@wave-ai-os/wave-cli 0.1.83 → 0.1.84

package/dist/index.cjs

@@ -1220,6 +1220,7 @@ var RESOURCE_QUERY_FIELDS = {
     "organizationSlug",
     "userId",
     "coachId",
+    "reportTo",
     "timezone",
     "province",
     "birthdate",
@@ -7900,7 +7901,7 @@ var import_commander = require("commander");
 var import_node_crypto3 = require("crypto");
 
 // src/version.ts
-var CLI_VERSION = "0.1.83";
+var CLI_VERSION = "0.1.84";
 
 // src/operationMetadata.ts
 var DISCOVERY_OPERATION_IDS = [
@@ -8360,6 +8361,7 @@ var WRITE_OPERATION_IDS = [
   "todos.create",
   "todos.update"
 ];
+var DIRECT_MACHINE_WRITE_OPERATION_IDS = /* @__PURE__ */ new Set(["automations.create"]);
 var AUTH_OPERATION_IDS = ["login", "logout"];
 var DESTRUCTIVE_OPERATION_IDS = /* @__PURE__ */ new Set([
   "content.destroy",
@@ -8403,7 +8405,7 @@ for (const [classification, operationIds] of Object.entries(OPERATION_IDS_BY_CLA
     }
     metadataByOperationId.set(id, {
       classification,
-      requiresApproval: classification === "write",
+      requiresApproval: classification === "write" && !DIRECT_MACHINE_WRITE_OPERATION_IDS.has(id),
       atlasSafetyClass,
       machine: {
         supportsValidate: true,
@@ -15729,9 +15731,481 @@ function registerDatasheetsCommands(program) {
   });
 }
 
+// src/commands/signatures.ts
+var import_node_path4 = require("path");
+var import_promises4 = require("fs/promises");
+var import_node_crypto4 = require("crypto");
+var import_pdf_lib = require("pdf-lib");
+var idSchema14 = (value, label = "id") => {
+  const parsed = typeof value === "string" ? value.trim() : "";
+  if (parsed.length === 0) {
+    throw new CliError({
+      message: label + " is required.",
+      kind: "invalid_args",
+      status: 400,
+      exitCode: EXIT_CODES.invalidArgs
+    });
+  }
+  return parsed;
+};
+var MAX_SIGNATURE_PDF_BYTES = 50 * 1024 * 1024;
+var URL_OR_TRANSPORT_KEY = /(?:^|_)(?:url|uri|token|nonce|post_fields|postfields|headers|authorization|secret|credential)(?:$|_)/i;
+function isRecord7(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function asNonEmptyString6(value) {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+function parseJsonObject4(raw, optionName) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (!isRecord7(parsed)) {
+      throw new Error("JSON must be an object.");
+    }
+    return parsed;
+  } catch (error) {
+    throw new CliError({
+      message: error instanceof Error ? "Invalid " + optionName + ": " + error.message : "Invalid " + optionName + ".",
+      kind: "invalid_args",
+      status: 400,
+      exitCode: EXIT_CODES.invalidArgs
+    });
+  }
+}
+function unwrapSignaturePayload(raw) {
+  const wrapped = raw.signature_envelope ?? raw.signatureEnvelope ?? raw.signature ?? raw.envelope;
+  return isRecord7(wrapped) ? wrapped : raw;
+}
+function onlyAllowedKeys(payload, allowed, optionName) {
+  const unsupported = Object.keys(payload).filter((key) => !allowed.includes(key));
+  if (unsupported.length > 0) {
+    throw new CliError({
+      message: "Invalid " + optionName + ": unsupported fields " + unsupported.join(", ") + ".",
+      kind: "invalid_args",
+      status: 400,
+      exitCode: EXIT_CODES.invalidArgs,
+      details: { unsupportedFields: unsupported, allowedFields: allowed }
+    });
+  }
+  return payload;
+}
+function parseCreatePayload(raw, mode) {
+  const data = raw ? unwrapSignaturePayload(parseJsonObject4(raw, "--data-json")) : {};
+  onlyAllowedKeys(
+    data,
+    ["name", "subject", "message", "expires_at", "visibility", "metadata", "recipients"],
+    "--data-json"
+  );
+  const parsedMode = asNonEmptyString6(mode);
+  if (parsedMode !== "request" && parsedMode !== "self_sign") {
+    throw new CliError({
+      message: "signatures create requires --mode request or --mode self_sign.",
+      kind: "invalid_args",
+      status: 400,
+      exitCode: EXIT_CODES.invalidArgs
+    });
+  }
+  return { ...data, mode: parsedMode };
+}
+function parseUpdatePayload(raw, options) {
+  const data = raw ? unwrapSignaturePayload(parseJsonObject4(raw, "--data-json")) : {};
+  onlyAllowedKeys(
+    data,
+    ["name", "subject", "message", "expires_at", "visibility", "recipients", "fields"],
+    "--data-json"
+  );
+  const name = asNonEmptyString6(options.name);
+  const subject = asNonEmptyString6(options.subject);
+  const message = asNonEmptyString6(options.message);
+  const patch = {
+    ...data,
+    ...name ? { name } : {},
+    ...subject ? { subject } : {},
+    ...message ? { message } : {}
+  };
+  if (Object.keys(patch).length === 0) {
+    throw new CliError({
+      message: "signatures update requires --data-json, --name, --subject, or --message.",
+      kind: "invalid_args",
+      status: 400,
+      exitCode: EXIT_CODES.invalidArgs
+    });
+  }
+  return patch;
+}
+function sanitizeSignatureValue(value) {
+  if (Array.isArray(value)) return value.map(sanitizeSignatureValue);
+  if (!isRecord7(value)) return value;
+  return Object.fromEntries(
+    Object.entries(value).filter(([key]) => {
+      const normalizedKey2 = key.replace(/([a-z0-9])([A-Z])/g, "$1_$2");
+      return !URL_OR_TRANSPORT_KEY.test(normalizedKey2);
+    }).map(([key, child]) => [key, sanitizeSignatureValue(child)])
+  );
+}
+function safeSignatureMutationPayload(payload) {
+  if (!isRecord7(payload)) return payload;
+  return {
+    ...payload,
+    ...Object.prototype.hasOwnProperty.call(payload, "data") ? { data: sanitizeSignatureValue(payload.data) } : {}
+  };
+}
+function safeSignatureQueryPayload(payload) {
+  return sanitizeSignatureValue(payload);
+}
+function cliErrorEnvelope(command, error) {
+  return {
+    ok: false,
+    command,
+    status: error.status,
+    data: null,
+    error: {
+      code: error.kind,
+      message: error.message,
+      details: error.details
+    },
+    meta: { requestId: "local_error" }
+  };
+}
+async function inspectSignaturePdf(path) {
+  const resolvedPath = idSchema14(path, "file");
+  const filename = (0, import_node_path4.basename)(resolvedPath);
+  if (!filename.toLowerCase().endsWith(".pdf")) {
+    throw new CliError({
+      message: "Signature source files must have a .pdf extension.",
+      kind: "invalid_args",
+      status: 400,
+      exitCode: EXIT_CODES.invalidArgs
+    });
+  }
+  let bytes;
+  try {
+    bytes = await (0, import_promises4.readFile)(resolvedPath);
+  } catch (error) {
+    throw new CliError({
+      message: "Unable to read the Signature PDF: " + (error instanceof Error ? error.message : "unknown error"),
+      kind: "invalid_args",
+      status: 400,
+      exitCode: EXIT_CODES.invalidArgs
+    });
+  }
+  if (bytes.byteLength === 0 || bytes.byteLength > MAX_SIGNATURE_PDF_BYTES) {
+    throw new CliError({
+      message: "Signature PDFs must be between 1 byte and 50 MB.",
+      kind: "invalid_args",
+      status: 400,
+      exitCode: EXIT_CODES.invalidArgs
+    });
+  }
+  if (Buffer.from(bytes).subarray(0, 5).toString("ascii") !== "%PDF-") {
+    throw new CliError({
+      message: "Only valid PDF documents can be used for signatures.",
+      kind: "invalid_args",
+      status: 400,
+      exitCode: EXIT_CODES.invalidArgs
+    });
+  }
+  let pageCount;
+  try {
+    const document = await import_pdf_lib.PDFDocument.load(bytes, { ignoreEncryption: false });
+    pageCount = document.getPageCount();
+  } catch {
+    throw new CliError({
+      message: "Only valid, non-password-protected PDF documents can be used for signatures.",
+      kind: "invalid_args",
+      status: 400,
+      exitCode: EXIT_CODES.invalidArgs
+    });
+  }
+  if (pageCount < 1 || pageCount > 500) {
+    throw new CliError({
+      message: "Signature PDFs must contain between 1 and 500 pages.",
+      kind: "invalid_args",
+      status: 400,
+      exitCode: EXIT_CODES.invalidArgs
+    });
+  }
+  return {
+    bytes,
+    filename,
+    byteSize: bytes.byteLength,
+    pageCount,
+    sha256: (0, import_node_crypto4.createHash)("sha256").update(bytes).digest("hex")
+  };
+}
+function requireUploadTarget(payload) {
+  if (!isRecord7(payload) || !isRecord7(payload.data) || !isRecord7(payload.data.data)) {
+    throw new CliError({
+      message: "Signature upload initialization returned an invalid payload.",
+      kind: "malformed_response",
+      status: 502,
+      exitCode: EXIT_CODES.networkOrUpstream
+    });
+  }
+  const attributes = payload.data.data.attributes;
+  if (!isRecord7(attributes)) {
+    throw new CliError({
+      message: "Signature upload initialization did not return upload attributes.",
+      kind: "malformed_response",
+      status: 502,
+      exitCode: EXIT_CODES.networkOrUpstream
+    });
+  }
+  const postUrl = asNonEmptyString6(attributes.postUrl);
+  const fileKey = asNonEmptyString6(attributes.getUrl);
+  const rawPostFields = attributes.postFields;
+  if (!postUrl || !fileKey || !isRecord7(rawPostFields) || !fileKey.startsWith("uploads/signatures/")) {
+    throw new CliError({
+      message: "Signature upload initialization returned an invalid storage target.",
+      kind: "malformed_response",
+      status: 502,
+      exitCode: EXIT_CODES.networkOrUpstream
+    });
+  }
+  const postFields = Object.entries(rawPostFields).reduce((result, [key, value]) => {
+    if (typeof value === "string") result[key] = value;
+    return result;
+  }, {});
+  if (Object.keys(postFields).length === 0) {
+    throw new CliError({
+      message: "Signature upload initialization returned no upload form fields.",
+      kind: "malformed_response",
+      status: 502,
+      exitCode: EXIT_CODES.networkOrUpstream
+    });
+  }
+  return { postUrl, postFields, fileKey };
+}
+async function uploadSignaturePdf(target, pdf) {
+  const form = new FormData();
+  Object.entries(target.postFields).forEach(([key, value]) => form.set(key, value));
+  const uploadBytes = new Uint8Array(pdf.bytes.byteLength);
+  uploadBytes.set(pdf.bytes);
+  form.set("file", new Blob([uploadBytes.buffer], { type: "application/pdf" }), pdf.filename);
+  let response;
+  try {
+    response = await fetch(target.postUrl, { method: "POST", body: form });
+  } catch (error) {
+    throw new CliError({
+      message: "Signature PDF upload failed: " + (error instanceof Error ? error.message : "network error"),
+      kind: "network_error",
+      status: 502,
+      exitCode: EXIT_CODES.networkOrUpstream
+    });
+  }
+  if (!response.ok) {
+    throw new CliError({
+      message: "Signature PDF upload failed with HTTP " + response.status + ".",
+      kind: "upstream_error",
+      status: 502,
+      exitCode: EXIT_CODES.networkOrUpstream
+    });
+  }
+}
+async function runCreateSignatureCommand(params) {
+  try {
+    const config = getConfig(params.runtimeOptions);
+    const pdf = await inspectSignaturePdf(params.file);
+    const uploadResult = await graphqlRequest({
+      config,
+      command: "signatures.create.upload",
+      operationName: "SignaturesCreateUpload",
+      operationType: "mutation",
+      field: "create_s3_upload",
+      variables: {
+        params: {
+          filename: pdf.filename,
+          file_type: "pdf",
+          content_type: "application/pdf",
+          directory: "signatures"
+        }
+      },
+      variableTypes: { params: "CreateS3UploadParamsInput!" },
+      selectionSet: "{ ok status errorCode data errors }"
+    });
+    if (!uploadResult.envelope.ok) {
+      return printEnvelopeAndExit({
+        envelope: uploadResult.envelope,
+        exitCode: uploadResult.exitCode
+      });
+    }
+    const uploadPayload = uploadResult.envelope.data?.create_s3_upload;
+    const target = requireUploadTarget(uploadPayload);
+    await uploadSignaturePdf(target, pdf);
+    const createResult = await graphqlRequest({
+      config,
+      command: "signatures.create",
+      operationName: "SignaturesCreate",
+      operationType: "mutation",
+      field: "create_signature_envelope",
+      variables: {
+        organization_id: params.organizationId,
+        params: {
+          ...params.payload,
+          file_key: target.fileKey,
+          filename: pdf.filename,
+          byte_size: pdf.byteSize,
+          page_count: pdf.pageCount,
+          sha256: pdf.sha256
+        }
+      },
+      variableTypes: {
+        organization_id: "ID!",
+        params: "JSON!"
+      },
+      selectionSet: "{ ok status errorCode data errors }"
+    });
+    if (createResult.envelope.ok && createResult.envelope.data) {
+      const data = createResult.envelope.data;
+      createResult.envelope.data = {
+        ...data,
+        create_signature_envelope: safeSignatureMutationPayload(data.create_signature_envelope)
+      };
+    }
+    return printEnvelopeAndExit({
+      envelope: createResult.envelope,
+      exitCode: createResult.exitCode
+    });
+  } catch (error) {
+    if (error instanceof CliError) {
+      return printEnvelopeAndExit({
+        envelope: cliErrorEnvelope("signatures.create", error),
+        exitCode: error.exitCode
+      });
+    }
+    throw error;
+  }
+}
+function requireConfirmation(value, optionName) {
+  if (value === true) return;
+  throw new CliError({
+    message: "This Signature action requires " + optionName + ".",
+    kind: "invalid_args",
+    status: 400,
+    exitCode: EXIT_CODES.invalidArgs
+  });
+}
+function registerSignatureCommands(program) {
+  const signatures = program.command("signatures").description("Signature envelope operations");
+  signatures.command("list").option("--folder <folder>").option("--status <status>").option("--query <query>").option("--mine").option("--page <page>").option("--per <per>").action(async (opts, cmd) => {
+    const context = await resolveCommandContext(cmd.optsWithGlobals());
+    const organizationId = resolveOrganizationId(context.organizationId);
+    await runGraphqlQueryCommand({
+      command: "signatures.list",
+      operationName: "SignaturesList",
+      runtimeOptions: context.runtimeOptions,
+      field: "signature_envelopes",
+      variables: {
+        organization_id: organizationId,
+        params: normalizeGraphqlVariables2({
+          folder: opts.folder,
+          status: opts.status,
+          query: opts.query,
+          mine: opts.mine,
+          page: opts.page,
+          per: opts.per
+        })
+      },
+      variableTypes: { organization_id: "ID!", params: "JSON" },
+      selectionSet: "",
+      isList: true,
+      transformData: safeSignatureQueryPayload
+    });
+  });
+  signatures.command("show").requiredOption("--id <id>").option("--include-events").action(async (opts, cmd) => {
+    const context = await resolveCommandContext(cmd.optsWithGlobals());
+    const organizationId = resolveOrganizationId(context.organizationId);
+    await runGraphqlQueryCommand({
+      command: "signatures.show",
+      operationName: "SignaturesShow",
+      runtimeOptions: context.runtimeOptions,
+      field: "signature_envelope",
+      variables: {
+        organization_id: organizationId,
+        id: idSchema14(opts.id),
+        include_events: Boolean(opts.includeEvents)
+      },
+      variableTypes: {
+        organization_id: "ID!",
+        id: "ID!",
+        include_events: "Boolean!"
+      },
+      selectionSet: "",
+      isShow: true,
+      transformData: safeSignatureQueryPayload
+    });
+  });
+  signatures.command("create").requiredOption("--file <file>").requiredOption("--mode <mode>", "request or self_sign").option("--data-json <dataJson>", "JSON object for additional draft fields").action(async (opts, cmd) => {
+    const context = await resolveCommandContext(cmd.optsWithGlobals());
+    await runCreateSignatureCommand({
+      runtimeOptions: context.runtimeOptions,
+      organizationId: resolveOrganizationId(context.organizationId),
+      file: String(opts.file),
+      payload: parseCreatePayload(opts.dataJson, opts.mode)
+    });
+  });
+  signatures.command("update").requiredOption("--id <id>").option("--name <name>").option("--subject <subject>").option("--message <message>").option("--data-json <dataJson>", "JSON object for draft fields, recipients, and fields").action(async (opts, cmd) => {
+    const context = await resolveCommandContext(cmd.optsWithGlobals());
+    const organizationId = resolveOrganizationId(context.organizationId);
+    await runGraphqlMutationCommand({
+      command: "signatures.update",
+      operationName: "SignaturesUpdate",
+      runtimeOptions: context.runtimeOptions,
+      field: "update_signature_envelope",
+      variables: {
+        organization_id: organizationId,
+        id: idSchema14(opts.id),
+        params: parseUpdatePayload(opts.dataJson, opts)
+      },
+      variableTypes: {
+        organization_id: "ID!",
+        id: "ID!",
+        params: "JSON!"
+      },
+      transformMutationPayload: safeSignatureMutationPayload
+    });
+  });
+  const lifecycle = (name, field, confirmation) => {
+    const command = signatures.command(name).requiredOption("--id <id>");
+    if (name === "void") command.requiredOption("--reason <reason>");
+    if (confirmation === "--confirm-send") command.option("--confirm-send");
+    if (confirmation === "--confirm") command.option("--confirm");
+    command.action(async (opts, cmd) => {
+      if (confirmation === "--confirm-send") requireConfirmation(opts.confirmSend, "--confirm-send");
+      if (confirmation === "--confirm") requireConfirmation(opts.confirm, "--confirm");
+      const context = await resolveCommandContext(cmd.optsWithGlobals());
+      const organizationId = resolveOrganizationId(context.organizationId);
+      await runGraphqlMutationCommand({
+        command: "signatures." + name,
+        operationName: "Signatures" + name.slice(0, 1).toUpperCase() + name.slice(1),
+        runtimeOptions: context.runtimeOptions,
+        field,
+        variables: {
+          organization_id: organizationId,
+          id: idSchema14(opts.id),
+          ...name === "void" ? { reason: idSchema14(opts.reason, "reason") } : {}
+        },
+        variableTypes: {
+          organization_id: "ID!",
+          id: "ID!",
+          ...name === "void" ? { reason: "String" } : {}
+        },
+        transformMutationPayload: safeSignatureMutationPayload
+      });
+    });
+  };
+  lifecycle("send", "send_signature_envelope", "--confirm-send");
+  lifecycle("archive", "archive_signature_envelope", null);
+  lifecycle("unarchive", "unarchive_signature_envelope", null);
+  lifecycle("destroy", "delete_signature_envelope", "--confirm");
+  lifecycle("void", "void_signature_envelope", "--confirm");
+}
+
 // src/commands/atlasAuthoring.ts
 var import_zod20 = require("zod");
-var idSchema14 = import_zod20.z.string().trim().min(1);
+var idSchema15 = import_zod20.z.string().trim().min(1);
 var idempotencyKeySchema = import_zod20.z.string().min(1).refine((value) => value.trim() === value, "Idempotency key must not have leading or trailing whitespace.");
 var skillScopeSchema = import_zod20.z.enum(["ADMIN_GLOBAL", "MEMBER_PERSONAL"]);
 var isoDateSchema = import_zod20.z.iso.date();
@@ -15803,7 +16277,6 @@ var AGENT_SELECTION = `{
   slug
   status
   visibility
-  model
   runWhenMentioned
   webAccessEnabled
   webFetchEnabled
@@ -16084,6 +16557,7 @@ function normalizePersistedCreatePayload(payload) {
   const mutationData = asRecord7(mutation?.data);
   const persisted = asRecord7(mutationData?.data) ?? mutationData;
   const attributes = asRecord7(persisted?.attributes);
+  const automationExecution = asRecord7(attributes?.automation_execution) ?? asRecord7(attributes?.automationExecution);
   const meta = asRecord7(mutationData?.meta);
   const idempotency = asRecord7(meta?.atlas_idempotency);
   const id = asRequiredString(persisted?.id);
@@ -16111,7 +16585,8 @@ function normalizePersistedCreatePayload(payload) {
       fingerprint: asRequiredString(idempotency.fingerprint),
       replay,
       action: asRequiredString(idempotency.action)
-    }
+    },
+    ...automationExecution ? { automation_execution: automationExecution } : {}
   };
 }
 function normalizePersistedUpdatePayload(payload) {
@@ -16263,7 +16738,7 @@ function parseAutomationConfig(value) {
       exitCode: EXIT_CODES.invalidArgs
     });
   }
-  return config;
+  return config.cycle === "single" ? { ...config, cycle: "single_use" } : config;
 }
 function parseExpectedUpdateVersion(value) {
   return nonEmptyStringSchema.parse(String(value));
@@ -16333,7 +16808,7 @@ function registerAtlasAuthoringCommands(program) {
             ...opts.name !== void 0 ? { name: String(opts.name) } : {},
             ...opts.description !== void 0 ? { description: String(opts.description) } : {},
             ...opts.notes !== void 0 ? { notes: String(opts.notes) } : {},
-            ...opts.memberId !== void 0 ? { member_id: idSchema14.parse(opts.memberId) } : {},
+            ...opts.memberId !== void 0 ? { member_id: idSchema15.parse(opts.memberId) } : {},
             ...opts.status !== void 0 ? { status: String(opts.status) } : {},
             ...opts.visibility !== void 0 ? { visibility: String(opts.visibility) } : {},
             ...opts.model !== void 0 ? { model: String(opts.model) } : {},
@@ -16356,7 +16831,7 @@ function registerAtlasAuthoringCommands(program) {
     });
   });
   agents.command("show").description("Read one persisted Agent by id or slug").requiredOption("--id <idOrSlug>", "Agent id or slug").action(async (opts, cmd) => {
-    const id = idSchema14.parse(opts.id);
+    const id = idSchema15.parse(opts.id);
     const context = await resolveCommandContext(cmd.optsWithGlobals());
     const organizationId = resolveOrganizationId(context.organizationId);
     await runGraphqlQueryCommand({
@@ -16444,7 +16919,7 @@ function registerAtlasAuthoringCommands(program) {
         exitCode: EXIT_CODES.invalidArgs
       });
     }
-    const id = idSchema14.parse(opts.id);
+    const id = idSchema15.parse(opts.id);
     const expectedUpdateVersion = parseExpectedUpdateVersion(opts.expectedUpdateVersion);
     const context = await resolveCommandContext(cmd.optsWithGlobals());
     const organizationId = resolveOrganizationId(context.organizationId);
@@ -16528,12 +17003,12 @@ function registerAtlasAuthoringCommands(program) {
       variables: {
         organization_id: organizationId,
         input: {
-          summary: idSchema14.parse(opts.summary),
+          summary: idSchema15.parse(opts.summary),
           ai_task_config: parseAutomationConfig(opts.aiTaskConfig),
           ...opts.description !== void 0 ? { description: String(opts.description) } : {},
           ...opts.notes !== void 0 ? { notes: String(opts.notes) } : {},
-          ...opts.memberId !== void 0 ? { member_id: idSchema14.parse(opts.memberId) } : {},
-          ...opts.agentId !== void 0 ? { agent_id: idSchema14.parse(opts.agentId) } : {},
+          ...opts.memberId !== void 0 ? { member_id: idSchema15.parse(opts.memberId) } : {},
+          ...opts.agentId !== void 0 ? { agent_id: idSchema15.parse(opts.agentId) } : {},
           ...opts.priority !== void 0 ? { priority: String(opts.priority) } : {},
           ...opts.dueDate !== void 0 ? { due_date: isoDateSchema.parse(opts.dueDate) } : {}
         },
@@ -16543,7 +17018,7 @@ function registerAtlasAuthoringCommands(program) {
     });
   });
   automations.command("show").description("Read one persisted Automation by id or slug").requiredOption("--id <idOrSlug>", "Automation id or slug").action(async (opts, cmd) => {
-    const id = idSchema14.parse(opts.id);
+    const id = idSchema15.parse(opts.id);
     const context = await resolveCommandContext(cmd.optsWithGlobals());
     const organizationId = resolveOrganizationId(context.organizationId);
     await runGraphqlQueryCommand({
@@ -16558,7 +17033,7 @@ function registerAtlasAuthoringCommands(program) {
     });
   });
   automations.command("run").description("Queue one Automation by id or slug and return exact status readback identifiers").requiredOption("--id <idOrSlug>", "Automation id or slug").action(async (opts, cmd) => {
-    const automationId = idSchema14.parse(opts.id);
+    const automationId = idSchema15.parse(opts.id);
     const context = await resolveCommandContext(cmd.optsWithGlobals());
     const organizationId = resolveOrganizationId(context.organizationId);
     await runGraphqlMutationCommand({
@@ -16572,9 +17047,9 @@ function registerAtlasAuthoringCommands(program) {
     });
   });
   automations.command("run-status").description("Read one queued or terminal Automation execution by its run identity").requiredOption("--id <idOrSlug>", "Automation id or slug returned by automations run").requiredOption("--message-id <messageId>", "Message id returned by automations run").requiredOption("--run-id <runId>", "Run id returned by automations run").action(async (opts, cmd) => {
-    const automationId = idSchema14.parse(opts.id);
-    const messageId = idSchema14.parse(opts.messageId);
-    const runId = idSchema14.parse(opts.runId);
+    const automationId = idSchema15.parse(opts.id);
+    const messageId = idSchema15.parse(opts.messageId);
+    const runId = idSchema15.parse(opts.runId);
     const context = await resolveCommandContext(cmd.optsWithGlobals());
     const organizationId = resolveOrganizationId(context.organizationId);
     await runGraphqlQueryCommand({
@@ -16599,8 +17074,8 @@ function registerAtlasAuthoringCommands(program) {
     });
   });
   automations.command("run-show").description("Read one Automation run artifact by Agent id and execution slug").requiredOption("--agent-id <agentIdOrSlug>", "Agent id or slug").requiredOption("--execution-slug <executionSlug>", "Execution slug returned by automations run").action(async (opts, cmd) => {
-    const agentId = idSchema14.parse(opts.agentId);
-    const executionSlug = idSchema14.parse(opts.executionSlug);
+    const agentId = idSchema15.parse(opts.agentId);
+    const executionSlug = idSchema15.parse(opts.executionSlug);
     const context = await resolveCommandContext(cmd.optsWithGlobals());
     const organizationId = resolveOrganizationId(context.organizationId);
     await runGraphqlQueryCommand({
@@ -16654,7 +17129,7 @@ function registerAtlasAuthoringCommands(program) {
         exitCode: EXIT_CODES.invalidArgs
       });
     }
-    const id = idSchema14.parse(opts.id);
+    const id = idSchema15.parse(opts.id);
     const expectedUpdateVersion = parseExpectedUpdateVersion(opts.expectedUpdateVersion);
     const context = await resolveCommandContext(cmd.optsWithGlobals());
     const organizationId = resolveOrganizationId(context.organizationId);
@@ -16699,7 +17174,7 @@ function registerAtlasAuthoringCommands(program) {
       variables: {
         organization_id: organizationId,
         input: {
-          name: idSchema14.parse(opts.name),
+          name: idSchema15.parse(opts.name),
           scope: skillScopeSchema.parse(opts.scope),
           ...opts.emoji !== void 0 ? { emoji: String(opts.emoji) } : {},
           ...opts.description !== void 0 ? { description: String(opts.description) } : {}
@@ -16726,7 +17201,7 @@ function registerAtlasAuthoringCommands(program) {
         exitCode: EXIT_CODES.invalidArgs
       });
     }
-    const id = idSchema14.parse(opts.id);
+    const id = idSchema15.parse(opts.id);
     const expectedUpdateVersion = parseExpectedUpdateVersion(opts.expectedUpdateVersion);
     const context = await resolveCommandContext(cmd.optsWithGlobals());
     const organizationId = resolveOrganizationId(context.organizationId);
@@ -16754,7 +17229,7 @@ function registerAtlasAuthoringCommands(program) {
 
 // src/commands/discovery.ts
 var import_node_fs4 = require("fs");
-var import_node_path4 = require("path");
+var import_node_path5 = require("path");
 var PRIMARY_NAMESPACES = [
   "osmd",
   "broadcast",
@@ -17394,7 +17869,7 @@ function commandSummary(command) {
 }
 function packageVersion() {
   try {
-    const pkg = JSON.parse((0, import_node_fs4.readFileSync)((0, import_node_path4.join)(process.cwd(), "package.json"), "utf8"));
+    const pkg = JSON.parse((0, import_node_fs4.readFileSync)((0, import_node_path5.join)(process.cwd(), "package.json"), "utf8"));
     return typeof pkg.version === "string" ? pkg.version : "unknown";
   } catch {
     return "unknown";
@@ -17811,6 +18286,7 @@ function buildCli(options) {
   registerMailCommands(program);
   registerPhantomCommands(program);
   registerDatasheetsCommands(program);
+  registerSignatureCommands(program);
   registerAuthCommands(program);
   registerDiscoveryCommands(program);
   attachNamespaceDiscovery(program);
@@ -17819,7 +18295,7 @@ function buildCli(options) {
 }
 
 // src/machine.ts
-var import_node_crypto4 = require("crypto");
+var import_node_crypto5 = require("crypto");
 var import_node_fs5 = require("fs");
 var MACHINE_FLAGS = /* @__PURE__ */ new Set([
   "--machine",
@@ -17925,7 +18401,7 @@ async function readMachineInput(location) {
   return parsed;
 }
 function inputDigest(input) {
-  return `sha256:${(0, import_node_crypto4.createHash)("sha256").update(canonicalJson(input)).digest("hex")}`;
+  return `sha256:${(0, import_node_crypto5.createHash)("sha256").update(canonicalJson(input)).digest("hex")}`;
 }
 function canonicalJson(value) {
   if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
@@ -18256,7 +18732,7 @@ async function maybeRunMachineExecute(argv, program) {
       exitCode: EXIT_CODES.missingOrInvalidAuth
     });
   }
-  if (resolved.operation.classification === "write") {
+  if (resolved.operation.requiresApproval) {
     const approval = parseTrustedJsonFromFd(parsed.approvalFd, isTrustedApproval);
     if (!approval || approval.operation !== resolved.operation.id || approval.inputDigest !== digest || approval.cliVersion !== manifest.cli.version || approval.registryDigest !== manifest.registryDigest || approval.organizationId !== auth?.organizationId || approval.actorId !== auth?.actorId) {
       return printEnvelopeAndExit({