId = asNonEmptyString4(responsibility.member_id);
+  const name = asNonEmptyString3(responsibility.name);
+  const memberId = asNonEmptyString3(responsibility.member_id);
   const missing = [];
   if (!name) missing.push("name");
   if (!memberId) missing.push("member_id");
@@ -4903,8 +4915,8 @@ function normalizeAccountabilityCreateBody(body) {
 }
 function normalizeAccountabilityUpdateBody(body) {
   const responsibility = ensureEntityObject(body, "responsibility");
-  const summary = asNonEmptyString4(responsibility.summary);
-  const currentName = asNonEmptyString4(responsibility.name);
+  const summary = asNonEmptyString3(responsibility.summary);
+  const currentName = asNonEmptyString3(responsibility.name);
   if (!currentName && summary) {
     responsibility.name = summary;
   }
@@ -4936,7 +4948,7 @@ function parseSmartKpiViewCreateBody(raw) {
 }
 function normalizeSmartKpiViewCreateBody(body) {
   const smartKpiView = ensureEntityObject(body, "smart_kpi_view");
-  const name = asNonEmptyString4(smartKpiView.name);
+  const name = asNonEmptyString3(smartKpiView.name);
   if (!name) {
     throwMissingRequiredCreateFields("smart_kpi_view", ["name"]);
   }
@@ -4974,9 +4986,9 @@ function buildKpisCreateMutation(params) {
     });
   }
   const smartKpi = { ...entity };
-  const name = asNonEmptyString4(smartKpi.name);
-  const smartKpiViewId = asNonEmptyString4(smartKpi.smart_kpi_view_id);
-  const measurableGroupId = asNonEmptyString4(smartKpi.measurable_group_id);
+  const name = asNonEmptyString3(smartKpi.name);
+  const smartKpiViewId = asNonEmptyString3(smartKpi.smart_kpi_view_id);
+  const measurableGroupId = asNonEmptyString3(smartKpi.measurable_group_id);
   const hasAllowedName = typeof name === "string" && SMART_KPI_NAME_SET.has(name);
   if (!name) {
     throw new CliError({
@@ -4996,7 +5008,7 @@ function buildKpisCreateMutation(params) {
       measurable_type: "number",
       condition: "greater_than_or_equal_to"
     };
-    const notes = asNonEmptyString4(smartKpi.notes);
+    const notes = asNonEmptyString3(smartKpi.notes);
     if (notes) {
       measurable.notes = notes;
     }
@@ -5399,7 +5411,7 @@ function ensureRootObject(body, rootKey) {
   }
   return { ...root };
 }
-function asNonEmptyString5(value) {
+function asNonEmptyString4(value) {
   if (typeof value !== "string") {
     return void 0;
   }
@@ -5409,7 +5421,7 @@ function asNonEmptyString5(value) {
 function normalizeOrganizationUpdateBody(body) {
   const organization = ensureRootObject(body, "organization");
   const detail = isRecord3(organization.organization_detail_attributes) ? { ...organization.organization_detail_attributes } : {};
-  const workspaceName = asNonEmptyString5(organization.workspace_name);
+  const workspaceName = asNonEmptyString4(organization.workspace_name);
   if (workspaceName) {
     detail.workspace_name = workspaceName;
   }
@@ -5422,7 +5434,7 @@ function normalizeOrganizationUpdateBody(body) {
 function normalizeOrganizationMetaProfileUpdateBody(body) {
   const root = ensureRootObject(body, "organization_meta_profile");
   const profile = isRecord3(root.profile) ? { ...root.profile } : {};
-  const title = asNonEmptyString5(root.title);
+  const title = asNonEmptyString4(root.title);
   if (title) {
     const companyIdentity = isRecord3(profile.company_identity) ? { ...profile.company_identity } : {};
     companyIdentity.one_sentence_summary = title;
@@ -5452,7 +5464,7 @@ function normalizeOrganizationMetaProfileUpdateBody(body) {
 function normalizeKeyMetricMetaProfileUpdateBody(body) {
   const root = ensureRootObject(body, "key_metric_meta_profile");
   const profile = isRecord3(root.profile) ? { ...root.profile } : {};
-  const annualRevenue = asNonEmptyString5(root.annual_revenue);
+  const annualRevenue = asNonEmptyString4(root.annual_revenue);
   if (annualRevenue) {
     const financial = isRecord3(profile.financial) ? { ...profile.financial } : {};
     financial.revenue = annualRevenue;
@@ -5623,7 +5635,7 @@ function ensureRootObject2(body, rootKey) {
   }
   return { ...root };
 }
-function asNonEmptyString6(value) {
+function asNonEmptyString5(value) {
   if (typeof value !== "string") {
     return void 0;
   }
@@ -5651,8 +5663,8 @@ function normalizeStrategicPlanUpdateBody(body) {
 }
 function normalizeStrategicObjectiveUpdateBody(body) {
   const strategicObjective = ensureRootObject2(body, "strategic_objective");
-  const title = asNonEmptyString6(strategicObjective.title);
-  if (!asNonEmptyString6(strategicObjective.summary) && title) {
+  const title = asNonEmptyString5(strategicObjective.title);
+  if (!asNonEmptyString5(strategicObjective.summary) && title) {
     strategicObjective.summary = title;
   }
   delete strategicObjective.title;
@@ -5675,8 +5687,8 @@ function normalizeStrategicObjectiveUpdateBody(body) {
 }
 function normalizeAnnualObjectiveCreateBody(body) {
   const annualObjective = ensureRootObject2(body, "annual_objective");
-  const title = asNonEmptyString6(annualObjective.title);
-  if (!asNonEmptyString6(annualObjective.name) && title) {
+  const title = asNonEmptyString5(annualObjective.title);
+  if (!asNonEmptyString5(annualObjective.name) && title) {
     annualObjective.name = title;
   }
   delete annualObjective.title;
@@ -5684,8 +5696,8 @@ function normalizeAnnualObjectiveCreateBody(body) {
 }
 function normalizeQuarterlyObjectiveCreateBody(body) {
   const quarterlyObjective = ensureRootObject2(body, "quarterly_objective");
-  const title = asNonEmptyString6(quarterlyObjective.title);
-  if (!asNonEmptyString6(quarterlyObjective.name) && title) {
+  const title = asNonEmptyString5(quarterlyObjective.title);
+  if (!asNonEmptyString5(quarterlyObjective.name) && title) {
     quarterlyObjective.name = title;
   }
   delete quarterlyObjective.title;
@@ -6486,7 +6498,7 @@ import { z as z16 } from "zod";
 
 // src/internalOptions.ts
 var INTERNAL_OPTIONS_KEY = "__waveInternalOptions";
-function asRecord6(value) {
+function asRecord5(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     return null;
   }
@@ -6500,7 +6512,7 @@ function setInternalCliOptions(program, options) {
 function getInternalCliOptions(command) {
   let current = command;
   while (current) {
-    const record = asRecord6(current[INTERNAL_OPTIONS_KEY]);
+    const record = asRecord5(current[INTERNAL_OPTIONS_KEY]);
     if (record) {
       return {
         enableRetryOnEmptyPhrase: record.enableRetryOnEmptyPhrase === true
@@ -10172,7 +10184,7 @@ function positiveInt2(raw, fallback) {
 function requestTimeoutMs(totalTimeoutMs) {
   return Math.max(1e3, Math.min(totalTimeoutMs, 1e4));
 }
-function asRecord7(value) {
+function asRecord6(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function asString(value) {
@@ -10219,9 +10231,9 @@ function cliTokenFromPoll(payload) {
   return asString(payload.cliToken) ?? asString(payload.cli_token) ?? asString(payload.token);
 }
 function unwrapMutationResult(value) {
-  const record = asRecord7(value);
+  const record = asRecord6(value);
   if (!record) return null;
-  const data = asRecord7(record.data);
+  const data = asRecord6(record.data);
   if (data && (Object.prototype.hasOwnProperty.call(record, "ok") || Object.prototype.hasOwnProperty.call(record, "errors") || Object.prototype.hasOwnProperty.call(record, "errorCode") || Object.prototype.hasOwnProperty.call(record, "error_code"))) {
     return data;
   }
@@ -10239,7 +10251,7 @@ async function authStatusRequest(params) {
   });
 }
 async function runTokenLogin(cmd, opts) {
-  const context = await resolveCommandContext(cmd.optsWithGlobals());
+  const context = await resolveUnscopedCommandContext(cmd.optsWithGlobals());
   const baseUrl = context.runtimeOptions.baseUrl;
   const globals = cmd.optsWithGlobals();
   const token = typeof opts.token === "string" && opts.token.trim() !== "" ? opts.token.trim() : typeof globals.token === "string" && globals.token.trim() !== "" ? globals.token.trim() : context.runtimeOptions.token;
@@ -10285,7 +10297,7 @@ async function runTokenLogin(cmd, opts) {
       exitCode: mapStatusToExitCode(status.error.status)
     });
   }
-  const statusData = asRecord7(status.result.data.cliAuthStatus) ?? {};
+  const statusData = asRecord6(status.result.data.cliAuthStatus) ?? {};
   const storage = await writeStoredToken(token, baseUrl);
   const configPath2 = opts.saveBaseUrl ? await persistBaseUrl(baseUrl) : void 0;
   return printEnvelopeAndExit({
@@ -10306,7 +10318,7 @@ async function runTokenLogin(cmd, opts) {
   });
 }
 async function runBrowserLogin(cmd, opts) {
-  const context = await resolveCommandContext(cmd.optsWithGlobals());
+  const context = await resolveUnscopedCommandContext(cmd.optsWithGlobals());
   const baseUrl = context.runtimeOptions.baseUrl;
   const timeoutMs = positiveInt2(opts.timeoutMs ?? context.runtimeOptions.timeoutMs, DEFAULT_LOGIN_TIMEOUT_MS);
   const pollIntervalMs = positiveInt2(opts.pollIntervalMs, DEFAULT_POLL_INTERVAL_MS);
@@ -10486,7 +10498,7 @@ async function runBrowserLogin(cmd, opts) {
   });
 }
 async function runLogout(cmd) {
-  const context = await resolveCommandContext(cmd.optsWithGlobals());
+  const context = await resolveUnscopedCommandContext(cmd.optsWithGlobals());
   const baseUrl = context.runtimeOptions.baseUrl;
   const token = context.runtimeOptions.token;
   const timeoutMs = positiveInt2(context.runtimeOptions.timeoutMs, 1e4);
@@ -10502,7 +10514,7 @@ async function runLogout(cmd) {
     });
     if (result.ok) {
       requestId = result.result.requestId;
-      const payload = asRecord7(result.result.data.revokeCliToken) ?? {};
+      const payload = asRecord6(result.result.data.revokeCliToken) ?? {};
       revokedRemote = payload.ok !== false;
     } else {
       requestId = result.requestId;
@@ -10525,7 +10537,7 @@ async function runLogout(cmd) {
   });
 }
 async function runAuthStatus(cmd) {
-  const context = await resolveCommandContext(cmd.optsWithGlobals());
+  const context = await resolveUnscopedCommandContext(cmd.optsWithGlobals());
   const baseUrl = context.runtimeOptions.baseUrl;
   const token = context.runtimeOptions.token;
   const tokenSource = context.runtimeOptions.tokenSource ?? "none";
@@ -10565,7 +10577,7 @@ async function runAuthStatus(cmd) {
       exitCode: mapStatusToExitCode(result.error.status)
     });
   }
-  const status = asRecord7(result.result.data.cliAuthStatus) ?? {};
+  const status = asRecord6(result.result.data.cliAuthStatus) ?? {};
   const baseAuthStatus = status.baseAuthStatus;
   return printEnvelopeAndExit({
     envelope: envelope({
@@ -12216,11 +12228,11 @@ function sanitizePlannerJson(value) {
   }
   return output;
 }
-function asRecord8(value) {
+function asRecord7(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function readPlannerStateKey(value, keys) {
-  const record = asRecord8(value);
+  const record = asRecord7(value);
   if (!record) {
     return null;
   }
@@ -14885,6 +14897,259 @@ function registerAiNotesCommands(program) {
   });
 }
 
+// src/commands/atlasAuthoring.ts
+import { z as z19 } from "zod";
+var idSchema14 = z19.string().trim().min(1);
+var idempotencyKeySchema = z19.string().min(1).refine((value) => value.trim() === value, "Idempotency key must not have leading or trailing whitespace.");
+var skillScopeSchema = z19.enum(["ADMIN_GLOBAL", "MEMBER_PERSONAL"]);
+var isoDateSchema = z19.iso.date();
+var AGENT_SELECTION = `{
+  id
+  type
+  name
+  slug
+  description
+  notes
+  status
+  visibility
+  model
+  runWhenMentioned
+  webAccessEnabled
+  organizationId
+  memberId
+  createdAt
+  updatedAt
+}`;
+var AUTOMATION_SELECTION = `{
+  id
+  type
+  summary
+  slug
+  description
+  notes
+  status
+  priority
+  taskType
+  aiTaskConfig
+  organizationId
+  memberId
+  createdAt
+  updatedAt
+}`;
+function asRecord8(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function asRequiredString(value) {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+function parseBooleanOption(value, optionName) {
+  if (value === void 0) return void 0;
+  if (value === "true") return true;
+  if (value === "false") return false;
+  throw new CliError({
+    message: `Invalid ${optionName}: expected true or false.`,
+    kind: "invalid_args",
+    status: 400,
+    exitCode: EXIT_CODES.invalidArgs
+  });
+}
+function parseCommaSeparatedStrings(value) {
+  if (value === void 0) return void 0;
+  const entries = String(value).split(",").map((entry2) => entry2.trim()).filter((entry2) => entry2.length > 0);
+  if (entries.length === 0) {
+    throw new CliError({
+      message: "--trusted-urls must include at least one URL.",
+      kind: "invalid_args",
+      status: 400,
+      exitCode: EXIT_CODES.invalidArgs
+    });
+  }
+  return entries;
+}
+function parseJson(value, optionName) {
+  try {
+    return JSON.parse(value);
+  } catch (error) {
+    throw new CliError({
+      message: error instanceof Error ? `Invalid ${optionName}: ${error.message}` : `Invalid ${optionName}.`,
+      kind: "invalid_args",
+      status: 400,
+      exitCode: EXIT_CODES.invalidArgs
+    });
+  }
+}
+function normalizePersistedCreatePayload(payload) {
+  const mutation = asRecord8(payload);
+  const mutationData = asRecord8(mutation?.data);
+  const persisted = asRecord8(mutationData?.data) ?? mutationData;
+  const attributes = asRecord8(persisted?.attributes);
+  const meta = asRecord8(mutationData?.meta);
+  const idempotency = asRecord8(meta?.atlas_idempotency);
+  const id = asRequiredString(persisted?.id);
+  const slug = asRequiredString(persisted?.slug) ?? asRequiredString(attributes?.slug);
+  const replay = idempotency?.replay;
+  if (!mutation || !mutationData || !persisted || !id || !slug || !idempotency || typeof replay !== "boolean") {
+    throw new CliError({
+      message: "Create response did not include persisted id/slug and idempotency metadata.",
+      kind: "malformed_response",
+      status: 502,
+      exitCode: EXIT_CODES.networkOrUpstream
+    });
+  }
+  return {
+    ok: mutation.ok,
+    status: mutation.status,
+    errorCode: mutation.errorCode ?? null,
+    errors: mutation.errors ?? null,
+    persisted: { id, slug },
+    idempotency: {
+      object_type: asRequiredString(idempotency.object_type),
+      id: asRequiredString(idempotency.id),
+      slug: asRequiredString(idempotency.slug),
+      idempotency_key: asRequiredString(idempotency.idempotency_key),
+      fingerprint: asRequiredString(idempotency.fingerprint),
+      replay,
+      action: asRequiredString(idempotency.action)
+    }
+  };
+}
+function registerAtlasAuthoringCommands(program) {
+  const agents = program.command("agents").description("Bounded Agent authoring operations");
+  agents.command("create").description("Create an Agent through the API-owned createAgent contract").requiredOption("--idempotency-key <key>", "Required create idempotency key").option("--name <name>").option("--description <description>").option("--notes <notes>").option("--member-id <memberId>").option("--status <status>").option("--visibility <visibility>").option("--model <model>").option("--run-when-mentioned <boolean>", "true or false").option("--web-access-enabled <boolean>", "true or false").option("--trusted-urls <urls>", "Comma-separated trusted URLs").action(async (opts, cmd) => {
+    const idempotencyKey = idempotencyKeySchema.parse(opts.idempotencyKey);
+    const runWhenMentioned = parseBooleanOption(opts.runWhenMentioned, "--run-when-mentioned");
+    const webAccessEnabled = parseBooleanOption(opts.webAccessEnabled, "--web-access-enabled");
+    const trustedUrls = parseCommaSeparatedStrings(opts.trustedUrls);
+    const context = await resolveCommandContext(cmd.optsWithGlobals());
+    const organizationId = resolveOrganizationId(context.organizationId);
+    await runGraphqlMutationCommand({
+      command: "agents.create",
+      operationName: "AgentsCreate",
+      runtimeOptions: context.runtimeOptions,
+      field: "create_agent",
+      variableTypes: {
+        organization_id: "ID!",
+        params: "CreateAgentParamsInput!",
+        idempotency_key: "String!"
+      },
+      variables: {
+        organization_id: organizationId,
+        params: {
+          agent: {
+            ...opts.name !== void 0 ? { name: String(opts.name) } : {},
+            ...opts.description !== void 0 ? { description: String(opts.description) } : {},
+            ...opts.notes !== void 0 ? { notes: String(opts.notes) } : {},
+            ...opts.memberId !== void 0 ? { member_id: idSchema14.parse(opts.memberId) } : {},
+            ...opts.status !== void 0 ? { status: String(opts.status) } : {},
+            ...opts.visibility !== void 0 ? { visibility: String(opts.visibility) } : {},
+            ...opts.model !== void 0 ? { model: String(opts.model) } : {},
+            ...runWhenMentioned !== void 0 ? { run_when_mentioned: runWhenMentioned } : {},
+            ...webAccessEnabled !== void 0 ? { web_access_enabled: webAccessEnabled } : {},
+            ...trustedUrls !== void 0 ? { trusted_urls: trustedUrls } : {}
+          }
+        },
+        idempotency_key: idempotencyKey
+      },
+      transformMutationPayload: normalizePersistedCreatePayload
+    });
+  });
+  agents.command("show").description("Read one persisted Agent by id").requiredOption("--id <id>", "Agent id").action(async (opts, cmd) => {
+    const id = idSchema14.parse(opts.id);
+    const context = await resolveCommandContext(cmd.optsWithGlobals());
+    const organizationId = resolveOrganizationId(context.organizationId);
+    await runGraphqlQueryCommand({
+      command: "agents.show",
+      operationName: "AgentsShow",
+      runtimeOptions: context.runtimeOptions,
+      field: "agent",
+      variables: { organization_id: organizationId, id },
+      variableTypes: { organization_id: "ID!", id: "ID!" },
+      selectionSet: AGENT_SELECTION,
+      isShow: true
+    });
+  });
+  const automations = program.command("automations").description("Bounded Automation authoring operations");
+  automations.command("create").description("Create an Automation through the API-owned createAutomation contract").requiredOption("--summary <summary>").requiredOption("--ai-task-config <json>", "Valid JSON for the API-owned ai_task_config field").requiredOption("--idempotency-key <key>", "Required create idempotency key").option("--description <description>").option("--notes <notes>").option("--member-id <memberId>").option("--status <status>").option("--priority <priority>").option("--due-date <date>", "ISO-8601 date (YYYY-MM-DD)").action(async (opts, cmd) => {
+    const idempotencyKey = idempotencyKeySchema.parse(opts.idempotencyKey);
+    const context = await resolveCommandContext(cmd.optsWithGlobals());
+    const organizationId = resolveOrganizationId(context.organizationId);
+    await runGraphqlMutationCommand({
+      command: "automations.create",
+      operationName: "AutomationsCreate",
+      runtimeOptions: context.runtimeOptions,
+      field: "create_automation",
+      variableTypes: {
+        organization_id: "ID!",
+        input: "CreateAutomationInput!",
+        idempotency_key: "String!"
+      },
+      variables: {
+        organization_id: organizationId,
+        input: {
+          summary: idSchema14.parse(opts.summary),
+          ai_task_config: parseJson(String(opts.aiTaskConfig), "--ai-task-config"),
+          ...opts.description !== void 0 ? { description: String(opts.description) } : {},
+          ...opts.notes !== void 0 ? { notes: String(opts.notes) } : {},
+          ...opts.memberId !== void 0 ? { member_id: idSchema14.parse(opts.memberId) } : {},
+          ...opts.status !== void 0 ? { status: String(opts.status) } : {},
+          ...opts.priority !== void 0 ? { priority: String(opts.priority) } : {},
+          ...opts.dueDate !== void 0 ? { due_date: isoDateSchema.parse(opts.dueDate) } : {}
+        },
+        idempotency_key: idempotencyKey
+      },
+      transformMutationPayload: normalizePersistedCreatePayload
+    });
+  });
+  automations.command("show").description("Read one persisted Automation by id").requiredOption("--id <id>", "Automation id").action(async (opts, cmd) => {
+    const id = idSchema14.parse(opts.id);
+    const context = await resolveCommandContext(cmd.optsWithGlobals());
+    const organizationId = resolveOrganizationId(context.organizationId);
+    await runGraphqlQueryCommand({
+      command: "automations.show",
+      operationName: "AutomationsShow",
+      runtimeOptions: context.runtimeOptions,
+      field: "automation",
+      variables: { organization_id: organizationId, id },
+      variableTypes: { organization_id: "ID!", id: "ID!" },
+      selectionSet: AUTOMATION_SELECTION,
+      isShow: true
+    });
+  });
+  const skills = program.commands.find((command) => command.name() === "skills");
+  if (!skills) {
+    throw new Error("Skills command must be registered before Atlas authoring commands.");
+  }
+  skills.command("create").description("Create a Skill through the API-owned createSkill contract").requiredOption("--name <name>").requiredOption("--scope <scope>", "ADMIN_GLOBAL or MEMBER_PERSONAL").requiredOption("--idempotency-key <key>", "Required create idempotency key").option("--emoji <emoji>").option("--description <description>").action(async (opts, cmd) => {
+    const idempotencyKey = idempotencyKeySchema.parse(opts.idempotencyKey);
+    const context = await resolveCommandContext(cmd.optsWithGlobals());
+    const organizationId = resolveOrganizationId(context.organizationId);
+    await runGraphqlMutationCommand({
+      command: "skills.create",
+      operationName: "SkillsCreate",
+      runtimeOptions: context.runtimeOptions,
+      field: "create_skill",
+      variableTypes: {
+        organization_id: "ID!",
+        input: "CreateSkillInput!",
+        idempotency_key: "String!"
+      },
+      variables: {
+        organization_id: organizationId,
+        input: {
+          name: idSchema14.parse(opts.name),
+          scope: skillScopeSchema.parse(opts.scope),
+          ...opts.emoji !== void 0 ? { emoji: String(opts.emoji) } : {},
+          ...opts.description !== void 0 ? { description: String(opts.description) } : {}
+        },
+        idempotency_key: idempotencyKey
+      },
+      transformMutationPayload: normalizePersistedCreatePayload
+    });
+  });
+}
+
 // src/commands/discovery.ts
 import { existsSync as existsSync3, readFileSync } from "fs";
 import { join as join3 } from "path";
@@ -14905,6 +15170,8 @@ var PRIMARY_NAMESPACES = [
   "rocks",
   "meetings",
   "members",
+  "agents",
+  "automations",
   "skills",
   "teams",
   "issues",
@@ -15018,20 +15285,62 @@ var NAMESPACE_DOCS = {
   skills: {
     name: "skills",
     tier: "primary",
-    description: "Read-only Skill record proof surfaces.",
+    description: "Skill record readback and bounded create operations.",
     examples: [
       "wave skills list --json",
       "wave skills list --scope ADMIN_GLOBAL --json",
-      "wave skills show --id 123 --json"
+      "wave skills show --id 123 --json",
+      'wave skills create --name "Weekly planning" --scope MEMBER_PERSONAL --idempotency-key skill-create-001'
     ],
     schema: {
       output: "json-envelope-default",
-      readOnly: true,
+      mutates: true,
       safety: [
         "Uses API-owned Skill GraphQL read fields only.",
-        "Does not create, update, destroy, archive, approve, or apply Skill records."
+        "Create calls only createSkill with an explicit idempotency key.",
+        "Skill create supports the API-defined ADMIN_GLOBAL and MEMBER_PERSONAL scopes.",
+        "Does not update, destroy, archive, approve, or apply Skill records."
       ],
-      commands: ["list", "show"]
+      commands: ["list", "show", "create"]
+    }
+  },
+  agents: {
+    name: "agents",
+    tier: "primary",
+    description: "Bounded Agent create and persisted readback operations.",
+    examples: [
+      'wave agents create --name "Planning helper" --idempotency-key agent-create-001',
+      "wave agents show --id 123"
+    ],
+    schema: {
+      output: "json-envelope-default",
+      mutates: true,
+      safety: [
+        "Create calls only createAgent with an explicit idempotency key.",
+        "Create preserves API-owned defaults by sending only supplied typed Agent fields.",
+        "Show uses the API-owned agent query by id; no slug fallback is implemented."
+      ],
+      commands: ["create", "show"]
+    }
+  },
+  automations: {
+    name: "automations",
+    tier: "primary",
+    description: "Bounded Automation create and persisted readback operations.",
+    examples: [
+      `wave automations create --summary "Weekly review" --ai-task-config '{"prompt":"Review tasks"}' --idempotency-key automation-create-001`,
+      "wave automations show --id 123"
+    ],
+    schema: {
+      output: "json-envelope-default",
+      mutates: true,
+      safety: [
+        "Create calls only createAutomation with an explicit idempotency key.",
+        "Only the API-defined ai_task_config field accepts validated JSON.",
+        "Does not create a project Task, run an Automation, or invoke AI OS actions.",
+        "Show uses the API-owned automation query by id; no slug fallback is implemented."
+      ],
+      commands: ["create", "show"]
     }
   },
   broadcast: {
@@ -15379,12 +15688,39 @@ function namespaceDoc(name) {
     }
   };
 }
-function allNamespaceDocs() {
-  return [
-    ...PRIMARY_NAMESPACES.map(namespaceDoc),
-    ...ADVANCED_NAMESPACES.map(namespaceDoc),
-    ...ALIASES.map(namespaceDoc)
-  ];
+function advertisedCommands(command) {
+  const children = command.commands.filter((child) => !["help", "schema", "examples"].includes(child.name())).map((child) => child.name());
+  return children.length > 0 ? children : [command.name()];
+}
+function examplesForRegisteredCommand(name, commands) {
+  if (commands.includes("list")) {
+    return [
+      `wave ${name} list --page 1 --per 10`,
+      ...commands.includes("show") ? [`wave ${name} show --id 123`] : []
+    ];
+  }
+  const [firstCommand] = commands;
+  return firstCommand && firstCommand !== name ? [`wave ${name} ${firstCommand}`] : [`wave ${name}`];
+}
+function registeredNamespaceDoc(command) {
+  const doc = namespaceDoc(command.name());
+  const commands = advertisedCommands(command);
+  const usesGenericDocumentation = !NAMESPACE_DOCS[command.name()];
+  return {
+    ...doc,
+    ...usesGenericDocumentation ? { examples: examplesForRegisteredCommand(command.name(), commands) } : {},
+    schema: {
+      ...doc.schema,
+      commands
+    }
+  };
+}
+function allNamespaceDocs(program) {
+  const names = program.commands.map((command) => command.name()).filter((name) => name !== "help").filter((name, index, values) => values.indexOf(name) === index);
+  return names.flatMap((name) => {
+    const command = program.commands.find((candidate) => candidate.name() === name);
+    return command ? [registeredNamespaceDoc(command)] : [];
+  });
 }
 function buildEnvelope2(command, data) {
   return {
@@ -15467,43 +15803,6 @@ function commandSummary(command) {
     }))
   };
 }
-function graphqlFields(program) {
-  const fields = /* @__PURE__ */ new Set([
-    "agent_markdown_status",
-    "agent_markdown_file",
-    "agent_markdown_children",
-    "os_md_search",
-    "os_md_wiki_lint",
-    "os_md_memory_quality",
-    "phantom_ledger_inventory",
-    "phantom_runs",
-    "phantom_run",
-    "phantom_reports",
-    "phantom_report",
-    "phantom_observation",
-    "phantom_observations",
-    "member_meta_profile",
-    "skills",
-    "destroy_task",
-    "raw_source_ingestion_plan",
-    "register_raw_source",
-    "ingest_raw_source",
-    "run_phantom_osmd_maintenance",
-    "markdown_tree_root",
-    "markdown_tree_node",
-    "markdown_tree_children",
-    "markdown_tree_subtree",
-    "ai_notes",
-    "ai_note"
-  ]);
-  for (const path of commandPaths(program)) {
-    const parts = path.split(" ");
-    if (parts.length >= 3) {
-      fields.add(parts.slice(1, -1).join("_").replaceAll("-", "_"));
-    }
-  }
-  return Array.from(fields).sort();
-}
 function packageVersion() {
   try {
     const pkg = JSON.parse(readFileSync(join3(process.cwd(), "package.json"), "utf8"));
@@ -15555,7 +15854,7 @@ async function resolveDoctorAuthOrganization(params) {
   }
 }
 async function runDoctor(cmd, opts) {
-  const context = await resolveCommandContext(cmd.optsWithGlobals());
+  const context = await resolveUnscopedCommandContext(cmd.optsWithGlobals());
   const runtime = context.runtimeOptions;
   const baseUrl = runtime.baseUrl;
   const token = runtime.token;
@@ -15677,7 +15976,7 @@ function registerDiscoveryCommands(program) {
         stdout: "exactly one JSON envelope for machine commands",
         stderr: "diagnostics only"
       },
-      namespaces: allNamespaceDocs(),
+      namespaces: allNamespaceDocs(program),
       toolSupportRegistry: {
         milestone: "WAVE-04",
         status: "registry_only",
@@ -15738,18 +16037,10 @@ function registerDiscoveryCommands(program) {
     return printEnvelopeAndExit({
       envelope: buildEnvelope2("api.ls", {
         commands: paths,
-        examples: ["wave api ls --json", "wave graphql fields --json"]
+        examples: ["wave api ls --json"]
       })
     });
   });
-  const graphql = program.command("graphql").description("Discover GraphQL fields used by the CLI");
-  graphql.command("fields").description("List known GraphQL field names").option("--readable", "Print fields as plain lines").option("--json", "Emit the stable JSON envelope").action((opts) => {
-    const fields = graphqlFields(program);
-    if (opts.readable && !opts.json) {
-      return printTextAndExit({ text: fields.join("\n") });
-    }
-    return printEnvelopeAndExit({ envelope: buildEnvelope2("graphql.fields", { fields }) });
-  });
   program.command("doctor").description("Run read-only CLI diagnostics").option("--readable", "Print a human-readable diagnostic summary").option("--json", "Emit the stable JSON envelope").action((opts, cmd) => runDoctor(cmd, opts));
   const phantom = program.commands.find((command) => command.name() === "phantom");
   phantom?.addHelpText(
@@ -15763,7 +16054,6 @@ function attachNamespaceDiscovery(program) {
     ...ADVANCED_NAMESPACES,
     "capabilities",
     "api",
-    "graphql",
     "doctor",
     "auth"
   ]);
@@ -15773,7 +16063,7 @@ function attachNamespaceDiscovery(program) {
     if (!command.commands.some((child) => child.name() === "schema")) {
       command.command("schema").description("Describe this namespace's command and output contract").option("--readable", "Print a human-readable schema summary").option("--json", "Emit the stable JSON envelope").action((opts) => {
         const data = {
-          namespace: namespaceDoc(command.name()),
+          namespace: registeredNamespaceDoc(command),
           command: commandSummary(command)
         };
         if (opts.readable && !opts.json) {
@@ -15789,7 +16079,7 @@ Output: ${data.namespace.schema.output}`
     }
     if (!command.commands.some((child) => child.name() === "examples")) {
       command.command("examples").description("Show scriptable examples for this namespace").option("--readable", "Print examples as shell lines").option("--json", "Emit the stable JSON envelope").action((opts) => {
-        const examples = namespaceDoc(command.name()).examples;
+        const examples = registeredNamespaceDoc(command).examples;
         if (opts.readable && !opts.json) {
           return printTextAndExit({ text: examples.join("\n") });
         }
@@ -15809,7 +16099,6 @@ function attachDiscoveryHelp(program) {
       "  wave capabilities list       List primary, advanced, and alias namespaces",
       "  wave capabilities tools      List shared recent-tool support metadata",
       "  wave api ls                  List scriptable command paths",
-      "  wave graphql fields          List known GraphQL fields",
       "  wave <namespace> schema      Describe namespace output and command contract",
       "  wave <namespace> examples    Show copyable examples",
       "  wave doctor                  Run read-only diagnostics",
@@ -15833,7 +16122,6 @@ function attachDiscoveryHelp(program) {
     ["markdown-tree", "\nExamples:\n  wave markdown-tree root --tree-view\n  wave markdown-tree resolve --tool-key projects --node-key tasks --parent-id 123\n"],
     ["capabilities", "\nExamples:\n  wave capabilities list\n  wave capabilities list --readable\n  wave capabilities tools\n  wave capabilities tools mail\n"],
     ["api", "\nExamples:\n  wave api ls\n  wave api ls --readable\n"],
-    ["graphql", "\nExamples:\n  wave graphql fields\n  wave graphql fields --readable\n"],
     ["doctor", "\nExamples:\n  wave doctor\n  wave doctor --readable\n"]
   ]);
   for (const command of program.commands) {
@@ -15845,12 +16133,12 @@ function attachDiscoveryHelp(program) {
 }
 
 // src/version.ts
-var CLI_VERSION = "0.1.61";
+var CLI_VERSION = "0.1.63";
 
 // src/cli.ts
 function buildCli(options) {
   const program = new Command();
-  program.name("wave").description("Wave agent CLI").version(CLI_VERSION, "-V, --version", "output the version number").showHelpAfterError(false).allowExcessArguments(false).option("--token <token>", "API token (prefer WAVE_API_TOKEN env var)").option("--jwt <jwt>", "Legacy alias for --token (prefer WAVE_API_TOKEN env var)").option("--token-stdin", "Read API token from stdin").option(
+  program.name("wave").description("Wave agent CLI").version(CLI_VERSION, "-V, --version", "output the version number").showHelpAfterError(false).allowExcessArguments(false).option("--token <token>", "API token (prefer WAVE_API_TOKEN env var)").option("--token-stdin", "Read API token from stdin").option(
     "--auth-json-stdin",
     "Read auth/runtime context JSON from stdin (token, baseUrl, organizationId, ...)"
   ).option(
@@ -15900,6 +16188,7 @@ function buildCli(options) {
   registerMeetingCommands(program);
   registerMemberCommands(program);
   registerSkillCommands(program);
+  registerAtlasAuthoringCommands(program);
   registerTeamCommands(program);
   registerOrganizationCommands(program);
   registerIssueCommands(program);