@wave-ai-os/wave-cli 0.1.76 → 0.1.78

package/dist/index.js

@@ -8,7 +8,7 @@ import { ZodError } from "zod";
 import { Command } from "commander";
 
 // src/commands/tasks.ts
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 
 // src/config.ts
 import { z } from "zod";
@@ -2143,6 +2143,17 @@ async function authGraphqlRequest(params) {
   }
 }
 
+// src/machineRuntimeContext.ts
+import { AsyncLocalStorage } from "async_hooks";
+var machineRuntimeAuthStorage = new AsyncLocalStorage();
+function currentMachineRuntimeAuth() {
+  return machineRuntimeAuthStorage.getStore();
+}
+function withMachineRuntimeAuth(auth, callback) {
+  if (!auth) return callback();
+  return machineRuntimeAuthStorage.run(auth, callback);
+}
+
 // src/commands/runtimeOptions.ts
 var CLI_AUTH_STATUS_QUERY = "query WaveCliAuthenticatedOrganization { cliAuthStatus { authenticated baseAuthStatus organization { id slug } } }";
 var stdinPromise = null;
@@ -2169,6 +2180,11 @@ function parseBool(raw) {
   }
   return void 0;
 }
+function omitUndefined(values) {
+  return Object.fromEntries(
+    Object.entries(values).filter(([, value]) => value !== void 0)
+  );
+}
 function parseAuthJson(raw) {
   try {
     const parsed = JSON.parse(raw);
@@ -2176,7 +2192,7 @@ function parseAuthJson(raw) {
       throw new Error("Expected JSON object.");
     }
     const obj = parsed;
-    return {
+    return omitUndefined({
       token: normalize3(obj.token),
       baseUrl: normalize3(obj.baseUrl ?? obj.base_url),
       timeoutMs: typeof obj.timeoutMs === "number" || typeof obj.timeoutMs === "string" ? obj.timeoutMs : typeof obj.timeout_ms === "number" || typeof obj.timeout_ms === "string" ? obj.timeout_ms : void 0,
@@ -2209,7 +2225,7 @@ function parseAuthJson(raw) {
       openapiPath: normalize3(obj.openapiPath ?? obj.openapi_path),
       openapiUrl: normalize3(obj.openapiUrl ?? obj.openapi_url),
       openapiVersion: normalize3(obj.openapiVersion ?? obj.openapi_version)
-    };
+    });
   } catch (error) {
     throw new CliError({
       message: error instanceof Error ? `Invalid --auth-json-stdin payload: ${error.message}` : "Invalid --auth-json-stdin payload.",
@@ -2257,13 +2273,14 @@ function firstDefined(...values) {
   return values.find((value) => value !== void 0);
 }
 function resolveAuthToken(options, stdin, config, env) {
+  const candidate = (source, token) => token ? { token, source } : { source };
   const candidates = [
-    { token: normalize3(options.token), source: "flag" },
-    { token: normalize3(stdin.token), source: "stdin" },
-    { token: normalize3(env.WAVE_API_TOKEN), source: "env" },
-    { token: normalize3(config.token), source: "config" }
+    candidate("flag", normalize3(options.token)),
+    candidate("stdin", normalize3(stdin.token)),
+    candidate("env", normalize3(env.WAVE_API_TOKEN)),
+    candidate("config", normalize3(config.token))
   ];
-  return candidates.find((candidate) => candidate.token) ?? { source: "none" };
+  return candidates.find((candidate2) => candidate2.token) ?? { source: "none" };
 }
 function resolveFromSources(options, stdin, config, env) {
   const baseUrl = firstDefined(
@@ -2362,10 +2379,9 @@ function resolveFromSources(options, stdin, config, env) {
     normalize3(config.openapiVersion)
   );
   const resolvedAuth = resolveAuthToken(options, stdin, config, env);
-  return {
-    organizationId,
+  const resolved = {
     organizationIdSource,
-    runtimeOptions: {
+    runtimeOptions: omitUndefined({
       token: resolvedAuth.token,
       tokenSource: resolvedAuth.token ? resolvedAuth.source : "none",
       baseUrl,
@@ -2385,8 +2401,10 @@ function resolveFromSources(options, stdin, config, env) {
       openapiPath,
       openapiUrl,
       openapiVersion
-    }
+    })
   };
+  if (organizationId) resolved.organizationId = organizationId;
+  return resolved;
 }
 async function resolveWithStoredToken(context) {
   if (context.runtimeOptions.token || !context.runtimeOptions.baseUrl) {
@@ -2410,11 +2428,11 @@ async function resolveWithAuthenticatedOrganization(context) {
   const baseUrl = normalize3(context.runtimeOptions.baseUrl);
   const token = normalize3(context.runtimeOptions.token);
   if (!baseUrl || !token) {
+    const runtimeOptions2 = { ...context.runtimeOptions };
+    delete runtimeOptions2.organizationId;
     return {
-      ...context,
-      organizationId: void 0,
       organizationIdSource: "none",
-      runtimeOptions: { ...context.runtimeOptions, organizationId: void 0 }
+      runtimeOptions: runtimeOptions2
     };
   }
   const response = await authGraphqlRequest({
@@ -2424,12 +2442,18 @@ async function resolveWithAuthenticatedOrganization(context) {
     query: CLI_AUTH_STATUS_QUERY
   });
   const organizationId = response.ok ? organizationIdFromCliAuthStatus(response.result.data) : void 0;
-  return {
-    ...context,
-    organizationId,
+  const runtimeOptions = { ...context.runtimeOptions };
+  if (organizationId) {
+    runtimeOptions.organizationId = organizationId;
+  } else {
+    delete runtimeOptions.organizationId;
+  }
+  const resolved = {
     organizationIdSource: organizationId ? "token" : "none",
-    runtimeOptions: { ...context.runtimeOptions, organizationId }
+    runtimeOptions
   };
+  if (organizationId) resolved.organizationId = organizationId;
+  return resolved;
 }
 function defaultConfigPath(env) {
   const explicitEnv = normalize3(env.WAVE_CONFIG_PATH);
@@ -2496,7 +2520,22 @@ async function resolveStdinContext(options) {
 async function resolveUnscopedCommandContext(options) {
   const stdin = await resolveStdinContext(options);
   const config = await resolveConfigFileContext(options, process.env);
-  return resolveWithStoredToken(resolveFromSources(options, stdin, config, process.env));
+  return resolveWithStoredToken(applyMachineRuntimeAuth(resolveFromSources(options, stdin, config, process.env)));
+}
+function applyMachineRuntimeAuth(resolved) {
+  const machineAuth = currentMachineRuntimeAuth();
+  if (!machineAuth) return resolved;
+  return {
+    organizationId: machineAuth.organizationId,
+    organizationIdSource: "flag",
+    runtimeOptions: {
+      ...resolved.runtimeOptions,
+      token: machineAuth.token,
+      tokenSource: "machine",
+      baseUrl: machineAuth.baseUrl,
+      organizationId: machineAuth.organizationId
+    }
+  };
 }
 async function resolveCommandContext(options) {
   return resolveWithAuthenticatedOrganization(await resolveUnscopedCommandContext(options));
@@ -2650,10 +2689,29 @@ function registerGraphqlSearchCommand(command, config) {
   });
 }
 
+// src/commands/taskPriority.ts
+import { z as z2 } from "zod";
+var taskPrioritySchema = z2.enum(["no_priority", "urgent", "high", "medium", "low"]);
+var taskPriorityValues = taskPrioritySchema.options.join(", ");
+var taskPriorityHelp = `Filter by priority: ${taskPriorityValues}.`;
+function parseTaskPriority(value) {
+  if (value === void 0) return void 0;
+  const parsed = taskPrioritySchema.safeParse(value);
+  if (!parsed.success) {
+    throw new CliError({
+      message: `Invalid task priority. Use one of: ${taskPriorityValues}.`,
+      kind: "invalid_args",
+      status: 400,
+      exitCode: EXIT_CODES.invalidArgs
+    });
+  }
+  return parsed.data.toUpperCase();
+}
+
 // src/commands/tasks.ts
-var projectIdSchema = z2.string().min(1);
-var idSchema = z2.string().min(1);
-var summarySchema = z2.string().min(1);
+var projectIdSchema = z3.string().min(1);
+var idSchema = z3.string().min(1);
+var summarySchema = z3.string().min(1);
 function parseTaskUpdateJson(raw) {
   try {
     const parsed = JSON.parse(raw);
@@ -2680,7 +2738,7 @@ function parseLabelIds(raw) {
 }
 function registerTaskCommands(program) {
   const tasks = program.command("tasks").description("Task operations");
-  tasks.command("list").option("--project-id <projectId>").option("--page <page>").option("--per <per>").option("--team-id <teamId>").option("--team-ids <teamIds>").option("--member-id <memberId>").option("--meeting-id <meetingId>").option("--field-name <fieldName>").option("--field-value <fieldValue>").option("--field-blank <fieldBlank>").option("--open <open>").option("--rank-direction <rankDirection>").option("--include-archived <includeArchived>").action(async (opts, cmd) => {
+  tasks.command("list").option("--project-id <projectId>").option("--page <page>").option("--per <per>").option("--team-id <teamId>").option("--team-ids <teamIds>").option("--member-id <memberId>").option("--meeting-id <meetingId>").option("--field-name <fieldName>").option("--field-value <fieldValue>").option("--field-blank <fieldBlank>").option("--open <open>").option("--priority <priority>", taskPriorityHelp).option("--rank-direction <rankDirection>").option("--include-archived <includeArchived>").action(async (opts, cmd) => {
     const context = await resolveCommandContext(cmd.optsWithGlobals());
     const organizationId = resolveOrganizationId(context.organizationId);
     const projectId = opts.projectId ? projectIdSchema.parse(opts.projectId) : void 0;
@@ -2701,9 +2759,27 @@ function registerTaskCommands(program) {
         field_value: opts.fieldValue,
         field_blank: opts.fieldBlank,
         open: opts.open,
+        priority: parseTaskPriority(opts.priority),
         rank_direction: opts.rankDirection,
         include_archived: opts.includeArchived
       }),
+      variableTypes: {
+        organization_id: "ID!",
+        page: "Int",
+        per: "Int",
+        project_id: "ID",
+        team_id: "ID",
+        team_ids: "[ID!]",
+        member_id: "ID",
+        meeting_id: "ID",
+        field_name: "String",
+        field_value: "String",
+        field_blank: "Boolean",
+        open: "Boolean",
+        priority: "TaskPriority",
+        rank_direction: "String",
+        include_archived: "Boolean"
+      },
       isList: true
     });
   });
@@ -2798,10 +2874,10 @@ function registerTaskCommands(program) {
 }
 
 // src/commands/projects.ts
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 
 // src/commands/entityCrud.ts
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 
 // src/commands/dtoHelpCatalog.ts
 var dtoHelpCatalog = {
@@ -3382,7 +3458,7 @@ function buildDataJsonHelp(rootKey, mode) {
 }
 
 // src/commands/entityCrud.ts
-var idSchema2 = z3.string().min(1);
+var idSchema2 = z4.string().min(1);
 function toSingularResourceName(resourcePath) {
   if (resourcePath === "organization_meta_profiles") {
     return "organization_meta_profile";
@@ -3608,10 +3684,28 @@ var __testables = {
 };
 
 // src/commands/projects.ts
-var idSchema3 = z4.string().min(1);
+var idSchema3 = z5.string().min(1);
+var projectStatusSchema = z5.enum([
+  "backlog",
+  "planned",
+  "in_progress",
+  "completed",
+  "cancelled"
+]);
+var projectStatusValues = projectStatusSchema.options.join(", ");
+var projectPrioritySchema = z5.enum([
+  "no_priority",
+  "urgent",
+  "high",
+  "medium",
+  "low"
+]);
+var projectPriorityValues = projectPrioritySchema.options.join(", ");
 var projectCreateDataJsonHelp = buildDataJsonHelp("project", "create") ?? 'JSON object for project or {"project": {...}}';
 var projectUpdateDataJsonHelp = buildDataJsonHelp("project", "update") ?? 'JSON object for project or {"project": {...}}';
-var projectsIndexMinimalSelectionSet = "{ count currentPage totalPages data { id type attributes { name slug status priority } } }";
+function projectsIndexMinimalSelectionSet(includeProjectTypes = false) {
+  return `{ count currentPage totalPages data { id type attributes { name slug status priority${includeProjectTypes ? " projectType" : ""} } } }`;
+}
 var displayPreferenceAttributesSelectionSet = "attributes { id viewType favorite groupingField groupToggleState memberId focusMemberId focusTeamId displayableId displayableType preferenceType agendaItemId }";
 var filterPreferenceAttributesSelectionSet = "attributes { id filterType filter memberId focusMemberId focusTeamId filterableId filterableType preferenceType agendaItemId }";
 var healthUpdateSummarySelectionSet = "id type value memberId status createdAt updatedAt updatableType updatableId parentUpdateId emojis { id name memberId } resources { ...ResourceSummaryFull }";
@@ -3622,6 +3716,32 @@ function asRecord3(value) {
 function toNonEmptyString(value) {
   return typeof value === "string" && value.trim() !== "" ? value : void 0;
 }
+function parseProjectStatus(value) {
+  if (value === void 0) return void 0;
+  const parsed = projectStatusSchema.safeParse(value);
+  if (!parsed.success) {
+    throw new CliError({
+      message: `Invalid project status. Use one of: ${projectStatusValues}.`,
+      kind: "invalid_args",
+      status: 400,
+      exitCode: EXIT_CODES.invalidArgs
+    });
+  }
+  return parsed.data.toUpperCase();
+}
+function parseProjectPriority(value) {
+  if (value === void 0) return void 0;
+  const parsed = projectPrioritySchema.safeParse(value);
+  if (!parsed.success) {
+    throw new CliError({
+      message: `Invalid project priority. Use one of: ${projectPriorityValues}.`,
+      kind: "invalid_args",
+      status: 400,
+      exitCode: EXIT_CODES.invalidArgs
+    });
+  }
+  return parsed.data.toUpperCase();
+}
 function normalizeProjectRowForDisplay(row) {
   const record = asRecord3(row);
   if (!record) return row;
@@ -3649,7 +3769,13 @@ function normalizeProjectsListForDisplay(payload) {
 }
 function registerProjectCommands(program) {
   const projects = program.command("projects").description("Project operations");
-  projects.command("list").option("--page <page>").option("--per <per>").option("--team-ids <teamIds>").option("--member-id <memberId>").action(async (opts, cmd) => {
+  projects.command("list").option("--page <page>").option("--per <per>").option("--team-ids <teamIds>").option("--member-id <memberId>").option(
+    "--status <status>",
+    "Filter by status: backlog, planned, in_progress, completed, cancelled."
+  ).option(
+    "--priority <priority>",
+    "Filter by priority: no_priority, urgent, high, medium, low."
+  ).option("--include-project-types", "Include projectType in the list response (opt-in).").action(async (opts, cmd) => {
     const context = await resolveCommandContext(cmd.optsWithGlobals());
     const organizationId = resolveOrganizationId(context.organizationId);
     await runGraphqlQueryCommand({
@@ -3662,17 +3788,21 @@ function registerProjectCommands(program) {
         page: opts.page,
         per: opts.per,
         team_ids: opts.teamIds,
-        member_id: opts.memberId
+        member_id: opts.memberId,
+        status: parseProjectStatus(opts.status),
+        priority: parseProjectPriority(opts.priority)
       }),
       variableTypes: {
         organization_id: "ID!",
         page: "Int",
         per: "Int",
         team_ids: "[ID!]",
-        member_id: "ID"
+        member_id: "ID",
+        status: "ProjectStatus",
+        priority: "ProjectPriority"
       },
       isList: true,
-      selectionSet: projectsIndexMinimalSelectionSet,
+      selectionSet: projectsIndexMinimalSelectionSet(opts.includeProjectTypes === true),
       transformData: normalizeProjectsListForDisplay
     });
   });
@@ -3680,7 +3810,7 @@ function registerProjectCommands(program) {
     command: "projects",
     operationName: "ProjectsSearch",
     field: "projects",
-    selectionSet: projectsIndexMinimalSelectionSet,
+    selectionSet: projectsIndexMinimalSelectionSet(),
     transformData: normalizeProjectsListForDisplay
   });
   projects.command("show").requiredOption("--id <id>").action(async (opts, cmd) => {
@@ -3739,10 +3869,10 @@ function registerProjectCommands(program) {
 }
 
 // src/commands/rocks.ts
-import { z as z5 } from "zod";
-var idSchema4 = z5.string().min(1);
-var rockCollectionIdSchema = z5.string().min(1);
-var statusSchema = z5.enum(["on_track", "at_risk", "off_track"]);
+import { z as z6 } from "zod";
+var idSchema4 = z6.string().min(1);
+var rockCollectionIdSchema = z6.string().min(1);
+var statusSchema = z6.enum(["on_track", "at_risk", "off_track"]);
 var createHelp = buildDataJsonHelp("rock", "create") ?? 'JSON object for rock or {"rock": {...}}';
 var updateHelp = buildDataJsonHelp("rock", "update") ?? 'JSON object for rock or {"rock": {...}}';
 function registerRockCommands(program) {
@@ -3840,9 +3970,9 @@ function registerRockCommands(program) {
 }
 
 // src/commands/meetings.ts
-import { z as z6 } from "zod";
-var idSchema5 = z6.string().min(1);
-var notesSchema = z6.string().min(1);
+import { z as z7 } from "zod";
+var idSchema5 = z7.string().min(1);
+var notesSchema = z7.string().min(1);
 var MEETING_TYPES = /* @__PURE__ */ new Set(["TeamMeeting", "OneOnOneMeeting"]);
 var MEETING_STATUSES = /* @__PURE__ */ new Set(["upcoming", "active", "completed"]);
 var MEETING_REPEATS = /* @__PURE__ */ new Set(["never", "weekly", "biweekly", "monthly", "quarterly"]);
@@ -4075,8 +4205,8 @@ function registerMeetingCommands(program) {
 }
 
 // src/commands/members.ts
-import { z as z7 } from "zod";
-var idSchema6 = z7.string().min(1);
+import { z as z8 } from "zod";
+var idSchema6 = z8.string().min(1);
 var createHelp3 = buildDataJsonHelp("member", "create") ?? 'JSON object for member or {"member": {...}}';
 var updateHelp3 = buildDataJsonHelp("member", "update") ?? 'JSON object for member or {"member": {...}}';
 var MEMBER_META_PROFILE_SELECTION = "{ id type memberId summary profile attributes { id memberId summary profile } }";
@@ -4205,9 +4335,9 @@ function registerMemberCommands(program) {
 }
 
 // src/commands/skills.ts
-import { z as z8 } from "zod";
-var idSchema7 = z8.string().min(1);
-var limitSchema = z8.coerce.number().int().positive();
+import { z as z9 } from "zod";
+var idSchema7 = z9.string().min(1);
+var limitSchema = z9.coerce.number().int().positive();
 var SKILL_SELECTION = `{
   id
   type
@@ -4283,17 +4413,24 @@ function registerSkillCommands(program) {
 }
 
 // src/commands/issues.ts
-import { z as z9 } from "zod";
-var issueGroupIdSchema = z9.string().min(1);
-var idSchema8 = z9.string().min(1);
-var nameSchema = z9.string().min(1);
-var issueTypeSchema = z9.string().min(1).refine((value) => value === "short_term" || value === "long_term", {
+import { z as z10 } from "zod";
+var issueGroupIdSchema = z10.string().min(1);
+var idSchema8 = z10.string().min(1);
+var nameSchema = z10.string().min(1);
+var issueTypeSchema = z10.string().min(1).refine((value) => value === "short_term" || value === "long_term", {
   message: "Invalid issue type. Use one of: short_term, long_term."
 });
+var issueStatusSchema = z10.string().min(1).refine((value) => value === "open" || value === "completed", {
+  message: "Invalid issue status. Use one of: open, completed."
+});
 var updateHelp4 = buildDataJsonHelp("issue", "update") ?? 'JSON object for issue or {"issue": {...}}';
+function parseIssueIndexEnum(value, schema) {
+  if (value === void 0) return void 0;
+  return schema.parse(String(value)).toUpperCase();
+}
 function registerIssueCommands(program) {
   const issues = program.command("issues").description("Issue operations");
-  issues.command("list").option("--page <page>").option("--per <per>").option("--issue-group-id <issueGroupId>").option("--start-date <startDate>").option("--issue-type <issueType>").option("--team-id <teamId>").option("--member-id <memberId>").option("--meeting-id <meetingId>").action(async (opts, cmd) => {
+  issues.command("list").option("--page <page>").option("--per <per>").option("--issue-group-id <issueGroupId>").option("--start-date <startDate>").option("--issue-type <issueType>").option("--status <status>", "Issue status: open | completed").option("--team-id <teamId>").option("--member-id <memberId>").option("--meeting-id <meetingId>").action(async (opts, cmd) => {
     const context = await resolveCommandContext(cmd.optsWithGlobals());
     const organizationId = resolveOrganizationId(context.organizationId);
     await runGraphqlQueryCommand({
@@ -4306,11 +4443,24 @@ function registerIssueCommands(program) {
         per: opts.per,
         issue_group_id: opts.issueGroupId,
         start_date: opts.startDate,
-        issue_type: opts.issueType,
+        issue_type: parseIssueIndexEnum(opts.issueType, issueTypeSchema),
+        status: parseIssueIndexEnum(opts.status, issueStatusSchema),
         team_id: opts.teamId,
         member_id: opts.memberId,
         meeting_id: opts.meetingId
       }),
+      variableTypes: {
+        organization_id: "ID!",
+        page: "Int",
+        per: "Int",
+        issue_group_id: "ID",
+        start_date: "String",
+        issue_type: "IssueType",
+        status: "IssueStatus",
+        team_id: "ID",
+        member_id: "ID",
+        meeting_id: "ID"
+      },
       isList: true
     });
   });
@@ -5334,8 +5484,8 @@ function registerSystemToolCommands(program) {
 }
 
 // src/commands/teams.ts
-import { z as z10 } from "zod";
-var idSchema9 = z10.string().min(1);
+import { z as z11 } from "zod";
+var idSchema9 = z11.string().min(1);
 function registerTeamCommands(program) {
   const teams = program.command("teams").description("Team operations");
   teams.command("list").option("--page <page>").option("--per <per>").action(async (opts, cmd) => {
@@ -5401,8 +5551,8 @@ function registerTeamCommands(program) {
 }
 
 // src/commands/organizations.ts
-import { z as z11 } from "zod";
-var idSchema10 = z11.string().min(1);
+import { z as z12 } from "zod";
+var idSchema10 = z12.string().min(1);
 function isRecord3(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
@@ -5614,8 +5764,8 @@ function registerOrganizationCommands(program) {
 }
 
 // src/commands/foundation.ts
-import { z as z12 } from "zod";
-var idSchema11 = z12.string().min(1);
+import { z as z13 } from "zod";
+var idSchema11 = z13.string().min(1);
 var STRATEGIC_PLAN_ALLOWED_UPDATE_KEYS = /* @__PURE__ */ new Set([
   "published_at",
   "profile",
@@ -5816,9 +5966,9 @@ function registerFoundationCommands(program) {
 }
 
 // src/commands/childEntities.ts
-import { z as z13 } from "zod";
-var idSchema12 = z13.string().min(1);
-var jsonObjectSchema = z13.record(z13.string(), z13.unknown());
+import { z as z14 } from "zod";
+var idSchema12 = z14.string().min(1);
+var jsonObjectSchema = z14.record(z14.string(), z14.unknown());
 var NOTE_DETAIL_FIELDS = [
   "notes",
   "hasNotes",
@@ -5966,10 +6116,17 @@ function normalizeSubtaskCreateBody(body) {
 }
 function registerChildCommands(program, config) {
   const command = program.command(config.command).description(config.description);
-  command.command("list").requiredOption(`--${config.parentFlag} <${config.parentFlag}>`).option("--page <page>").option("--per <per>").action(async (opts, cmd) => {
+  const listCommand = command.command("list").requiredOption(`--${config.parentFlag} <${config.parentFlag}>`).option("--page <page>").option("--per <per>");
+  if (config.priorityFilter) {
+    listCommand.option("--priority <priority>", config.priorityFilter.help);
+  }
+  listCommand.action(async (opts, cmd) => {
     const context = await resolveCommandContext(cmd.optsWithGlobals());
     const organizationId = resolveOrganizationId(context.organizationId);
     const parentId = idSchema12.parse(opts[config.parentFlag.replace(/-([a-z])/g, (_, c) => c.toUpperCase())]);
+    const priority = config.priorityFilter?.parse(opts.priority);
+    const priorityVariables = priority === void 0 ? {} : { priority };
+    const priorityVariableTypes = priority === void 0 || !config.priorityFilter ? {} : { priority: config.priorityFilter.variableType };
     await runGraphqlQueryCommand({
       command: `${config.command}.list`,
       operationName: config.listOperationName,
@@ -5979,13 +6136,15 @@ function registerChildCommands(program, config) {
         organization_id: organizationId,
         [config.parentFlag.replace(/-/g, "_")]: parentId,
         page: opts.page,
-        per: opts.per
+        per: opts.per,
+        ...priorityVariables
       }),
       variableTypes: {
         organization_id: "ID!",
         [config.parentFlag.replace(/-/g, "_")]: "ID!",
         page: "Int",
-        per: "Int"
+        per: "Int",
+        ...priorityVariableTypes
       },
       isList: true,
       selectionSet: config.listSelectionSet,
@@ -6105,6 +6264,11 @@ function registerChildEntityCommands(program) {
     destroyOperationName: "SubtasksDestroy",
     listSelectionSet: buildChildListSelectionSet("taskId"),
     listParentTypedField: "taskId",
+    priorityFilter: {
+      variableType: "TaskPriority",
+      help: taskPriorityHelp,
+      parse: parseTaskPriority
+    },
     searchRequiredOptions: requiredParentSearchOption("task-id", "task"),
     showField: "subtask",
     showOperationName: "SubtasksShow",
@@ -6220,9 +6384,9 @@ function registerChildEntityCommands(program) {
 }
 
 // src/commands/content.ts
-import { z as z14 } from "zod";
-var idSchema13 = z14.string().min(1);
-var nonEmptyString = z14.string().min(1);
+import { z as z15 } from "zod";
+var idSchema13 = z15.string().min(1);
+var nonEmptyString = z15.string().min(1);
 var contentAttributesSelection = "attributes { id type name slug content firstChildSlug rootParentSlug status contentType lastEdited organizationId memberId focusMemberId focusTeamId teamId creatorId createdAt updatedAt childCount assignmentType contentableId contentableSlug contentableType votesTotal labelIds rootContentId parentContentId }";
 function assertUpdateFields(params) {
   if (!params.name && !params.content && !params.status) {
@@ -6410,9 +6574,9 @@ function registerContentCommands(program) {
 }
 
 // src/commands/markdownTree.ts
-import { z as z15 } from "zod";
-var nonEmptyString2 = z15.string().min(1);
-var nonNegativeInt = z15.coerce.number().int().min(0);
+import { z as z16 } from "zod";
+var nonEmptyString2 = z16.string().min(1);
+var nonNegativeInt = z16.coerce.number().int().min(0);
 function addScopeOptions(command) {
   return command.requiredOption("--tool-key <toolKey>").requiredOption("--node-key <nodeKey>").option("--parent-id <parentId>").option("--record-id <recordId>").option("--member-id <memberId>").option("--team-id <teamId>").option("--content-type <contentType>").option("--tree-view");
 }
@@ -6577,7 +6741,7 @@ function registerMarkdownTreeCommands(program) {
 }
 
 // src/commands/navigation.ts
-import { z as z16 } from "zod";
+import { z as z17 } from "zod";
 
 // src/internalOptions.ts
 var INTERNAL_OPTIONS_KEY = "__waveInternalOptions";
@@ -6607,8 +6771,8 @@ function getInternalCliOptions(command) {
 }
 
 // src/commands/navigation.ts
-var nonEmpty = z16.string().min(1);
-var nonNegativeInt2 = z16.coerce.number().int().min(0);
+var nonEmpty = z17.string().min(1);
+var nonNegativeInt2 = z17.coerce.number().int().min(0);
 var MIGRATED_BRANCHES = ["directory", "projects", "knowledge"];
 function normalizeText(input) {
   if (typeof input !== "string") return "";
@@ -7391,11 +7555,11 @@ function registerMutationCapabilityCommands(program) {
 // src/commands/osmd.ts
 import { readFile as readFile3 } from "fs/promises";
 import { basename } from "path";
-import { z as z17 } from "zod";
-var sourceSchema = z17.enum(["canonical_osmd", "agent_overlay", "agent_wiki"]);
-var accessSchema = z17.enum(["read_only", "read_write", "append_only"]).catch("read_write");
-var ownerSchema = z17.enum(["system", "atlas"]);
-var suggestedActionSchema = z17.enum([
+import { z as z18 } from "zod";
+var sourceSchema = z18.enum(["canonical_osmd", "agent_overlay", "agent_wiki"]);
+var accessSchema = z18.enum(["read_only", "read_write", "append_only"]).catch("read_write");
+var ownerSchema = z18.enum(["system", "atlas"]);
+var suggestedActionSchema = z18.enum([
   "read",
   "create",
   "init",
@@ -7404,7 +7568,7 @@ var suggestedActionSchema = z17.enum([
   "forbidden",
   "invalid_parent"
 ]).catch("update");
-var agentMarkdownErrorCodeSchema = z17.enum([
+var agentMarkdownErrorCodeSchema = z18.enum([
   "canonical_osmd_read_only",
   "agent_parent_not_found",
   "agent_file_not_found",
@@ -7415,9 +7579,9 @@ var agentMarkdownErrorCodeSchema = z17.enum([
   "invalid_agent_wiki_path"
 ]);
 var agentMarkdownErrorCodeFieldSchema = agentMarkdownErrorCodeSchema.nullable().catch(null);
-var nonEmptyString3 = z17.string().min(1);
-var nonNegativeInt3 = z17.coerce.number().int().min(0);
-var positiveInt = z17.coerce.number().int().min(1);
+var nonEmptyString3 = z18.string().min(1);
+var nonNegativeInt3 = z18.coerce.number().int().min(0);
+var positiveInt = z18.coerce.number().int().min(1);
 var supportedAgentOverlaySystemFiles = ["notes.md", "summary.md"];
 var supportedWikiIndexFile = "index.md";
 var supportedWikiLogFile = "log.md";
@@ -7433,20 +7597,20 @@ var supportedWikiControlledPatterns = supportedWikiControlledFolders.map(
 );
 var controlledWikiSlugPattern = /^[a-z0-9][a-z0-9-]*$/;
 var agentMarkdownSlugPattern = /^[a-z0-9][a-z0-9-]*$/;
-var osmdSearchScopeSchema = z17.enum([
+var osmdSearchScopeSchema = z18.enum([
   "os-only",
   "agent-overlay-only",
   "agent-wiki-only",
   "combined"
 ]);
-var osmdLintScopeSchema = z17.enum([
+var osmdLintScopeSchema = z18.enum([
   "combined",
   "agent-overlay-only",
   "agent-wiki-only"
 ]);
-var osmdMemoryQualityScopeSchema = z17.enum(["agent-overlay-only"]);
-var osmdIngestKindSchema = z17.enum(["text", "file", "url", "transcript"]);
-var osmdRawSourceTypeSchema = z17.enum([
+var osmdMemoryQualityScopeSchema = z18.enum(["agent-overlay-only"]);
+var osmdIngestKindSchema = z18.enum(["text", "file", "url", "transcript"]);
+var osmdRawSourceTypeSchema = z18.enum([
   "pasted_text",
   "uploaded_markdown",
   "uploaded_text",
@@ -7455,31 +7619,30 @@ var osmdRawSourceTypeSchema = z17.enum([
   "meeting_transcript",
   "url"
 ]);
-var defaultOsmdPhantomTimeoutMs = 12e4;
-var agentMarkdownFileSchema = z17.preprocess(
+var agentMarkdownFileSchema = z18.preprocess(
   normalizeAgentMarkdownJsonKeys,
-  z17.object({
-    path: z17.string(),
+  z18.object({
+    path: z18.string(),
     source: sourceSchema,
     access: accessSchema,
     owner: ownerSchema,
-    exists: z17.boolean(),
-    canCreate: z17.boolean(),
-    canUpdate: z17.boolean(),
-    canAppend: z17.boolean(),
-    wikiRole: z17.string().nullable().optional(),
-    formatVersion: z17.string().nullable().optional(),
-    createdAt: z17.string().nullable().optional(),
-    updatedAt: z17.string().nullable().optional(),
-    ingestedAt: z17.string().nullable().optional(),
-    lastSeenAt: z17.string().nullable().optional(),
-    canonicalParentUpdatedAt: z17.string().nullable().optional(),
-    parentRef: z17.string().nullable().optional(),
-    agentChildrenAllowed: z17.boolean(),
+    exists: z18.boolean(),
+    canCreate: z18.boolean(),
+    canUpdate: z18.boolean(),
+    canAppend: z18.boolean(),
+    wikiRole: z18.string().nullable().optional(),
+    formatVersion: z18.string().nullable().optional(),
+    createdAt: z18.string().nullable().optional(),
+    updatedAt: z18.string().nullable().optional(),
+    ingestedAt: z18.string().nullable().optional(),
+    lastSeenAt: z18.string().nullable().optional(),
+    canonicalParentUpdatedAt: z18.string().nullable().optional(),
+    parentRef: z18.string().nullable().optional(),
+    agentChildrenAllowed: z18.boolean(),
     suggestedAction: suggestedActionSchema,
     errorCode: agentMarkdownErrorCodeFieldSchema.optional(),
-    content: z17.string().nullable().optional(),
-    url: z17.string().nullable().optional()
+    content: z18.string().nullable().optional(),
+    url: z18.string().nullable().optional()
   }).transform((value) => ({
     ...value,
     wikiRole: value.wikiRole ?? null,
@@ -7495,31 +7658,31 @@ var agentMarkdownFileSchema = z17.preprocess(
     url: value.url ?? null
   }))
 );
-var agentMarkdownFilesSchema = z17.array(agentMarkdownFileSchema);
-var agentMarkdownMutationDataSchema = z17.union([
+var agentMarkdownFilesSchema = z18.array(agentMarkdownFileSchema);
+var agentMarkdownMutationDataSchema = z18.union([
   agentMarkdownFileSchema,
-  z17.object({ files: agentMarkdownFilesSchema })
+  z18.object({ files: agentMarkdownFilesSchema })
 ]);
-var osmdSearchCandidateSchema = z17.preprocess(
+var osmdSearchCandidateSchema = z18.preprocess(
   normalizeAgentMarkdownJsonKeys,
-  z17.object({
-    path: z17.string(),
+  z18.object({
+    path: z18.string(),
     source: sourceSchema,
     access: accessSchema,
     owner: ownerSchema,
-    wikiRole: z17.string().nullable().optional(),
-    formatVersion: z17.string().nullable().optional(),
-    parentRef: z17.string().nullable().optional(),
-    exists: z17.boolean(),
-    agentChildrenAllowed: z17.boolean(),
-    title: z17.string(),
-    label: z17.string(),
-    snippet: z17.string().nullable().optional(),
-    rank: z17.number().int(),
-    matchReason: z17.string().nullable().optional(),
-    toolKey: z17.string().nullable().optional(),
-    nodeKey: z17.string().nullable().optional(),
-    nodeKind: z17.string().nullable().optional()
+    wikiRole: z18.string().nullable().optional(),
+    formatVersion: z18.string().nullable().optional(),
+    parentRef: z18.string().nullable().optional(),
+    exists: z18.boolean(),
+    agentChildrenAllowed: z18.boolean(),
+    title: z18.string(),
+    label: z18.string(),
+    snippet: z18.string().nullable().optional(),
+    rank: z18.number().int(),
+    matchReason: z18.string().nullable().optional(),
+    toolKey: z18.string().nullable().optional(),
+    nodeKey: z18.string().nullable().optional(),
+    nodeKind: z18.string().nullable().optional()
   }).transform((value) => ({
     ...value,
     wikiRole: value.wikiRole ?? null,
@@ -7532,26 +7695,26 @@ var osmdSearchCandidateSchema = z17.preprocess(
     nodeKind: value.nodeKind ?? null
   }))
 );
-var osmdSearchResultSchema = z17.preprocess(
+var osmdSearchResultSchema = z18.preprocess(
   normalizeAgentMarkdownJsonKeys,
-  z17.object({
-    query: z17.string(),
-    scope: z17.string(),
-    count: z17.number().int().min(0),
-    candidates: z17.array(osmdSearchCandidateSchema)
+  z18.object({
+    query: z18.string(),
+    scope: z18.string(),
+    count: z18.number().int().min(0),
+    candidates: z18.array(osmdSearchCandidateSchema)
   })
 );
-var osmdWikiLintIssueSchema = z17.preprocess(
+var osmdWikiLintIssueSchema = z18.preprocess(
   normalizeAgentMarkdownJsonKeys,
-  z17.object({
-    code: z17.string(),
-    severity: z17.string(),
-    path: z17.string(),
-    source: z17.string().nullable().optional(),
-    parentRef: z17.string().nullable().optional(),
-    message: z17.string(),
-    suggestedAction: z17.string().nullable().optional(),
-    canAutoFix: z17.boolean()
+  z18.object({
+    code: z18.string(),
+    severity: z18.string(),
+    path: z18.string(),
+    source: z18.string().nullable().optional(),
+    parentRef: z18.string().nullable().optional(),
+    message: z18.string(),
+    suggestedAction: z18.string().nullable().optional(),
+    canAutoFix: z18.boolean()
   }).transform((value) => ({
     ...value,
     source: value.source ?? null,
@@ -7559,37 +7722,37 @@ var osmdWikiLintIssueSchema = z17.preprocess(
     suggestedAction: value.suggestedAction ?? null
   }))
 );
-var osmdWikiLintResultSchema = z17.preprocess(
+var osmdWikiLintResultSchema = z18.preprocess(
   normalizeAgentMarkdownJsonKeys,
-  z17.object({
-    status: z17.string(),
-    summary: z17.object({
-      totalIssues: z17.number().int().min(0),
-      errors: z17.number().int().min(0),
-      warnings: z17.number().int().min(0),
-      suggestions: z17.number().int().min(0)
+  z18.object({
+    status: z18.string(),
+    summary: z18.object({
+      totalIssues: z18.number().int().min(0),
+      errors: z18.number().int().min(0),
+      warnings: z18.number().int().min(0),
+      suggestions: z18.number().int().min(0)
     }),
-    issues: z17.array(osmdWikiLintIssueSchema)
+    issues: z18.array(osmdWikiLintIssueSchema)
   })
 );
-var nullableCountSchema = z17.preprocess(
+var nullableCountSchema = z18.preprocess(
   (value) => value === void 0 || value === null || value === "" ? null : value,
-  z17.coerce.number().int().min(0).nullable()
+  z18.coerce.number().int().min(0).nullable()
 ).catch(null);
-var osmdMemoryQualityIssueSchema = z17.preprocess(
+var osmdMemoryQualityIssueSchema = z18.preprocess(
   normalizeAgentMarkdownJsonKeys,
-  z17.object({
-    code: z17.string().nullable().optional(),
-    issueCode: z17.string().nullable().optional(),
-    path: z17.string().nullable().optional(),
-    parentRef: z17.string().nullable().optional(),
-    dimension: z17.string().nullable().optional(),
-    evidence: z17.string().nullable().optional(),
-    evidenceSnippet: z17.string().nullable().optional(),
-    message: z17.string().nullable().optional(),
-    severity: z17.string().nullable().optional(),
-    suggestedAction: z17.string().nullable().optional(),
-    canAutoFix: z17.boolean().nullable().optional()
+  z18.object({
+    code: z18.string().nullable().optional(),
+    issueCode: z18.string().nullable().optional(),
+    path: z18.string().nullable().optional(),
+    parentRef: z18.string().nullable().optional(),
+    dimension: z18.string().nullable().optional(),
+    evidence: z18.string().nullable().optional(),
+    evidenceSnippet: z18.string().nullable().optional(),
+    message: z18.string().nullable().optional(),
+    severity: z18.string().nullable().optional(),
+    suggestedAction: z18.string().nullable().optional(),
+    canAutoFix: z18.boolean().nullable().optional()
   }).passthrough().transform((value) => ({
     ...value,
     code: value.code ?? value.issueCode ?? "unknown_issue",
@@ -7604,16 +7767,16 @@ var osmdMemoryQualityIssueSchema = z17.preprocess(
     canAutoFix: value.canAutoFix === true ? true : false
   }))
 );
-var osmdMemoryQualityOverlaySchema = z17.preprocess(
+var osmdMemoryQualityOverlaySchema = z18.preprocess(
   normalizeAgentMarkdownJsonKeys,
-  z17.object({
-    path: z17.string().nullable().optional(),
-    parentRef: z17.string().nullable().optional(),
-    status: z17.string().nullable().optional(),
-    score: z17.union([z17.number(), z17.string()]).nullable().optional(),
-    overallScore: z17.union([z17.number(), z17.string()]).nullable().optional(),
-    dimensions: z17.unknown().nullable().optional(),
-    issues: z17.array(osmdMemoryQualityIssueSchema).optional()
+  z18.object({
+    path: z18.string().nullable().optional(),
+    parentRef: z18.string().nullable().optional(),
+    status: z18.string().nullable().optional(),
+    score: z18.union([z18.number(), z18.string()]).nullable().optional(),
+    overallScore: z18.union([z18.number(), z18.string()]).nullable().optional(),
+    dimensions: z18.unknown().nullable().optional(),
+    issues: z18.array(osmdMemoryQualityIssueSchema).optional()
   }).passthrough().transform((value) => ({
     ...value,
     path: value.path ?? null,
@@ -7625,9 +7788,9 @@ var osmdMemoryQualityOverlaySchema = z17.preprocess(
     issues: value.issues ?? []
   }))
 );
-var osmdMemoryQualitySummarySchema = z17.preprocess(
+var osmdMemoryQualitySummarySchema = z18.preprocess(
   normalizeAgentMarkdownJsonKeys,
-  z17.object({
+  z18.object({
     evaluatedCount: nullableCountSchema.optional(),
     passCount: nullableCountSchema.optional(),
     warnCount: nullableCountSchema.optional(),
@@ -7645,19 +7808,19 @@ var osmdMemoryQualitySummarySchema = z17.preprocess(
     failCount: value.failCount ?? value.failures ?? null
   }))
 );
-var osmdMemoryQualityResultSchema = z17.preprocess(
+var osmdMemoryQualityResultSchema = z18.preprocess(
   normalizeAgentMarkdownJsonKeys,
-  z17.object({
-    status: z17.string(),
-    scope: z17.string().nullable().optional(),
+  z18.object({
+    status: z18.string(),
+    scope: z18.string().nullable().optional(),
     evaluatedCount: nullableCountSchema.optional(),
     passCount: nullableCountSchema.optional(),
     warnCount: nullableCountSchema.optional(),
     failCount: nullableCountSchema.optional(),
     summary: osmdMemoryQualitySummarySchema.optional(),
-    weakestOverlays: z17.array(osmdMemoryQualityOverlaySchema).optional(),
-    issues: z17.array(osmdMemoryQualityIssueSchema).optional(),
-    scores: z17.array(osmdMemoryQualityOverlaySchema).optional()
+    weakestOverlays: z18.array(osmdMemoryQualityOverlaySchema).optional(),
+    issues: z18.array(osmdMemoryQualityIssueSchema).optional(),
+    scores: z18.array(osmdMemoryQualityOverlaySchema).optional()
   }).passthrough().transform((value) => {
     const summary = isRecord5(value.summary) ? value.summary : null;
     return {
@@ -7681,24 +7844,24 @@ function normalizeOsmdIngestFileRecordInput(value) {
   }
   return normalized;
 }
-var osmdIngestFileRecordSchema = z17.preprocess(
+var osmdIngestFileRecordSchema = z18.preprocess(
   normalizeOsmdIngestFileRecordInput,
-  z17.object({
-    path: z17.string(),
-    source: z17.string().nullable().optional(),
-    access: z17.string().nullable().optional(),
-    owner: z17.string().nullable().optional(),
-    parentRef: z17.string().nullable().optional(),
-    exists: z17.boolean().nullable().optional(),
-    canCreate: z17.boolean().nullable().optional(),
-    canUpdate: z17.boolean().nullable().optional(),
-    canAppend: z17.boolean().nullable().optional(),
-    wikiRole: z17.string().nullable().optional(),
-    formatVersion: z17.string().nullable().optional(),
-    createdAt: z17.string().nullable().optional(),
-    updatedAt: z17.string().nullable().optional(),
-    suggestedAction: z17.string().nullable().optional(),
-    errorCode: z17.string().nullable().optional()
+  z18.object({
+    path: z18.string(),
+    source: z18.string().nullable().optional(),
+    access: z18.string().nullable().optional(),
+    owner: z18.string().nullable().optional(),
+    parentRef: z18.string().nullable().optional(),
+    exists: z18.boolean().nullable().optional(),
+    canCreate: z18.boolean().nullable().optional(),
+    canUpdate: z18.boolean().nullable().optional(),
+    canAppend: z18.boolean().nullable().optional(),
+    wikiRole: z18.string().nullable().optional(),
+    formatVersion: z18.string().nullable().optional(),
+    createdAt: z18.string().nullable().optional(),
+    updatedAt: z18.string().nullable().optional(),
+    suggestedAction: z18.string().nullable().optional(),
+    errorCode: z18.string().nullable().optional()
   }).passthrough().transform((value) => ({
     ...value,
     source: value.source ?? null,
@@ -7717,17 +7880,17 @@ var osmdIngestFileRecordSchema = z17.preprocess(
     errorCode: value.errorCode ?? null
   }))
 );
-var osmdIngestResultSchema = z17.preprocess(
+var osmdIngestResultSchema = z18.preprocess(
   normalizeAgentMarkdownJsonKeys,
-  z17.object({
-    rawSourceId: z17.union([z17.string(), z17.number()]).nullable().optional(),
-    sourceSummaryPath: z17.string().nullable().optional(),
+  z18.object({
+    rawSourceId: z18.union([z18.string(), z18.number()]).nullable().optional(),
+    sourceSummaryPath: z18.string().nullable().optional(),
     sourceSummaryFile: osmdIngestFileRecordSchema.nullable().optional(),
-    slug: z17.string().nullable().optional(),
-    runLint: z17.boolean().nullable().optional(),
-    createdFiles: z17.array(osmdIngestFileRecordSchema).optional(),
-    updatedFiles: z17.array(osmdIngestFileRecordSchema).optional(),
-    skippedUpdates: z17.array(z17.unknown()).optional(),
+    slug: z18.string().nullable().optional(),
+    runLint: z18.boolean().nullable().optional(),
+    createdFiles: z18.array(osmdIngestFileRecordSchema).optional(),
+    updatedFiles: z18.array(osmdIngestFileRecordSchema).optional(),
+    skippedUpdates: z18.array(z18.unknown()).optional(),
     lintResult: osmdWikiLintResultSchema.nullable().optional()
   }).passthrough().transform((value) => ({
     ...value,
@@ -7742,127 +7905,37 @@ var osmdIngestResultSchema = z17.preprocess(
     lintResult: value.lintResult ?? null
   }))
 );
-var osmdPhantomNotificationSchema = z17.preprocess(
-  normalizeAgentMarkdownJsonKeys,
-  z17.object({
-    id: z17.union([z17.string(), z17.number()]).nullable().optional(),
-    status: z17.string().nullable().optional()
-  }).passthrough().transform((value) => ({
-    ...value,
-    id: value.id === void 0 || value.id === null ? null : String(value.id),
-    status: value.status ?? null
-  }))
-);
-var osmdPhantomResultSchema = z17.preprocess(
-  normalizeOsmdPhantomResultKeys,
-  z17.object({
-    runId: z17.union([z17.string(), z17.number()]).nullable().optional(),
-    organizationId: z17.union([z17.string(), z17.number()]).nullable().optional(),
-    triggerType: z17.string().nullable().optional(),
-    scope: z17.string().nullable().optional(),
-    subtree: z17.string().nullable().optional(),
-    status: z17.string().nullable().optional(),
-    createdAt: z17.string().nullable().optional(),
-    updatedAt: z17.string().nullable().optional(),
-    startedAt: z17.string().nullable().optional(),
-    completedAt: z17.string().nullable().optional(),
-    countSemantics: z17.unknown().nullable().optional(),
-    scannedFileCount: nullableCountSchema,
-    changedFileCount: nullableCountSchema,
-    unchangedFileCount: nullableCountSchema,
-    updatedFileCount: nullableCountSchema,
-    skippedFileCount: nullableCountSchema,
-    lintStatus: z17.string().nullable().optional(),
-    errorCount: nullableCountSchema,
-    warningCount: nullableCountSchema,
-    reportPath: z17.string().nullable().optional(),
-    plannedReads: z17.array(osmdIngestFileRecordSchema).optional(),
-    plannedReadFiles: z17.array(osmdIngestFileRecordSchema).optional(),
-    plannedWrites: z17.array(osmdIngestFileRecordSchema).optional(),
-    plannedWriteFiles: z17.array(osmdIngestFileRecordSchema).optional(),
-    changedFiles: z17.array(osmdIngestFileRecordSchema).optional(),
-    unchangedFiles: z17.array(osmdIngestFileRecordSchema).optional(),
-    updatedFiles: z17.array(osmdIngestFileRecordSchema).optional(),
-    skippedFiles: z17.array(osmdIngestFileRecordSchema).optional(),
-    lintPlan: z17.unknown().nullable().optional(),
-    lintSummary: z17.unknown().nullable().optional(),
-    lintResult: osmdWikiLintResultSchema.nullable().optional(),
-    notification: osmdPhantomNotificationSchema.nullable().optional(),
-    notificationId: z17.union([z17.string(), z17.number()]).nullable().optional(),
-    notificationStatus: z17.string().nullable().optional()
-  }).passthrough().transform((value) => {
-    const lintResultSummary = isRecord5(value.lintResult?.summary) ? value.lintResult.summary : null;
-    const lintSummary = isRecord5(value.lintSummary) ? value.lintSummary : null;
-    const notification = value.notification ?? (value.notificationId !== void 0 || value.notificationStatus !== void 0 ? {
-      id: value.notificationId === void 0 || value.notificationId === null ? null : String(value.notificationId),
-      status: value.notificationStatus ?? null
-    } : null);
-    return {
-      ...value,
-      runId: value.runId === void 0 || value.runId === null ? null : String(value.runId),
-      organizationId: value.organizationId === void 0 || value.organizationId === null ? null : String(value.organizationId),
-      triggerType: value.triggerType ?? null,
-      scope: value.scope ?? null,
-      subtree: value.subtree ?? null,
-      status: value.status ?? null,
-      createdAt: value.createdAt ?? null,
-      updatedAt: value.updatedAt ?? null,
-      startedAt: value.startedAt ?? null,
-      completedAt: value.completedAt ?? null,
-      countSemantics: value.countSemantics ?? null,
-      scannedFileCount: value.scannedFileCount,
-      changedFileCount: value.changedFileCount,
-      unchangedFileCount: value.unchangedFileCount,
-      updatedFileCount: value.updatedFileCount,
-      skippedFileCount: value.skippedFileCount,
-      lintStatus: value.lintStatus ?? (typeof value.lintResult?.status === "string" ? value.lintResult.status : null) ?? (typeof lintSummary?.status === "string" ? lintSummary.status : null),
-      errorCount: value.errorCount ?? countFromRecord(lintResultSummary, "errors") ?? countFromRecord(lintSummary, "errors"),
-      warningCount: value.warningCount ?? countFromRecord(lintResultSummary, "warnings") ?? countFromRecord(lintSummary, "warnings"),
-      reportPath: value.reportPath ?? null,
-      plannedReads: value.plannedReads ?? value.plannedReadFiles ?? [],
-      plannedWrites: value.plannedWrites ?? value.plannedWriteFiles ?? [],
-      changedFiles: value.changedFiles ?? [],
-      unchangedFiles: dedupeOsmdFileRecords(value.unchangedFiles ?? []),
-      updatedFiles: value.updatedFiles ?? [],
-      skippedFiles: dedupeOsmdFileRecords(value.skippedFiles ?? []),
-      lintPlan: value.lintPlan ?? null,
-      lintSummary: value.lintSummary ?? null,
-      lintResult: value.lintResult ?? null,
-      notification
-    };
-  })
-);
-var mutationPayloadSchema = z17.object({
-  ok: z17.boolean(),
-  status: z17.number(),
-  errorCode: z17.string().nullable().optional(),
-  data: z17.unknown().nullable().optional(),
-  errors: z17.unknown().nullable().optional()
+var mutationPayloadSchema = z18.object({
+  ok: z18.boolean(),
+  status: z18.number(),
+  errorCode: z18.string().nullable().optional(),
+  data: z18.unknown().nullable().optional(),
+  errors: z18.unknown().nullable().optional()
 });
-var markdownTreeNodeSchema = z17.lazy(
-  () => z17.object({
-    toolKey: z17.string(),
-    nodeKey: z17.string(),
-    nodeKind: z17.string(),
-    runtimeLabel: z17.string(),
-    path: z17.string().nullable().optional().transform((value) => value ?? null),
+var markdownTreeNodeSchema = z18.lazy(
+  () => z18.object({
+    toolKey: z18.string(),
+    nodeKey: z18.string(),
+    nodeKind: z18.string(),
+    runtimeLabel: z18.string(),
+    path: z18.string().nullable().optional().transform((value) => value ?? null),
     source: sourceSchema,
     access: accessSchema,
     owner: ownerSchema,
-    parentRef: z17.string().nullable().optional().transform((value) => value ?? null),
-    agentChildrenAllowed: z17.boolean(),
-    exists: z17.boolean(),
-    resolvedScope: z17.object({
-      parentId: z17.string().nullable().optional().transform((value) => value ?? null),
-      recordId: z17.string().nullable().optional().transform((value) => value ?? null),
-      memberId: z17.string().nullable().optional().transform((value) => value ?? null),
-      teamId: z17.string().nullable().optional().transform((value) => value ?? null),
-      contentType: z17.string().nullable().optional().transform((value) => value ?? null)
+    parentRef: z18.string().nullable().optional().transform((value) => value ?? null),
+    agentChildrenAllowed: z18.boolean(),
+    exists: z18.boolean(),
+    resolvedScope: z18.object({
+      parentId: z18.string().nullable().optional().transform((value) => value ?? null),
+      recordId: z18.string().nullable().optional().transform((value) => value ?? null),
+      memberId: z18.string().nullable().optional().transform((value) => value ?? null),
+      teamId: z18.string().nullable().optional().transform((value) => value ?? null),
+      contentType: z18.string().nullable().optional().transform((value) => value ?? null)
     }),
-    isLeaf: z17.boolean(),
-    treeView: z17.boolean(),
-    details: z17.unknown().nullable(),
-    children: z17.array(markdownTreeNodeSchema).optional().transform((value) => value ?? [])
+    isLeaf: z18.boolean(),
+    treeView: z18.boolean(),
+    details: z18.unknown().nullable(),
+    children: z18.array(markdownTreeNodeSchema).optional().transform((value) => value ?? [])
   })
 );
 var AGENT_MARKDOWN_FILE_SELECTION = `{
@@ -8123,86 +8196,6 @@ function normalizeAgentMarkdownJsonKeys(value) {
   }
   return normalized;
 }
-function firstPresent(...values) {
-  for (const value of values) {
-    if (value !== void 0 && value !== null) {
-      return value;
-    }
-  }
-  return void 0;
-}
-function normalizeOsmdPhantomResultKeys(value) {
-  const normalized = normalizeAgentMarkdownJsonKeys(value);
-  if (!isRecord5(normalized)) {
-    return normalized;
-  }
-  const run = isRecord5(normalized.run) ? normalizeAgentMarkdownJsonKeys(normalized.run) : null;
-  const result = run ? { ...run, ...normalized } : { ...normalized };
-  const runField = (key) => run ? run[key] : void 0;
-  const assignFirstPresent = (target, ...values) => {
-    const value2 = firstPresent(result[target], ...values);
-    if (value2 !== void 0) {
-      result[target] = value2;
-    }
-  };
-  assignFirstPresent("runId", normalized.id, runField("runId"), runField("id"));
-  assignFirstPresent("organizationId", runField("organizationId"));
-  assignFirstPresent("triggerType", runField("triggerType"));
-  assignFirstPresent("scope", runField("scope"));
-  assignFirstPresent("status", runField("status"));
-  assignFirstPresent("createdAt", runField("createdAt"));
-  assignFirstPresent("updatedAt", runField("updatedAt"));
-  assignFirstPresent("startedAt", runField("startedAt"));
-  assignFirstPresent("completedAt", runField("completedAt"));
-  assignFirstPresent("countSemantics", runField("countSemantics"));
-  assignFirstPresent(
-    "scannedFileCount",
-    normalized.scanned,
-    runField("scannedFileCount"),
-    runField("scanned")
-  );
-  assignFirstPresent(
-    "changedFileCount",
-    normalized.changed,
-    runField("changedFileCount"),
-    runField("changed")
-  );
-  assignFirstPresent(
-    "unchangedFileCount",
-    normalized.unchanged,
-    runField("unchangedFileCount"),
-    runField("unchanged")
-  );
-  assignFirstPresent(
-    "updatedFileCount",
-    normalized.updated,
-    runField("updatedFileCount"),
-    runField("updated")
-  );
-  assignFirstPresent(
-    "skippedFileCount",
-    normalized.skipped,
-    runField("skippedFileCount"),
-    runField("skipped")
-  );
-  assignFirstPresent("lintStatus", runField("lintStatus"));
-  assignFirstPresent("errorCount", runField("errorCount"));
-  assignFirstPresent("warningCount", runField("warningCount"));
-  assignFirstPresent("reportPath", runField("reportPath"));
-  assignFirstPresent("plannedReads", runField("plannedReads"), runField("plannedReadFiles"));
-  assignFirstPresent("plannedWrites", runField("plannedWrites"), runField("plannedWriteFiles"));
-  assignFirstPresent("changedFiles", runField("changedFiles"));
-  assignFirstPresent("unchangedFiles", runField("unchangedFiles"));
-  assignFirstPresent("updatedFiles", runField("updatedFiles"));
-  assignFirstPresent("skippedFiles", runField("skippedFiles"));
-  assignFirstPresent("lintPlan", runField("lintPlan"));
-  assignFirstPresent("lintSummary", runField("lintSummary"));
-  assignFirstPresent("lintResult", runField("lintResult"));
-  assignFirstPresent("notification", runField("notification"));
-  assignFirstPresent("notificationId", runField("notificationId"));
-  assignFirstPresent("notificationStatus", runField("notificationStatus"));
-  return result;
-}
 function buildSuccessEnvelope(params) {
   return {
     ok: true,
@@ -8622,51 +8615,6 @@ async function runOsmdIngestFlow(params) {
     })
   });
 }
-async function runOsmdPhantomPhaseOne(params) {
-  const runtimeOptions = {
-    ...params.runtimeOptions,
-    timeoutMs: params.runtimeOptions.timeoutMs ?? defaultOsmdPhantomTimeoutMs
-  };
-  const result = await requestOsmdMutationPayload({
-    command: params.command,
-    operationName: "RunPhantomOsmdMaintenance",
-    operationType: "mutation",
-    runtimeOptions,
-    field: "run_phantom_osmd_maintenance",
-    variables: {
-      organization_id: params.organizationId,
-      dry_run: params.dryRun
-    }
-  });
-  const parsedData = osmdPhantomResultSchema.safeParse(
-    normalizeAgentMarkdownJsonKeys(result.payload.data)
-  );
-  if (!parsedData.success) {
-    return printInvalidPayloadError({
-      command: params.command,
-      requestId: result.requestId,
-      issues: parsedData.error.issues
-    });
-  }
-  const data = {
-    ...parsedData.data,
-    organizationId: parsedData.data.organizationId ?? params.organizationId,
-    triggerType: parsedData.data.triggerType ?? "manual"
-  };
-  if (params.readable) {
-    return printTextAndExit({
-      text: formatOsmdPhantomHuman(data, params.dryRun)
-    });
-  }
-  return printEnvelopeAndExit({
-    envelope: buildSuccessEnvelope({
-      command: params.command,
-      status: result.payload.status,
-      data,
-      requestId: result.requestId
-    })
-  });
-}
 function normalizeAgentFilePath(file) {
   const trimmed = nonEmptyString3.parse(file).trim().replace(/^\/+|\/+$/g, "");
   const fileName = trimmed.startsWith(".agent/") ? trimmed.slice(".agent/".length) : trimmed;
@@ -9077,62 +9025,6 @@ function formatIngestFileList(files) {
     return `- ${path}${action}`;
   });
 }
-function fileRecordPath(file) {
-  return typeof file.path === "string" && file.path.trim() !== "" ? file.path : null;
-}
-function isAgentNotesWrite(file) {
-  const path = fileRecordPath(file);
-  return path !== null && /(?:^|\/)\.agent\/notes\.md$/.test(path);
-}
-function formatNotesWriteSummary(files) {
-  const notesWrites = files.filter(isAgentNotesWrite);
-  if (notesWrites.length === 0) {
-    return ["notes.md writes: none"];
-  }
-  return ["notes.md writes:", ...formatIngestFileList(notesWrites)];
-}
-function skippedReasonForFile(file) {
-  for (const key of ["reason", "skipReason", "errorCode", "suggestedAction", "status"]) {
-    const value = file[key];
-    if (typeof value === "string" && value.trim() !== "") {
-      return value;
-    }
-  }
-  return "unspecified";
-}
-function formatSkippedFilesByReason(files) {
-  if (files.length === 0) {
-    return ["- none"];
-  }
-  const groups = /* @__PURE__ */ new Map();
-  for (const file of files) {
-    const reason = skippedReasonForFile(file);
-    const existing = groups.get(reason) ?? [];
-    existing.push(file);
-    groups.set(reason, existing);
-  }
-  const lines = [];
-  for (const [reason, records] of groups.entries()) {
-    lines.push(`- ${reason}`);
-    for (const record of records) {
-      lines.push(`  - ${fileRecordPath(record) ?? "-"}`);
-    }
-  }
-  return lines;
-}
-function dedupeOsmdFileRecords(files) {
-  const seen = /* @__PURE__ */ new Set();
-  const deduped = [];
-  for (const file of files) {
-    const key = file.path;
-    if (typeof key !== "string" || key.trim() === "" || seen.has(key)) {
-      continue;
-    }
-    seen.add(key);
-    deduped.push(file);
-  }
-  return deduped;
-}
 function formatSkippedUpdateList(skippedUpdates) {
   if (skippedUpdates.length === 0) {
     return ["- none"];
@@ -9171,72 +9063,6 @@ function formatOsmdIngestHuman(data) {
 function formatNullableNumberHumanField(value) {
   return typeof value === "number" ? String(value) : "-";
 }
-function formatNotificationHuman(notification) {
-  if (!notification) {
-    return "-";
-  }
-  const id = formatNullableHumanField(notification.id);
-  const status = formatNullableHumanField(notification.status);
-  return `id=${id} status=${status}`;
-}
-function formatPhantomTimestampLines(data) {
-  const lines = [];
-  if (data.startedAt) {
-    lines.push(`Started at: ${data.startedAt}`);
-  }
-  if (data.completedAt) {
-    lines.push(`Completed at: ${data.completedAt}`);
-  }
-  if (data.createdAt) {
-    lines.push(`Created at: ${data.createdAt}`);
-  }
-  if (data.updatedAt) {
-    lines.push(`Updated at: ${data.updatedAt}`);
-  }
-  return lines;
-}
-function formatOsmdPhantomHuman(data, dryRun) {
-  const lines = [
-    dryRun ? "Phantom Phase 1 plan" : "Phantom Phase 1 run",
-    `Run ID: ${formatNullableHumanField(data.runId)}`,
-    `Status: ${formatNullableHumanField(data.status)}`,
-    ...formatPhantomTimestampLines(data),
-    `Organization ID: ${formatNullableHumanField(data.organizationId)}`,
-    `Trigger type: ${formatNullableHumanField(data.triggerType)}`,
-    `Scope: ${formatNullableHumanField(data.scope ?? data.subtree)}`,
-    ...data.countSemantics === null || data.countSemantics === void 0 ? [] : [`Count semantics: ${formatUnknownHuman(data.countSemantics)}`],
-    `Reviewed OSMD/agent markdown entries: ${formatNullableNumberHumanField(data.scannedFileCount)}`,
-    `Changed entries: ${formatNullableNumberHumanField(data.changedFileCount)}`,
-    `Unchanged entries: ${formatNullableNumberHumanField(data.unchangedFileCount)}`,
-    `Updated files: ${formatNullableNumberHumanField(data.updatedFileCount)}`,
-    `Skipped entries: ${formatNullableNumberHumanField(data.skippedFileCount)}`,
-    `Lint status: ${formatNullableHumanField(data.lintStatus)}`,
-    `Errors: ${formatNullableNumberHumanField(data.errorCount)}`,
-    `Warnings: ${formatNullableNumberHumanField(data.warningCount)}`,
-    `Report path: ${formatNullableHumanField(data.reportPath)}`,
-    `Notification: ${formatNotificationHuman(data.notification)}`,
-    "",
-    "Planned reads:",
-    ...formatIngestFileList(data.plannedReads),
-    "",
-    "Planned semantic memory writes:",
-    ...formatIngestFileList(data.plannedWrites),
-    ...dryRun ? formatNotesWriteSummary(data.plannedWrites) : [],
-    "",
-    "Changed entries:",
-    ...formatIngestFileList(data.changedFiles),
-    "",
-    "Updated files:",
-    ...formatIngestFileList(data.updatedFiles),
-    "",
-    "Skipped nodes by reason:",
-    ...formatSkippedFilesByReason(data.skippedFiles),
-    "",
-    "Lint plan:",
-    formatUnknownHuman(data.lintPlan)
-  ];
-  return lines.join("\n");
-}
 function parseSearchLimit(value) {
   const raw = value === void 0 || value === null || value === "" ? "10" : value;
   const parsed = positiveInt.safeParse(raw);
@@ -10004,18 +9830,6 @@ function registerOsmdCommands(program) {
       throw error;
     }
   });
-  const phantom = osmd.command("phantom").description("Backend-owned Phantom Phase 1 manual operations");
-  phantom.command("run").description("Manually run or plan Phantom Phase 1 for OSMD/agent semantic memory").option("--dry-run", "Ask backend for the Phantom Phase 1 plan without mutating").option("--readable", "Print a human-readable Phantom summary instead of JSON").action(async (opts, cmd) => {
-    const command = "osmd.phantom.run";
-    const { organizationId, runtimeOptions } = await resolveOsmdContext(cmd);
-    return runOsmdPhantomPhaseOne({
-      command,
-      runtimeOptions,
-      organizationId,
-      dryRun: opts.dryRun === true,
-      readable: opts.readable === true
-    });
-  });
   const agent = osmd.command("agent").description(".agent markdown attached to canonical OSMD parents");
   agent.command("status <parent-ref> <file>").description("Show .agent file metadata without creating files").action(async (parentRef, file, _opts, cmd) => {
     const { organizationId, runtimeOptions } = await resolveOsmdContext(cmd);
@@ -13011,14 +12825,14 @@ function registerMailCommands(program) {
 }
 
 // src/commands/phantom.ts
-import { z as z18 } from "zod";
-var nonNegativeInt4 = z18.coerce.number().int().min(0);
-var nullableString = z18.string().nullable().optional().transform((value) => value ?? null);
-var idString = z18.union([z18.string(), z18.number()]).transform((value) => String(value));
-var nullableIdString = z18.union([z18.string(), z18.number()]).nullable().optional().transform(
+import { z as z19 } from "zod";
+var nonNegativeInt4 = z19.coerce.number().int().min(0);
+var nullableString = z19.string().nullable().optional().transform((value) => value ?? null);
+var idString = z19.union([z19.string(), z19.number()]).transform((value) => String(value));
+var nullableIdString = z19.union([z19.string(), z19.number()]).nullable().optional().transform(
   (value) => value === void 0 || value === null ? null : String(value)
 );
-var jsonObject = z18.record(z18.string(), z18.unknown());
+var jsonObject = z19.record(z19.string(), z19.unknown());
 var PHANTOM_LEDGER_INVENTORY_SELECTION = `{
   schemaVersion
   runsCount
@@ -13231,10 +13045,10 @@ var PHANTOM_LEDGER_KEY_ALIASES = {
   content_hash: "contentHash",
   observed_at: "observedAt"
 };
-var phantomLedgerInventorySchema = z18.preprocess(
+var phantomLedgerInventorySchema = z19.preprocess(
   normalizePhantomLedgerKeys,
-  z18.object({
-    schemaVersion: z18.string(),
+  z19.object({
+    schemaVersion: z19.string(),
     runsCount: nonNegativeInt4,
     observationsCount: nonNegativeInt4,
     candidatesCount: nonNegativeInt4,
@@ -13244,16 +13058,16 @@ var phantomLedgerInventorySchema = z18.preprocess(
     reportsCount: nonNegativeInt4
   })
 );
-var phantomRunSchema = z18.preprocess(
+var phantomRunSchema = z19.preprocess(
   normalizePhantomLedgerKeys,
-  z18.object({
+  z19.object({
     id: idString,
     organizationId: idString,
-    notificationId: z18.union([z18.string(), z18.number()]).nullable().optional().transform(
+    notificationId: z19.union([z19.string(), z19.number()]).nullable().optional().transform(
       (value) => value === void 0 || value === null ? null : String(value)
     ),
-    status: z18.string(),
-    triggerType: z18.string(),
+    status: z19.string(),
+    triggerType: z19.string(),
     startedAt: nullableString,
     completedAt: nullableString,
     scannedFileCount: nonNegativeInt4,
@@ -13263,163 +13077,163 @@ var phantomRunSchema = z18.preprocess(
     errorCount: nonNegativeInt4,
     warningCount: nonNegativeInt4,
     errorMessage: nullableString,
-    dryRun: z18.boolean(),
-    schemaVersion: z18.string(),
+    dryRun: z19.boolean(),
+    schemaVersion: z19.string(),
     testRunId: nullableString,
     idempotencyKey: nullableString,
     ledgerMetadata: jsonObject.catch({}),
-    createdAt: z18.string(),
-    updatedAt: z18.string()
+    createdAt: z19.string(),
+    updatedAt: z19.string()
   })
 );
-var phantomRunListItemSchema = z18.preprocess(
+var phantomRunListItemSchema = z19.preprocess(
   normalizePhantomLedgerKeys,
-  z18.object({
+  z19.object({
     id: idString,
     organizationId: idString,
-    status: z18.string(),
-    triggerType: z18.string(),
-    dryRun: z18.boolean(),
-    schemaVersion: z18.string(),
+    status: z19.string(),
+    triggerType: z19.string(),
+    dryRun: z19.boolean(),
+    schemaVersion: z19.string(),
     testRunId: nullableString,
-    createdAt: z18.string(),
-    updatedAt: z18.string()
+    createdAt: z19.string(),
+    updatedAt: z19.string()
   })
 );
-var phantomReportSchema = z18.preprocess(
+var phantomReportSchema = z19.preprocess(
   normalizePhantomLedgerKeys,
-  z18.object({
+  z19.object({
     id: idString,
     organizationId: idString,
     phantomRunId: idString,
-    status: z18.string(),
-    reportType: z18.string(),
-    schemaVersion: z18.string(),
+    status: z19.string(),
+    reportType: z19.string(),
+    schemaVersion: z19.string(),
     markdownPath: nullableString,
     payload: jsonObject.catch({}),
     testRunId: nullableString,
-    idempotencyKey: z18.string(),
-    createdAt: z18.string(),
-    updatedAt: z18.string()
+    idempotencyKey: z19.string(),
+    createdAt: z19.string(),
+    updatedAt: z19.string()
   })
 );
-var phantomObservationSchema = z18.preprocess(
+var phantomObservationSchema = z19.preprocess(
   normalizePhantomLedgerKeys,
-  z18.object({
+  z19.object({
     id: idString,
     organizationId: idString,
     phantomRunId: idString,
-    status: z18.string(),
-    observationType: z18.string(),
+    status: z19.string(),
+    observationType: z19.string(),
     targetType: nullableString,
     targetId: nullableString,
     sourceTable: nullableString,
     sourceRecordId: nullableString,
     sourceEventId: nullableString,
     contentHash: nullableString,
-    observedAt: z18.string(),
-    confidence: z18.coerce.number(),
+    observedAt: z19.string(),
+    confidence: z19.coerce.number(),
     payload: jsonObject.catch({}),
-    schemaVersion: z18.string(),
+    schemaVersion: z19.string(),
     testRunId: nullableString,
-    idempotencyKey: z18.string(),
-    createdAt: z18.string(),
-    updatedAt: z18.string()
+    idempotencyKey: z19.string(),
+    createdAt: z19.string(),
+    updatedAt: z19.string()
   })
 );
-var phantomCandidateSchema = z18.preprocess(
+var phantomCandidateSchema = z19.preprocess(
   normalizePhantomLedgerKeys,
-  z18.object({
+  z19.object({
     id: idString,
     organizationId: idString,
     phantomRunId: idString,
     phantomObservationId: nullableString,
-    status: z18.string(),
-    candidateType: z18.string(),
+    status: z19.string(),
+    candidateType: z19.string(),
     targetType: nullableString,
     targetId: nullableString,
     title: nullableString,
-    dryRun: z18.boolean(),
+    dryRun: z19.boolean(),
     payload: jsonObject.catch({}),
-    approvalStatus: z18.string(),
+    approvalStatus: z19.string(),
     approvedById: nullableIdString,
     approvedAt: nullableString,
     approvalSource: nullableString,
     approvalReason: nullableString,
     approvalMetadata: jsonObject.catch({}),
-    schemaVersion: z18.string(),
+    schemaVersion: z19.string(),
     testRunId: nullableString,
-    idempotencyKey: z18.string(),
-    createdAt: z18.string(),
-    updatedAt: z18.string()
+    idempotencyKey: z19.string(),
+    createdAt: z19.string(),
+    updatedAt: z19.string()
   })
 );
-var phantomCandidateEvidenceSchema = z18.preprocess(
+var phantomCandidateEvidenceSchema = z19.preprocess(
   normalizePhantomLedgerKeys,
-  z18.object({
+  z19.object({
     id: idString,
     organizationId: idString,
     phantomCandidateId: idString,
     phantomObservationId: nullableString,
-    evidenceType: z18.string(),
+    evidenceType: z19.string(),
     sourceType: nullableString,
     sourceId: nullableString,
     contentHash: nullableString,
     payload: jsonObject.catch({}),
-    schemaVersion: z18.string(),
+    schemaVersion: z19.string(),
     testRunId: nullableString,
-    idempotencyKey: z18.string(),
-    createdAt: z18.string(),
-    updatedAt: z18.string()
+    idempotencyKey: z19.string(),
+    createdAt: z19.string(),
+    updatedAt: z19.string()
   })
 );
-var phantomValidationSchema = z18.preprocess(
+var phantomValidationSchema = z19.preprocess(
   normalizePhantomLedgerKeys,
-  z18.object({
+  z19.object({
     id: idString,
     organizationId: idString,
     phantomRunId: idString,
     phantomCandidateId: idString,
-    status: z18.string(),
-    validationType: z18.string(),
-    dryRun: z18.boolean(),
+    status: z19.string(),
+    validationType: z19.string(),
+    dryRun: z19.boolean(),
     payload: jsonObject.catch({}),
     resultPayload: jsonObject.catch({}),
-    schemaVersion: z18.string(),
+    schemaVersion: z19.string(),
     testRunId: nullableString,
-    idempotencyKey: z18.string(),
-    createdAt: z18.string(),
-    updatedAt: z18.string()
+    idempotencyKey: z19.string(),
+    createdAt: z19.string(),
+    updatedAt: z19.string()
   })
 );
-var phantomApplyOperationSchema = z18.preprocess(
+var phantomApplyOperationSchema = z19.preprocess(
   normalizePhantomLedgerKeys,
-  z18.object({
+  z19.object({
     id: idString,
     organizationId: idString,
     phantomRunId: idString,
     phantomCandidateId: idString,
-    status: z18.string(),
-    operationType: z18.string(),
-    dryRun: z18.boolean(),
+    status: z19.string(),
+    operationType: z19.string(),
+    dryRun: z19.boolean(),
     targetType: nullableString,
     targetId: nullableString,
     payload: jsonObject.catch({}),
     resultPayload: jsonObject.catch({}),
-    schemaVersion: z18.string(),
+    schemaVersion: z19.string(),
     testRunId: nullableString,
-    idempotencyKey: z18.string(),
-    createdAt: z18.string(),
-    updatedAt: z18.string()
+    idempotencyKey: z19.string(),
+    createdAt: z19.string(),
+    updatedAt: z19.string()
   })
 );
-var phantomRunsSchema = z18.array(phantomRunListItemSchema);
-var phantomReportsSchema = z18.array(phantomReportSchema);
-var phantomObservationsSchema = z18.array(phantomObservationSchema);
-var phantomCandidatesSchema = z18.array(phantomCandidateSchema);
-var phantomCandidateEvidencesSchema = z18.array(phantomCandidateEvidenceSchema);
-var phantomValidationsSchema = z18.array(phantomValidationSchema);
-var phantomApplyOperationsSchema = z18.array(phantomApplyOperationSchema);
+var phantomRunsSchema = z19.array(phantomRunListItemSchema);
+var phantomReportsSchema = z19.array(phantomReportSchema);
+var phantomObservationsSchema = z19.array(phantomObservationSchema);
+var phantomCandidatesSchema = z19.array(phantomCandidateSchema);
+var phantomCandidateEvidencesSchema = z19.array(phantomCandidateEvidenceSchema);
+var phantomValidationsSchema = z19.array(phantomValidationSchema);
+var phantomApplyOperationsSchema = z19.array(phantomApplyOperationSchema);
 function isRecord6(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
@@ -14876,72 +14690,72 @@ function registerDatasheetsCommands(program) {
 }
 
 // src/commands/atlasAuthoring.ts
-import { z as z19 } from "zod";
-var idSchema14 = z19.string().trim().min(1);
-var idempotencyKeySchema = z19.string().min(1).refine((value) => value.trim() === value, "Idempotency key must not have leading or trailing whitespace.");
-var skillScopeSchema = z19.enum(["ADMIN_GLOBAL", "MEMBER_PERSONAL"]);
-var isoDateSchema = z19.iso.date();
-var nonEmptyStringSchema = z19.string().trim().min(1);
+import { z as z20 } from "zod";
+var idSchema14 = z20.string().trim().min(1);
+var idempotencyKeySchema = z20.string().min(1).refine((value) => value.trim() === value, "Idempotency key must not have leading or trailing whitespace.");
+var skillScopeSchema = z20.enum(["ADMIN_GLOBAL", "MEMBER_PERSONAL"]);
+var isoDateSchema = z20.iso.date();
+var nonEmptyStringSchema = z20.string().trim().min(1);
 var AUTOMATION_RUN_HTTP_TIMEOUT_MS = 6e4;
-var agentToolAccessSchema = z19.array(
-  z19.object({
+var agentToolAccessSchema = z20.array(
+  z20.object({
     tool_key: nonEmptyStringSchema,
     scope_value: nonEmptyStringSchema
   }).strict()
 ).min(1);
 var agentToolAccessUpdateSchema = agentToolAccessSchema.min(0);
-var agentPluginConnectionsSchema = z19.array(
-  z19.object({
+var agentPluginConnectionsSchema = z20.array(
+  z20.object({
     external_tool_connection_id: nonEmptyStringSchema,
     tool_key: nonEmptyStringSchema,
     scope_value: nonEmptyStringSchema.optional(),
-    allowed_tools: z19.array(nonEmptyStringSchema).optional(),
-    allowed_scopes: z19.array(nonEmptyStringSchema).optional(),
-    requires_confirmation: z19.boolean().optional(),
-    enabled: z19.boolean().optional()
+    allowed_tools: z20.array(nonEmptyStringSchema).optional(),
+    allowed_scopes: z20.array(nonEmptyStringSchema).optional(),
+    requires_confirmation: z20.boolean().optional(),
+    enabled: z20.boolean().optional()
   }).strict()
 ).min(1);
-var agentPluginConnectionUpdateSchema = z19.array(
-  z19.union([
-    z19.object({
+var agentPluginConnectionUpdateSchema = z20.array(
+  z20.union([
+    z20.object({
       id: nonEmptyStringSchema,
-      _destroy: z19.literal(true)
+      _destroy: z20.literal(true)
     }).strict(),
-    z19.object({
+    z20.object({
       id: nonEmptyStringSchema.optional(),
       external_tool_connection_id: nonEmptyStringSchema.optional(),
       tool_key: nonEmptyStringSchema.optional(),
       scope_value: nonEmptyStringSchema.optional(),
-      allowed_tools: z19.array(nonEmptyStringSchema).optional(),
-      allowed_scopes: z19.array(nonEmptyStringSchema).optional(),
-      requires_confirmation: z19.boolean().optional(),
-      enabled: z19.boolean().optional()
+      allowed_tools: z20.array(nonEmptyStringSchema).optional(),
+      allowed_scopes: z20.array(nonEmptyStringSchema).optional(),
+      requires_confirmation: z20.boolean().optional(),
+      enabled: z20.boolean().optional()
     }).strict().superRefine((value, context) => {
       if (value.id || value.external_tool_connection_id && value.tool_key) return;
       context.addIssue({
-        code: z19.ZodIssueCode.custom,
+        code: z20.ZodIssueCode.custom,
         message: "Plugin updates require an id, or both external_tool_connection_id and tool_key for a new grant."
       });
     })
   ])
 );
-var agentTriggerSchema = z19.object({
-  trigger_type: z19.literal("cron"),
+var agentTriggerSchema = z20.object({
+  trigger_type: z20.literal("cron"),
   cron_expression: nonEmptyStringSchema,
   timezone: nonEmptyStringSchema,
-  starts_at: z19.iso.datetime({ offset: true }).nullable().optional(),
-  ends_at: z19.iso.datetime({ offset: true }).nullable().optional(),
-  max_runs: z19.number().int().positive().nullable().optional(),
-  enabled: z19.boolean().optional()
+  starts_at: z20.iso.datetime({ offset: true }).nullable().optional(),
+  ends_at: z20.iso.datetime({ offset: true }).nullable().optional(),
+  max_runs: z20.number().int().positive().nullable().optional(),
+  enabled: z20.boolean().optional()
 }).strict();
-var agentTriggerUpdateSchema = z19.union([
+var agentTriggerUpdateSchema = z20.union([
   agentTriggerSchema.extend({ id: nonEmptyStringSchema.optional() }).strict(),
-  z19.object({
+  z20.object({
     id: nonEmptyStringSchema,
-    _destroy: z19.literal(true)
+    _destroy: z20.literal(true)
   }).strict()
 ]);
-var automationConfigSchema = z19.record(z19.string(), z19.unknown());
+var automationConfigSchema = z20.record(z20.string(), z20.unknown());
 var AGENT_SELECTION = `{
   id
   type
@@ -15017,6 +14831,11 @@ var AUTOMATION_SELECTION = `{
   organizationId
   memberId
   agentId
+  agentTriggerId
+  scheduleStatus
+  triggerEnabled
+  cronExpression
+  timezone
   createdAt
   updatedAt
   updateVersion
@@ -15223,7 +15042,16 @@ function normalizeAutomationRunPayload(payload) {
   };
 }
 function parseAutomationConfig(value) {
-  return automationConfigSchema.parse(parseJson(String(value), "--ai-task-config"));
+  const config = automationConfigSchema.parse(parseJson(String(value), "--ai-task-config"));
+  if (Object.hasOwn(config, "agent_id") || Object.hasOwn(config, "agentId")) {
+    throw new CliError({
+      message: "Automation executor agent_id must be supplied through --agent-id, not --ai-task-config.",
+      kind: "invalid_args",
+      status: 400,
+      exitCode: EXIT_CODES.invalidArgs
+    });
+  }
+  return config;
 }
 function parseExpectedUpdateVersion(value) {
   return nonEmptyStringSchema.parse(String(value));
@@ -15432,7 +15260,7 @@ function registerAtlasAuthoringCommands(program) {
     "--service <service>",
     "Supported service: gmail, calendar, slack, or stripe"
   ).action(async (opts, cmd) => {
-    const service = z19.enum(["gmail", "calendar", "slack", "stripe"]).parse(opts.service);
+    const service = z20.enum(["gmail", "calendar", "slack", "stripe"]).parse(opts.service);
     const context = await resolveCommandContext(cmd.optsWithGlobals());
     const organizationId = resolveOrganizationId(context.organizationId);
     await runGraphqlQueryCommand({
@@ -15446,7 +15274,7 @@ function registerAtlasAuthoringCommands(program) {
     });
   });
   const automations = program.command("automations").description("Bounded Automation authoring operations");
-  automations.command("create").description("Create a Backlog Automation through the API-owned createAutomation contract").requiredOption("--summary <summary>").requiredOption("--ai-task-config <json>", "Valid JSON for the API-owned ai_task_config field").requiredOption("--idempotency-key <key>", "Required create idempotency key").option("--description <description>").option("--notes <notes>").option("--member-id <memberId>").option("--agent-id <agentId>", "Optional executor Agent id for a repeat Automation").option("--priority <priority>").option("--due-date <date>", "ISO-8601 date (YYYY-MM-DD)").action(async (opts, cmd) => {
+  automations.command("create").description("Create a Backlog Automation through the API-owned createAutomation contract").requiredOption("--summary <summary>").requiredOption("--ai-task-config <json>", "Valid JSON for the API-owned ai_task_config field").requiredOption("--idempotency-key <key>", "Required create idempotency key").option("--description <description>").option("--notes <notes>").option("--member-id <memberId>").requiredOption("--agent-id <agentId>", "Required executor Agent id").option("--priority <priority>").option("--due-date <date>", "ISO-8601 date (YYYY-MM-DD)").action(async (opts, cmd) => {
     const idempotencyKey = idempotencyKeySchema.parse(opts.idempotencyKey);
     const context = await resolveCommandContext(cmd.optsWithGlobals());
     const organizationId = resolveOrganizationId(context.organizationId);
@@ -15464,7 +15292,7 @@ function registerAtlasAuthoringCommands(program) {
         organization_id: organizationId,
         input: {
           summary: idSchema14.parse(opts.summary),
-          ai_task_config: parseJson(String(opts.aiTaskConfig), "--ai-task-config"),
+          ai_task_config: parseAutomationConfig(opts.aiTaskConfig),
           ...opts.description !== void 0 ? { description: String(opts.description) } : {},
           ...opts.notes !== void 0 ? { notes: String(opts.notes) } : {},
           ...opts.memberId !== void 0 ? { member_id: idSchema14.parse(opts.memberId) } : {},
@@ -15535,20 +15363,17 @@ function registerAtlasAuthoringCommands(program) {
     "Exact opaque updateVersion value from automations show; rejects stale writes"
   ).option("--summary <summary>").option("--description <description>").option("--notes <notes>").option("--priority <priority>").option("--due-date <date>", "ISO-8601 date (YYYY-MM-DD)").option("--ai-task-config <json>", "Complete replacement ai_task_config JSON object").option(
     "--agent-id <agentId>",
-    "Executor Agent id; requires --ai-task-config and is stored in that config"
+    "Rejected: executor ownership is immutable after Automation creation"
   ).action(async (opts, cmd) => {
-    if (opts.agentId !== void 0 && opts.aiTaskConfig === void 0) {
+    if (opts.agentId !== void 0) {
       throw new CliError({
-        message: "automations update requires --ai-task-config whenever --agent-id is supplied.",
+        message: "automations update cannot change executor ownership; create a new Automation instead.",
         kind: "invalid_args",
         status: 400,
         exitCode: EXIT_CODES.invalidArgs
       });
     }
-    const aiTaskConfig = opts.aiTaskConfig === void 0 ? void 0 : {
-      ...parseAutomationConfig(opts.aiTaskConfig),
-      ...opts.agentId !== void 0 ? { agent_id: idSchema14.parse(opts.agentId) } : {}
-    };
+    const aiTaskConfig = opts.aiTaskConfig === void 0 ? void 0 : parseAutomationConfig(opts.aiTaskConfig);
     const patch = {
       ...opts.summary !== void 0 ? { summary: String(opts.summary) } : {},
       ...opts.description !== void 0 ? { description: String(opts.description) } : {},
@@ -15671,7 +15496,7 @@ import { join as join3 } from "path";
 import { createHash } from "crypto";
 
 // src/version.ts
-var CLI_VERSION = "0.1.76";
+var CLI_VERSION = "0.1.77";
 
 // src/operationMetadata.ts
 var DISCOVERY_OPERATION_IDS = [
@@ -16075,7 +15900,6 @@ var WRITE_OPERATION_IDS = [
   "osmd.ingest.text",
   "osmd.ingest.transcript",
   "osmd.ingest.url",
-  "osmd.phantom.run",
   "osmd.wiki.append-log",
   "osmd.wiki.create",
   "osmd.wiki.index-upsert",
@@ -16394,22 +16218,21 @@ var NAMESPACE_DOCS = {
   osmd: {
     name: "osmd",
     tier: "primary",
-    description: "Canonical OSMD, .agent overlay, Agent Wiki, ingest, lint, and Phantom operations.",
+    description: "Canonical OSMD, .agent overlay, Agent Wiki, ingest, and lint operations.",
     examples: [
       "wave osmd tree --depth 2",
       "wave osmd lint --json",
       'wave osmd ingest text "Notes" --slug notes --parent-ref "projects/Wave Tools" --summary "Source notes" --dry-run',
-      'wave osmd agent update "projects/Wave Tools" notes.md --content "# Notes"',
-      "wave osmd phantom run --dry-run"
+      'wave osmd agent update "projects/Wave Tools" notes.md --content "# Notes"'
     ],
     schema: {
       output: "json-envelope-default",
       safety: [
         "Canonical OSMD writes are blocked before mutation.",
         "Agent Wiki log is append-only.",
-        "Ingest and Phantom support dry-run paths."
+        "Ingest supports dry-run paths."
       ],
-      commands: ["tree", "status", "read", "children", "search", "lint", "memory-quality", "ingest", "phantom", "agent", "wiki"]
+      commands: ["tree", "status", "read", "children", "search", "lint", "memory-quality", "ingest", "agent", "wiki"]
     }
   },
   phantom: {
@@ -17215,7 +17038,7 @@ function registerDiscoveryCommands(program) {
   const phantom = program.commands.find((command) => command.name() === "phantom");
   phantom?.addHelpText(
     "after",
-    "\nExamples:\n  wave phantom inventory --json\n  wave phantom observations --run-id 123 --json\n  wave phantom candidates --candidate-type organization_meta_profile_update_candidate --json\n  wave phantom apply-operations --status succeeded --operation-type organization_meta_profile_patch --json\n  wave phantom report latest --json\n  wave osmd phantom run --dry-run\n"
+    "\nExamples:\n  wave phantom inventory --json\n  wave phantom observations --run-id 123 --json\n  wave phantom candidates --candidate-type organization_meta_profile_update_candidate --json\n  wave phantom apply-operations --status succeeded --operation-type organization_meta_profile_patch --json\n  wave phantom report latest --json\n"
   );
 }
 function attachNamespaceDiscovery(program) {
@@ -17281,12 +17104,11 @@ function attachDiscoveryHelp(program) {
       "  wave capabilities list",
       "  wave capabilities tools",
       "  wave osmd lint --json",
-      "  wave osmd phantom run --dry-run",
       "  wave doctor"
     ].join("\n")
   );
   const helpByName = /* @__PURE__ */ new Map([
-    ["osmd", '\nExamples:\n  wave osmd tree --depth 2\n  wave osmd lint --json\n  wave osmd agent update "projects/Wave Tools" notes.md --content "# Notes"\n  wave osmd phantom run --dry-run\n'],
+    ["osmd", '\nExamples:\n  wave osmd tree --depth 2\n  wave osmd lint --json\n  wave osmd agent update "projects/Wave Tools" notes.md --content "# Notes"\n'],
     ["broadcast", "\nExamples:\n  wave broadcast list\n  wave broadcast workspace\n  wave broadcast community\n  wave broadcast open\n"],
     ["support", "\nExamples:\n  wave support counts --status open\n  wave support tickets --status open --page 1 --per 20\n  wave support knowledge-articles --collection-id 123 --visibility public\n  wave support settings\n  wave support open\n"],
     ["markdown-tree", "\nExamples:\n  wave markdown-tree root --tree-view\n  wave markdown-tree resolve --tool-key projects --node-key tasks --parent-id 123\n"],
@@ -17385,19 +17207,30 @@ function buildCli(options) {
 
 // src/machine.ts
 import { createHash as createHash2 } from "crypto";
+import { readSync } from "fs";
 var MACHINE_FLAGS = /* @__PURE__ */ new Set([
   "--machine",
   "--operation",
   "--phase",
-  "--input-json"
+  "--input-json",
+  "--machine-auth-fd",
+  "--machine-approval-fd"
 ]);
+var MACHINE_AUTH_FD = 3;
+var MACHINE_APPROVAL_FD = 4;
+var MAX_MACHINE_SECRET_BYTES = 64 * 1024;
+var MAX_MACHINE_INPUT_BYTES = 128 * 1024;
 function machineEnvelope(params) {
   return {
     ok: params.ok,
     command: params.command,
     status: params.status,
     data: params.data ?? null,
-    error: params.error ?? null,
+    error: params.error ? {
+      code: params.error.code,
+      message: params.error.message,
+      details: params.error.details ?? {}
+    } : null,
     meta: { requestId: "machine" }
   };
 }
@@ -17419,7 +17252,7 @@ function commandId(command) {
 function parseMachineArgs(argv) {
   const values = {};
   for (let index = 0; index < argv.length; index += 1) {
-    const flag = argv[index];
+    const flag = argv[index] ?? "";
     if (!MACHINE_FLAGS.has(flag)) {
       return { error: `Unsupported machine flag: ${flag}` };
     }
@@ -17434,19 +17267,45 @@ function parseMachineArgs(argv) {
   if (values["--machine"] !== "execute") {
     return { error: '--machine must be "execute".' };
   }
+  const authFd = parseReservedMachineFd(values["--machine-auth-fd"], MACHINE_AUTH_FD);
+  if (authFd instanceof Error) return { error: authFd.message };
+  const approvalFd = parseReservedMachineFd(
+    values["--machine-approval-fd"],
+    MACHINE_APPROVAL_FD
+  );
+  if (approvalFd instanceof Error) return { error: approvalFd.message };
   return {
-    operation: values["--operation"],
-    phase: values["--phase"],
-    inputJson: values["--input-json"]
+    ...values["--operation"] ? { operation: values["--operation"] } : {},
+    ...values["--phase"] ? { phase: values["--phase"] } : {},
+    ...values["--input-json"] ? { inputJson: values["--input-json"] } : {},
+    ...authFd !== void 0 ? { authFd } : {},
+    ...approvalFd !== void 0 ? { approvalFd } : {}
   };
 }
+function parseReservedMachineFd(value, expected) {
+  if (value === void 0) return void 0;
+  if (!/^\d+$/.test(value) || Number(value) !== expected) {
+    return new Error(`The machine secret descriptor must be fd ${expected}.`);
+  }
+  return expected;
+}
 async function readMachineInput(location) {
   if (location !== "-") {
     throw new Error('Machine input must be supplied with "--input-json -".');
   }
   let raw = "";
+  let bytes = 0;
   process.stdin.setEncoding("utf8");
-  for await (const chunk of process.stdin) raw += chunk;
+  for await (const chunk of process.stdin) {
+    const text = String(chunk);
+    bytes += Buffer.byteLength(text, "utf8");
+    if (bytes > MAX_MACHINE_INPUT_BYTES) {
+      throw new Error(
+        `Machine input exceeds the maximum size of ${MAX_MACHINE_INPUT_BYTES} bytes.`
+      );
+    }
+    raw += text;
+  }
   if (!raw.trim()) throw new Error("Machine input JSON is required.");
   const parsed = JSON.parse(raw);
   if (!isPlainObject(parsed)) throw new Error("Machine input must be a JSON object.");
@@ -17467,11 +17326,20 @@ function normalizeInput(input) {
     Object.keys(input).sort().map((key) => [key, input[key]])
   );
 }
-function parseTrustedJson(name, predicate) {
-  const raw = process.env[name];
-  if (!raw) return null;
+function parseTrustedJsonFromFd(fd, predicate) {
+  if (fd === void 0) return null;
   try {
-    const parsed = JSON.parse(raw);
+    const chunks = [];
+    const buffer = Buffer.allocUnsafe(8 * 1024);
+    let bytes = 0;
+    while (true) {
+      const read = readSync(fd, buffer, 0, buffer.length, null);
+      if (read === 0) break;
+      bytes += read;
+      if (bytes > MAX_MACHINE_SECRET_BYTES) return null;
+      chunks.push(Buffer.from(buffer.subarray(0, read)));
+    }
+    const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
     return predicate(parsed) ? parsed : null;
   } catch {
     return null;
@@ -17546,13 +17414,9 @@ function withTrustedMachineAuth(auth, callback) {
   for (const key of Object.keys(process.env)) {
     if (key.startsWith("WAVE_")) delete process.env[key];
   }
-  if (auth) {
-    process.env.WAVE_API_TOKEN = auth.token;
-    process.env.WAVE_API_BASE_URL = auth.baseUrl;
-  }
   process.env.WAVE_CLI_AUTH_STORAGE = "disabled";
   process.env.WAVE_CLI_HOME = "/dev/null";
-  return callback().finally(() => {
+  return withMachineRuntimeAuth(auth, callback).finally(() => {
     for (const key of Object.keys(process.env)) {
       if (key.startsWith("WAVE_")) delete process.env[key];
     }
@@ -17704,7 +17568,7 @@ async function maybeRunMachineExecute(argv, program) {
       })
     });
   }
-  const auth = parseTrustedJson("WAVE_MACHINE_AUTH_JSON", isTrustedAuth);
+  const auth = parseTrustedJsonFromFd(parsed.authFd, isTrustedAuth);
   if (needsTrustedAuth(resolved.operation) && !auth) {
     return printEnvelopeAndExit({
       envelope: machineEnvelope({
@@ -17720,7 +17584,7 @@ async function maybeRunMachineExecute(argv, program) {
     });
   }
   if (resolved.operation.classification === "write") {
-    const approval = parseTrustedJson("WAVE_MACHINE_APPROVAL_JSON", isTrustedApproval);
+    const approval = parseTrustedJsonFromFd(parsed.approvalFd, isTrustedApproval);
     if (!approval || approval.operation !== resolved.operation.id || approval.inputDigest !== digest || approval.cliVersion !== manifest.cli.version || approval.registryDigest !== manifest.registryDigest || approval.organizationId !== auth?.organizationId || approval.actorId !== auth?.actorId) {
       return printEnvelopeAndExit({
         envelope: machineEnvelope({