@wave-ai-os/wave-cli 0.1.66 → 0.1.68

package/dist/index.js

@@ -57,6 +57,9 @@ function mapStatusToExitCode(status) {
   return EXIT_CODES.generic;
 }
 
+// src/runtimeDefaults.ts
+var DEFAULT_PRODUCTION_API_BASE_URL = "https://api.ourwave.io";
+
 // src/config.ts
 var DEFAULT_TIMEOUT_MS = 1e4;
 var configSchema = z.object({
@@ -115,15 +118,7 @@ function getConfig(options) {
       exitCode: EXIT_CODES.missingOrInvalidAuth
     });
   }
-  const baseUrl = options.baseUrl ?? process.env.WAVE_API_BASE_URL ?? process.env.WAVE_API_URL;
-  if (!baseUrl) {
-    throw new CliError({
-      message: "Missing API base URL. Pass --base-url, provide via --auth-json-stdin, or set WAVE_API_BASE_URL/WAVE_API_URL.",
-      kind: "invalid_args",
-      status: 400,
-      exitCode: EXIT_CODES.invalidArgs
-    });
-  }
+  const baseUrl = options.baseUrl ?? process.env.WAVE_API_BASE_URL ?? process.env.WAVE_API_URL ?? DEFAULT_PRODUCTION_API_BASE_URL;
   const parsed = configSchema.safeParse({
     baseUrl,
     token,
@@ -2276,7 +2271,8 @@ function resolveFromSources(options, stdin, config, env) {
     normalize3(stdin.baseUrl),
     normalize3(env.WAVE_API_BASE_URL),
     normalize3(env.WAVE_API_URL),
-    normalize3(config.baseUrl)
+    normalize3(config.baseUrl),
+    DEFAULT_PRODUCTION_API_BASE_URL
   );
   const organizationId = normalize3(options.organizationId);
   const organizationIdSource = organizationId ? "flag" : "none";
@@ -15033,6 +15029,649 @@ function registerAtlasAuthoringCommands(program) {
 // src/commands/discovery.ts
 import { existsSync as existsSync3, readFileSync } from "fs";
 import { join as join3 } from "path";
+
+// src/operationManifest.ts
+import { createHash } from "crypto";
+
+// src/version.ts
+var CLI_VERSION = "0.1.68";
+
+// src/operationMetadata.ts
+var DISCOVERY_OPERATION_IDS = [
+  "accountability.examples",
+  "accountability.schema",
+  "agents.examples",
+  "agents.schema",
+  "api.examples",
+  "api.ls",
+  "api.schema",
+  "auth.examples",
+  "auth.schema",
+  "automations.examples",
+  "automations.schema",
+  "broadcast.examples",
+  "broadcast.schema",
+  "capabilities.examples",
+  "capabilities.list",
+  "capabilities.schema",
+  "capabilities.tools",
+  "contacts.examples",
+  "contacts.schema",
+  "content.examples",
+  "content.schema",
+  "customers.examples",
+  "customers.schema",
+  "datasheets.examples",
+  "datasheets.schema",
+  "doctor",
+  "doctor.examples",
+  "doctor.schema",
+  "feedbacks.examples",
+  "feedbacks.schema",
+  "foundation.examples",
+  "foundation.schema",
+  "issue-groups.examples",
+  "issue-groups.schema",
+  "issues.examples",
+  "issues.schema",
+  "knowledge.examples",
+  "knowledge.schema",
+  "kpis.examples",
+  "kpis.schema",
+  "list-items.examples",
+  "list-items.schema",
+  "lists.examples",
+  "lists.schema",
+  "mail.examples",
+  "mail.schema",
+  "markdown-tree.examples",
+  "markdown-tree.schema",
+  "meetings.examples",
+  "meetings.schema",
+  "members.examples",
+  "members.schema",
+  "milestones.examples",
+  "milestones.schema",
+  "news.examples",
+  "news.schema",
+  "organizations.examples",
+  "organizations.schema",
+  "osmd.examples",
+  "osmd.schema",
+  "planner.examples",
+  "planner.schema",
+  "project-content.examples",
+  "project-content.schema",
+  "projects.examples",
+  "projects.schema",
+  "pulse.examples",
+  "pulse.schema",
+  "questions.examples",
+  "questions.schema",
+  "recognition.examples",
+  "recognition.schema",
+  "rock-collections.examples",
+  "rock-collections.schema",
+  "rocks.examples",
+  "rocks.schema",
+  "scorecard-groups.examples",
+  "scorecard-groups.schema",
+  "scorecards.examples",
+  "scorecards.schema",
+  "skills.examples",
+  "skills.schema",
+  "stand-ups.examples",
+  "stand-ups.schema",
+  "subissues.examples",
+  "subissues.schema",
+  "subitems.examples",
+  "subitems.schema",
+  "subtasks.examples",
+  "subtasks.schema",
+  "subtodos.examples",
+  "subtodos.schema",
+  "support.examples",
+  "support.schema",
+  "surveys.examples",
+  "surveys.schema",
+  "talking-points.examples",
+  "talking-points.schema",
+  "tasks.examples",
+  "tasks.schema",
+  "teams.examples",
+  "teams.schema",
+  "time-tracking.examples",
+  "time-tracking.schema",
+  "todo-groups.examples",
+  "todo-groups.schema",
+  "todos.examples",
+  "todos.schema",
+  "whiteboards.examples",
+  "whiteboards.schema"
+];
+var READ_OPERATION_IDS = [
+  "accountability.list",
+  "accountability.search",
+  "accountability.show",
+  "agents.show",
+  "auth.status",
+  "automations.show",
+  "broadcast.community",
+  "broadcast.list",
+  "broadcast.open",
+  "broadcast.workspace",
+  "cat",
+  "contacts.list",
+  "contacts.search",
+  "contacts.show",
+  "content.list",
+  "content.show",
+  "customers.list",
+  "customers.search",
+  "customers.show",
+  "datasheets.list",
+  "datasheets.open",
+  "datasheets.show",
+  "feedbacks.list",
+  "feedbacks.search",
+  "feedbacks.show",
+  "find",
+  "foundation.annual-objectives.list",
+  "foundation.annual-objectives.search",
+  "foundation.annual-objectives.show",
+  "foundation.quarterly-objectives.list",
+  "foundation.quarterly-objectives.search",
+  "foundation.quarterly-objectives.show",
+  "foundation.strategic-objectives.show",
+  "foundation.strategic-plans.show",
+  "issue-groups.list",
+  "issue-groups.search",
+  "issue-groups.show",
+  "issues.list",
+  "issues.search",
+  "issues.show",
+  "knowledge.list",
+  "knowledge.search",
+  "knowledge.show",
+  "kpis.list",
+  "kpis.search",
+  "kpis.show",
+  "list-items.list",
+  "list-items.search",
+  "list-items.show",
+  "lists.list",
+  "lists.search",
+  "lists.show",
+  "ls",
+  "mail.accounts",
+  "mail.conversation",
+  "mail.conversations",
+  "mail.labels",
+  "mail.message",
+  "mail.messages",
+  "mail.open",
+  "mail.settings",
+  "mail.snippets",
+  "mail.sync-status",
+  "mail.unread-count",
+  "mail.validate-provider",
+  "mail.workspace",
+  "markdown-tree.children",
+  "markdown-tree.resolve",
+  "markdown-tree.root",
+  "markdown-tree.subtree",
+  "meetings.list",
+  "meetings.search",
+  "meetings.show",
+  "members.list",
+  "members.meta-profile",
+  "members.search",
+  "members.show",
+  "milestones.list",
+  "milestones.search",
+  "news.list",
+  "news.search",
+  "news.show",
+  "open",
+  "organizations.key-metric-meta-profile.show",
+  "organizations.meta-profile.show",
+  "organizations.show",
+  "osmd.agent.children",
+  "osmd.agent.read",
+  "osmd.agent.status",
+  "osmd.children",
+  "osmd.lint",
+  "osmd.memory-quality",
+  "osmd.read",
+  "osmd.search",
+  "osmd.status",
+  "osmd.tree",
+  "osmd.wiki.read",
+  "osmd.wiki.status",
+  "phantom.apply-operation",
+  "phantom.apply-operations",
+  "phantom.candidate",
+  "phantom.candidates",
+  "phantom.evidence",
+  "phantom.evidences",
+  "phantom.inventory",
+  "phantom.observation",
+  "phantom.observations",
+  "phantom.report",
+  "phantom.validation",
+  "phantom.validations",
+  "planner.booking-links",
+  "planner.events",
+  "planner.open",
+  "planner.preferences",
+  "planner.public-booking-link",
+  "planner.state",
+  "projects.list",
+  "projects.search",
+  "projects.show",
+  "pulse.list",
+  "pulse.search",
+  "pulse.show",
+  "questions.list",
+  "questions.search",
+  "questions.show",
+  "recognition.list",
+  "recognition.open",
+  "recognition.point-balance",
+  "recognition.show",
+  "recognition.top-value",
+  "rock-collections.list",
+  "rock-collections.search",
+  "rock-collections.show",
+  "rocks.list",
+  "rocks.search",
+  "rocks.show",
+  "scorecard-groups.list",
+  "scorecard-groups.search",
+  "scorecard-groups.show",
+  "scorecards.list",
+  "scorecards.search",
+  "scorecards.show",
+  "skills.list",
+  "skills.show",
+  "stand-ups.list",
+  "stand-ups.search",
+  "stand-ups.show",
+  "subissues.list",
+  "subissues.search",
+  "subitems.list",
+  "subitems.search",
+  "subtasks.list",
+  "subtasks.search",
+  "subtodos.list",
+  "subtodos.search",
+  "support.counts",
+  "support.inbox",
+  "support.knowledge-articles",
+  "support.knowledge-collections",
+  "support.labels",
+  "support.open",
+  "support.settings",
+  "support.ticket-counts",
+  "support.tickets",
+  "surveys.list",
+  "surveys.search",
+  "surveys.show",
+  "talking-points.list",
+  "talking-points.search",
+  "tasks.list",
+  "tasks.search",
+  "tasks.show",
+  "teams.list",
+  "teams.show",
+  "time-tracking.entries",
+  "time-tracking.open",
+  "time-tracking.projects",
+  "time-tracking.report",
+  "time-tracking.show",
+  "time-tracking.timer",
+  "time-tracking.timesheet",
+  "todo-groups.list",
+  "todo-groups.search",
+  "todo-groups.show",
+  "todos.list",
+  "todos.search",
+  "todos.show",
+  "tree",
+  "whiteboards.list",
+  "whiteboards.open",
+  "whiteboards.show"
+];
+var WRITE_OPERATION_IDS = [
+  "accountability.create",
+  "accountability.update",
+  "agents.create",
+  "automations.create",
+  "contacts.create",
+  "contacts.update",
+  "content.create-contact",
+  "content.create-customer",
+  "content.create-manager",
+  "content.create-member",
+  "content.create-project",
+  "content.create-team",
+  "content.destroy",
+  "content.update",
+  "customers.create",
+  "customers.update",
+  "datasheets.archive",
+  "datasheets.cell.upsert",
+  "datasheets.column.archive",
+  "datasheets.column.create",
+  "datasheets.column.delete",
+  "datasheets.column.reorder",
+  "datasheets.column.update",
+  "datasheets.create",
+  "datasheets.export.create",
+  "datasheets.favorite",
+  "datasheets.form.archive",
+  "datasheets.form.close",
+  "datasheets.form.create",
+  "datasheets.form.delete",
+  "datasheets.form.publish",
+  "datasheets.form.submit",
+  "datasheets.form.update",
+  "datasheets.import.commit",
+  "datasheets.row.archive",
+  "datasheets.row.create",
+  "datasheets.row.delete",
+  "datasheets.row.reorder",
+  "datasheets.row.update",
+  "datasheets.update",
+  "datasheets.view.archive",
+  "datasheets.view.create",
+  "datasheets.view.delete",
+  "datasheets.view.reorder",
+  "datasheets.view.update",
+  "feedbacks.create",
+  "feedbacks.update",
+  "foundation.annual-objectives.create",
+  "foundation.annual-objectives.update",
+  "foundation.quarterly-objectives.create",
+  "foundation.quarterly-objectives.update",
+  "foundation.strategic-objectives.update",
+  "foundation.strategic-plans.update",
+  "issue-groups.create",
+  "issue-groups.update",
+  "issues.create",
+  "issues.update",
+  "knowledge.create",
+  "knowledge.update",
+  "kpis.create",
+  "kpis.update",
+  "list-items.create",
+  "list-items.update",
+  "lists.create",
+  "lists.update",
+  "meetings.create",
+  "meetings.notes",
+  "meetings.update",
+  "members.create",
+  "members.update",
+  "milestones.create",
+  "milestones.destroy",
+  "milestones.update",
+  "news.create",
+  "news.update",
+  "organizations.key-metric-meta-profile.update",
+  "organizations.meta-profile.update",
+  "organizations.update",
+  "osmd.agent.create",
+  "osmd.agent.init",
+  "osmd.agent.update",
+  "osmd.ingest.file",
+  "osmd.ingest.text",
+  "osmd.ingest.transcript",
+  "osmd.ingest.url",
+  "osmd.phantom.run",
+  "osmd.wiki.append-log",
+  "osmd.wiki.create",
+  "osmd.wiki.index-upsert",
+  "osmd.wiki.update",
+  "project-content.create",
+  "project-content.destroy",
+  "project-content.update",
+  "projects.create",
+  "projects.update",
+  "pulse.create",
+  "pulse.update",
+  "questions.create",
+  "questions.update",
+  "rock-collections.create",
+  "rock-collections.update",
+  "rocks.create",
+  "rocks.update",
+  "rocks.update-status",
+  "scorecard-groups.create",
+  "scorecard-groups.update",
+  "scorecards.create",
+  "scorecards.update",
+  "skills.create",
+  "smart-kpi-views.create",
+  "stand-ups.create",
+  "stand-ups.update",
+  "subissues.create",
+  "subissues.destroy",
+  "subissues.update",
+  "subitems.create",
+  "subitems.destroy",
+  "subitems.update",
+  "subtasks.create",
+  "subtasks.destroy",
+  "subtasks.update",
+  "subtodos.create",
+  "subtodos.destroy",
+  "subtodos.update",
+  "surveys.create",
+  "surveys.update",
+  "talking-points.create",
+  "talking-points.destroy",
+  "talking-points.update",
+  "tasks.create",
+  "tasks.destroy",
+  "tasks.update",
+  "teams.create",
+  "teams.update",
+  "todo-groups.create",
+  "todo-groups.update",
+  "todos.create",
+  "todos.update"
+];
+var AUTH_OPERATION_IDS = ["login", "logout"];
+var DESTRUCTIVE_OPERATION_IDS = /* @__PURE__ */ new Set([
+  "content.destroy",
+  "datasheets.archive",
+  "datasheets.column.archive",
+  "datasheets.column.delete",
+  "datasheets.form.archive",
+  "datasheets.form.close",
+  "datasheets.form.delete",
+  "datasheets.form.publish",
+  "datasheets.form.submit",
+  "datasheets.import.commit",
+  "datasheets.row.archive",
+  "datasheets.row.delete",
+  "datasheets.view.archive",
+  "datasheets.view.delete",
+  "milestones.destroy",
+  "project-content.destroy",
+  "subissues.destroy",
+  "subitems.destroy",
+  "subtasks.destroy",
+  "subtodos.destroy",
+  "talking-points.destroy",
+  "tasks.destroy"
+]);
+var OPERATION_IDS_BY_CLASSIFICATION = {
+  discovery: DISCOVERY_OPERATION_IDS,
+  read: READ_OPERATION_IDS,
+  write: WRITE_OPERATION_IDS,
+  auth: AUTH_OPERATION_IDS
+};
+var metadataByOperationId = /* @__PURE__ */ new Map();
+for (const [classification, operationIds] of Object.entries(OPERATION_IDS_BY_CLASSIFICATION)) {
+  for (const id of operationIds) {
+    if (metadataByOperationId.has(id)) {
+      throw new Error(`Duplicate Wave CLI operation metadata: ${id}`);
+    }
+    const atlasSafetyClass = classification === "discovery" ? "discovery" : classification === "read" ? "read_only" : classification === "auth" ? "auth" : DESTRUCTIVE_OPERATION_IDS.has(id) ? "destructive" : "mutation";
+    if (DESTRUCTIVE_OPERATION_IDS.has(id) && classification !== "write") {
+      throw new Error(`Destructive Wave CLI operation must be a write: ${id}`);
+    }
+    metadataByOperationId.set(id, {
+      classification,
+      requiresApproval: classification === "write",
+      atlasSafetyClass,
+      machine: {
+        supportsValidate: true,
+        supportsPreview: classification === "write",
+        supportsExecute: true,
+        executionMode: "sync"
+      }
+    });
+  }
+}
+function registeredOperationMetadata(id) {
+  return metadataByOperationId.get(id);
+}
+
+// src/operationManifest.ts
+var MACHINE_PRESENTATION_OPTIONS = /* @__PURE__ */ new Set(["json", "readable"]);
+function hasAction(command) {
+  return Boolean(command._actionHandler);
+}
+function commandPath(command) {
+  const path = [];
+  let current = command;
+  while (current) {
+    const name = current.name();
+    if (name) path.unshift(name);
+    current = current.parent ?? null;
+  }
+  return path;
+}
+function operationId(path) {
+  return path.slice(1).join(".");
+}
+function inputKeyForArgument(argument) {
+  return argument.name().replace(/<|>|\[|\]|\.\.\./g, "");
+}
+function inputSchemaFor(command) {
+  const properties = {};
+  const required = [];
+  for (const argument of command.registeredArguments) {
+    const key = inputKeyForArgument(argument);
+    properties[key] = {
+      type: argument.variadic ? "array" : "string",
+      ...argument.description ? { description: argument.description } : {}
+    };
+    if (argument.required) required.push(key);
+  }
+  for (const option of command.options) {
+    const key = option.attributeName();
+    if (MACHINE_PRESENTATION_OPTIONS.has(key)) continue;
+    properties[key] = {
+      type: option.required ? "string" : option.optional ? ["boolean", "string"] : "boolean",
+      ...option.description ? { description: option.description } : {}
+    };
+    if (option.mandatory) required.push(key);
+  }
+  return {
+    type: "object",
+    additionalProperties: false,
+    properties,
+    required: required.sort()
+  };
+}
+function exampleFor(inputSchema) {
+  const input = {};
+  for (const key of inputSchema.required) {
+    const propertyType = inputSchema.properties[key]?.type;
+    const types = Array.isArray(propertyType) ? propertyType : [propertyType];
+    input[key] = types.includes("array") ? ["example"] : types.includes("boolean") ? true : "example";
+  }
+  return [{ name: "minimal valid input", input }];
+}
+function outputSchema() {
+  return {
+    $schema: "https://json-schema.org/draft/2020-12/schema",
+    type: "object",
+    additionalProperties: false,
+    properties: {
+      ok: { type: "boolean" },
+      command: { type: "string" },
+      status: { type: "number" },
+      data: { type: ["object", "array", "string", "number", "boolean", "null"] },
+      error: { type: ["object", "null"] },
+      meta: { type: "object" }
+    },
+    required: ["ok", "command", "status", "data", "error", "meta"]
+  };
+}
+function listInvocableCommands(program) {
+  const result = [];
+  const visit = (command) => {
+    if (command.name() !== "help" && hasAction(command)) result.push(command);
+    for (const child of command.commands) visit(child);
+  };
+  for (const command of program.commands) visit(command);
+  return result;
+}
+function entryFor(command, metadata) {
+  const path = commandPath(command);
+  const inputSchema = inputSchemaFor(command);
+  const summary = command.description() || `Run ${path.join(" ")}.`;
+  return {
+    id: operationId(path),
+    path,
+    command: path.join(" "),
+    summary,
+    description: summary,
+    classification: metadata.classification,
+    requiresApproval: metadata.requiresApproval,
+    atlasSafetyClass: metadata.atlasSafetyClass,
+    inputSchema,
+    outputSchema: outputSchema(),
+    examples: exampleFor(inputSchema),
+    machine: metadata.machine
+  };
+}
+function digestFor(operations) {
+  const canonical = JSON.stringify(operations);
+  return `sha256:${createHash("sha256").update(canonical).digest("hex")}`;
+}
+function buildOperationManifest(program) {
+  const operations = listInvocableCommands(program).map((command) => {
+    const path = commandPath(command);
+    const id = operationId(path);
+    const metadata = registeredOperationMetadata(id);
+    if (!metadata) {
+      throw new Error(`Missing explicit Wave CLI operation metadata: ${id}`);
+    }
+    return entryFor(command, metadata);
+  }).sort((left, right) => left.id.localeCompare(right.id));
+  const seen = /* @__PURE__ */ new Set();
+  for (const operation of operations) {
+    if (seen.has(operation.id)) {
+      throw new Error(`Duplicate Wave CLI operation id: ${operation.id}`);
+    }
+    seen.add(operation.id);
+  }
+  return {
+    manifestVersion: "1",
+    cli: { package: "@wave-ai-os/wave-cli", version: CLI_VERSION },
+    registryDigest: digestFor(operations),
+    operationCount: operations.length,
+    operations
+  };
+}
+
+// src/commands/discovery.ts
 var PRIMARY_NAMESPACES = [
   "osmd",
   "broadcast",
@@ -15641,13 +16280,6 @@ function readableToolSupport(key) {
     ].join("\n");
   }).join("\n\n");
 }
-function commandPaths(command, prefix = command.name()) {
-  const children = command.commands.filter((child) => !child.name().startsWith("help"));
-  if (children.length === 0) {
-    return [prefix];
-  }
-  return children.flatMap((child) => commandPaths(child, `${prefix} ${child.name()}`));
-}
 function commandSummary(command) {
   return {
     name: command.name(),
@@ -15892,12 +16524,16 @@ function registerDiscoveryCommands(program) {
   });
   const api = program.command("api").description("Discover Wave API-backed CLI operations");
   api.command("ls").description("List scriptable command paths").option("--readable", "Print command paths as plain lines").option("--json", "Emit the stable JSON envelope").action((opts) => {
-    const paths = commandPaths(program).filter((path) => path !== "wave");
+    const manifest = buildOperationManifest(program);
+    const paths = manifest.operations.map((operation) => operation.command);
     if (opts.readable && !opts.json) {
       return printTextAndExit({ text: paths.join("\n") });
     }
     return printEnvelopeAndExit({
       envelope: buildEnvelope2("api.ls", {
+        ...manifest,
+        // Retained as a derived compatibility projection for existing CLI
+        // callers. The manifest above is the sole inventory source.
         commands: paths,
         examples: ["wave api ls --json"]
       })
@@ -15994,9 +16630,6 @@ function attachDiscoveryHelp(program) {
   }
 }
 
-// src/version.ts
-var CLI_VERSION = "0.1.66";
-
 // src/cli.ts
 function buildCli(options) {
   const program = new Command();
@@ -16005,7 +16638,7 @@ function buildCli(options) {
     "Read auth/runtime context JSON from stdin (token, baseUrl, tracing fields, ...)"
   ).option(
     "--base-url <baseUrl>",
-    "API base URL (prefer WAVE_API_BASE_URL env var)"
+    "API base URL (defaults to production; WAVE_API_BASE_URL overrides it)"
   ).option(
     "--organization-id <organizationId>",
     "Explicit organization ID override"
@@ -16078,6 +16711,371 @@ function buildCli(options) {
   return program;
 }
 
+// src/machine.ts
+import { createHash as createHash2 } from "crypto";
+var MACHINE_FLAGS = /* @__PURE__ */ new Set([
+  "--machine",
+  "--operation",
+  "--phase",
+  "--input-json"
+]);
+function machineEnvelope(params) {
+  return {
+    ok: params.ok,
+    command: params.command,
+    status: params.status,
+    data: params.data ?? null,
+    error: params.error ?? null,
+    meta: { requestId: "machine" }
+  };
+}
+function isPlainObject(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function hasAction2(command) {
+  return Boolean(command._actionHandler);
+}
+function commandId(command) {
+  const path = [];
+  let current = command;
+  while (current) {
+    if (current.name()) path.unshift(current.name());
+    current = current.parent;
+  }
+  return path.slice(1).join(".");
+}
+function parseMachineArgs(argv) {
+  const values = {};
+  for (let index = 0; index < argv.length; index += 1) {
+    const flag = argv[index];
+    if (!MACHINE_FLAGS.has(flag)) {
+      return { error: `Unsupported machine flag: ${flag}` };
+    }
+    const value = argv[index + 1];
+    if (!value || value.startsWith("--")) {
+      return { error: `Missing value for ${flag}` };
+    }
+    if (flag in values) return { error: `Machine flag may be supplied only once: ${flag}` };
+    values[flag] = value;
+    index += 1;
+  }
+  if (values["--machine"] !== "execute") {
+    return { error: '--machine must be "execute".' };
+  }
+  return {
+    operation: values["--operation"],
+    phase: values["--phase"],
+    inputJson: values["--input-json"]
+  };
+}
+async function readMachineInput(location) {
+  if (location !== "-") {
+    throw new Error('Machine input must be supplied with "--input-json -".');
+  }
+  let raw = "";
+  process.stdin.setEncoding("utf8");
+  for await (const chunk of process.stdin) raw += chunk;
+  if (!raw.trim()) throw new Error("Machine input JSON is required.");
+  const parsed = JSON.parse(raw);
+  if (!isPlainObject(parsed)) throw new Error("Machine input must be a JSON object.");
+  return parsed;
+}
+function inputDigest(input) {
+  return `sha256:${createHash2("sha256").update(canonicalJson(input)).digest("hex")}`;
+}
+function canonicalJson(value) {
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  if (isPlainObject(value)) {
+    return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function normalizeInput(input) {
+  return Object.fromEntries(
+    Object.keys(input).sort().map((key) => [key, input[key]])
+  );
+}
+function parseTrustedJson(name, predicate) {
+  const raw = process.env[name];
+  if (!raw) return null;
+  try {
+    const parsed = JSON.parse(raw);
+    return predicate(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function isTrustedAuth(value) {
+  return isPlainObject(value) && typeof value.token === "string" && value.token.trim() !== "" && typeof value.baseUrl === "string" && value.baseUrl.trim() !== "" && typeof value.organizationId === "string" && value.organizationId.trim() !== "" && typeof value.actorId === "string" && value.actorId.trim() !== "";
+}
+function isTrustedApproval(value) {
+  return isPlainObject(value) && typeof value.operation === "string" && typeof value.inputDigest === "string" && typeof value.cliVersion === "string" && typeof value.registryDigest === "string" && typeof value.organizationId === "string" && value.organizationId.trim() !== "" && typeof value.actorId === "string" && value.actorId.trim() !== "";
+}
+function operationCommand(program, id) {
+  return listInvocableCommands(program).find((command) => commandId(command) === id);
+}
+function typeMatches(value, type) {
+  if (type === "array") return Array.isArray(value);
+  if (type === "null") return value === null;
+  if (type === "object") return isPlainObject(value);
+  return typeof value === type;
+}
+function validateInput(operation, input) {
+  const allowed = new Set(Object.keys(operation.inputSchema.properties));
+  const unknown = Object.keys(input).filter((key) => !allowed.has(key));
+  const missing = operation.inputSchema.required.filter(
+    (key) => input[key] === void 0 || input[key] === null || input[key] === ""
+  );
+  const typeErrors = Object.entries(input).flatMap(([key, value]) => {
+    const property = operation.inputSchema.properties[key];
+    if (!property) return [];
+    const types = Array.isArray(property.type) ? property.type : [property.type];
+    return types.some((type) => typeMatches(value, type)) ? [] : [`Invalid input type for ${key}: expected ${types.join(" or ")}.`];
+  });
+  return [
+    ...unknown.map((key) => `Unknown input property: ${key}`),
+    ...missing.map((key) => `Missing required input property: ${key}`),
+    ...typeErrors
+  ];
+}
+function optionValue(value) {
+  return typeof value === "string" ? value : JSON.stringify(value);
+}
+function commandArgs(command, input) {
+  const path = [];
+  let current = command;
+  while (current) {
+    if (current.name()) path.unshift(current.name());
+    current = current.parent;
+  }
+  const args = path.slice(1);
+  for (const argument of command.registeredArguments) {
+    const key = argument.name().replace(/<|>|\[|\]|\.\.\./g, "");
+    const value = input[key];
+    if (value === void 0) continue;
+    if (Array.isArray(value)) args.push(...value.map(optionValue));
+    else args.push(optionValue(value));
+  }
+  for (const option of command.options) {
+    const key = option.attributeName();
+    const value = input[key];
+    if (value === void 0 || value === false) continue;
+    const long = option.long;
+    if (!long) continue;
+    if (value === true) args.push(long);
+    else args.push(long, optionValue(value));
+  }
+  return args;
+}
+function withTrustedMachineAuth(auth, callback) {
+  const previousWaveEnvironment = Object.fromEntries(
+    Object.entries(process.env).filter(([key]) => key.startsWith("WAVE_"))
+  );
+  for (const key of Object.keys(process.env)) {
+    if (key.startsWith("WAVE_")) delete process.env[key];
+  }
+  if (auth) {
+    process.env.WAVE_API_TOKEN = auth.token;
+    process.env.WAVE_API_BASE_URL = auth.baseUrl;
+  }
+  process.env.WAVE_CLI_AUTH_STORAGE = "disabled";
+  process.env.WAVE_CLI_HOME = "/dev/null";
+  return callback().finally(() => {
+    for (const key of Object.keys(process.env)) {
+      if (key.startsWith("WAVE_")) delete process.env[key];
+    }
+    Object.assign(process.env, previousWaveEnvironment);
+  });
+}
+function needsTrustedAuth(operation) {
+  return operation.classification === "read" || operation.classification === "write" || operation.classification === "auth";
+}
+function resolveMachineOperation(program, id) {
+  const manifest = buildOperationManifest(program);
+  const operation = manifest.operations.find((candidate) => candidate.id === id);
+  const command = operation ? operationCommand(program, id) : void 0;
+  return operation && command && hasAction2(command) ? { operation, command } : null;
+}
+async function maybeRunMachineExecute(argv, program) {
+  if (argv[0] !== "--machine") return false;
+  const parsed = parseMachineArgs(argv);
+  if (parsed.error || !parsed.operation || !parsed.phase) {
+    return printEnvelopeAndExit({
+      envelope: machineEnvelope({
+        ok: false,
+        status: 400,
+        command: "machine.execute",
+        error: { code: "invalid_args", message: parsed.error ?? "operation and phase are required." }
+      }),
+      exitCode: EXIT_CODES.invalidArgs
+    });
+  }
+  if (!["validate", "preview", "execute"].includes(parsed.phase)) {
+    return printEnvelopeAndExit({
+      envelope: machineEnvelope({
+        ok: false,
+        status: 400,
+        command: "machine.execute",
+        error: { code: "invalid_phase", message: `Unsupported machine phase: ${parsed.phase}` }
+      }),
+      exitCode: EXIT_CODES.invalidArgs
+    });
+  }
+  let input;
+  try {
+    input = await readMachineInput(parsed.inputJson);
+  } catch (error) {
+    return printEnvelopeAndExit({
+      envelope: machineEnvelope({
+        ok: false,
+        status: 400,
+        command: "machine.execute",
+        error: { code: "invalid_input", message: error instanceof Error ? error.message : "Invalid machine input." }
+      }),
+      exitCode: EXIT_CODES.invalidArgs
+    });
+  }
+  const resolved = resolveMachineOperation(program, parsed.operation);
+  if (!resolved) {
+    return printEnvelopeAndExit({
+      envelope: machineEnvelope({
+        ok: false,
+        status: 404,
+        command: "machine.execute",
+        error: { code: "unknown_operation", message: `Unknown operation: ${parsed.operation}` }
+      }),
+      exitCode: EXIT_CODES.notFound
+    });
+  }
+  const normalizedInput = normalizeInput(input);
+  const errors = validateInput(resolved.operation, normalizedInput);
+  const digest = inputDigest(normalizedInput);
+  if (errors.length > 0) {
+    return printEnvelopeAndExit({
+      envelope: machineEnvelope({
+        ok: false,
+        status: 400,
+        command: "machine.execute",
+        error: { code: "invalid_input", message: "Machine input did not match the operation schema.", details: { errors } },
+        data: {
+          operation: resolved.operation.id,
+          normalizedInput,
+          inputDigest: digest
+        }
+      }),
+      exitCode: EXIT_CODES.invalidArgs
+    });
+  }
+  const manifest = buildOperationManifest(program);
+  if (parsed.phase === "validate") {
+    return printEnvelopeAndExit({
+      envelope: machineEnvelope({
+        ok: true,
+        status: 200,
+        command: "machine.execute",
+        data: {
+          status: "validated",
+          operation: resolved.operation.id,
+          normalizedInput,
+          inputDigest: digest,
+          cliVersion: manifest.cli.version,
+          registryDigest: manifest.registryDigest
+        }
+      })
+    });
+  }
+  if (parsed.phase === "preview") {
+    if (resolved.operation.classification !== "write") {
+      return printEnvelopeAndExit({
+        envelope: machineEnvelope({
+          ok: false,
+          status: 400,
+          command: "machine.execute",
+          error: { code: "preview_not_supported", message: `${resolved.operation.id} is not a write operation.` }
+        }),
+        exitCode: EXIT_CODES.invalidArgs
+      });
+    }
+    return printEnvelopeAndExit({
+      envelope: machineEnvelope({
+        ok: true,
+        status: 200,
+        command: "machine.execute",
+        data: {
+          status: "preview",
+          operation: resolved.operation.id,
+          normalizedInput,
+          preview: {
+            title: resolved.operation.summary,
+            command: resolved.operation.command,
+            requestedInput: normalizedInput,
+            summary: `Execute ${resolved.operation.command} with the validated input.`
+          },
+          inputDigest: digest,
+          cliVersion: manifest.cli.version,
+          registryDigest: manifest.registryDigest
+        }
+      })
+    });
+  }
+  if (resolved.operation.classification === "auth") {
+    return printEnvelopeAndExit({
+      envelope: machineEnvelope({
+        ok: true,
+        status: 202,
+        command: "machine.execute",
+        data: {
+          status: "continuation_required",
+          operation: resolved.operation.id,
+          message: "Interactive authentication is not run in machine mode. Continue through the MCP OAuth flow."
+        }
+      })
+    });
+  }
+  const auth = parseTrustedJson("WAVE_MACHINE_AUTH_JSON", isTrustedAuth);
+  if (needsTrustedAuth(resolved.operation) && !auth) {
+    return printEnvelopeAndExit({
+      envelope: machineEnvelope({
+        ok: false,
+        status: 401,
+        command: "machine.execute",
+        error: {
+          code: "missing_machine_auth",
+          message: "Machine execution requires trusted OAuth-bound auth context."
+        }
+      }),
+      exitCode: EXIT_CODES.missingOrInvalidAuth
+    });
+  }
+  if (resolved.operation.classification === "write") {
+    const approval = parseTrustedJson("WAVE_MACHINE_APPROVAL_JSON", isTrustedApproval);
+    if (!approval || approval.operation !== resolved.operation.id || approval.inputDigest !== digest || approval.cliVersion !== manifest.cli.version || approval.registryDigest !== manifest.registryDigest || approval.organizationId !== auth?.organizationId || approval.actorId !== auth?.actorId) {
+      return printEnvelopeAndExit({
+        envelope: machineEnvelope({
+          ok: false,
+          status: 403,
+          command: "machine.execute",
+          error: {
+            code: "approval_required",
+            message: "A matching server-managed approval is required before write execution.",
+            details: { operation: resolved.operation.id, inputDigest: digest }
+          }
+        }),
+        exitCode: EXIT_CODES.forbidden
+      });
+    }
+  }
+  try {
+    await withTrustedMachineAuth(auth, async () => {
+      await program.parseAsync([process.execPath, "wave", ...commandArgs(resolved.command, normalizedInput)]);
+    });
+  } catch (error) {
+    if (isEnvelopeEmittedSignal(error)) return true;
+    throw error;
+  }
+  return true;
+}
+
 // src/index.ts
 function printCliFailure(params) {
   printEnvelope({
@@ -16099,6 +17097,7 @@ function printCliFailure(params) {
 }
 async function main() {
   const program = buildCli();
+  if (await maybeRunMachineExecute(process.argv.slice(2), program)) return;
   await program.parseAsync(process.argv);
 }
 main().catch((error) => {