@wave-ai-os/wave-cli 0.1.86 → 0.1.88

package/dist/index.cjs

@@ -3,11 +3,230 @@
 
 // src/index.ts
 var import_commander3 = require("commander");
-var import_zod21 = require("zod");
+var import_zod22 = require("zod");
 
 // src/cli.ts
 var import_commander2 = require("commander");
 
+// src/authStorage.ts
+var import_node_child_process = require("child_process");
+var import_node_fs = require("fs");
+var import_promises = require("fs/promises");
+var import_node_os = require("os");
+var import_node_path = require("path");
+var import_node_util = require("util");
+var execFileAsync = (0, import_node_util.promisify)(import_node_child_process.execFile);
+var KEYCHAIN_SERVICE = "wave-cli";
+var FILE_NAME = "auth-token.json";
+var DEFAULT_STORAGE_MODE = "auto";
+var activeOptions = {};
+function configureAuthStorage(options) {
+  activeOptions = { ...options };
+}
+async function withAuthStorageOptions(options, callback) {
+  const previous = activeOptions;
+  activeOptions = { ...options };
+  try {
+    return await callback();
+  } finally {
+    activeOptions = previous;
+  }
+}
+function normalize(raw) {
+  if (typeof raw !== "string") return void 0;
+  const trimmed = raw.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+function authHome() {
+  return normalize(activeOptions.home) ?? (0, import_node_path.join)((0, import_node_os.homedir)(), ".wave");
+}
+function tokenPath() {
+  return (0, import_node_path.join)(authHome(), FILE_NAME);
+}
+function configPath() {
+  return normalize(activeOptions.configPath) ?? (0, import_node_path.join)(authHome(), "config.json");
+}
+function storageMode() {
+  return activeOptions.mode ?? DEFAULT_STORAGE_MODE;
+}
+function accountForBaseUrl(baseUrl) {
+  return normalize(baseUrl) ?? "default";
+}
+async function commandExists(command) {
+  try {
+    await (0, import_promises.access)(command, import_node_fs.constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function keychainAvailable() {
+  if (process.platform !== "darwin") return false;
+  if (storageMode() === "file" || storageMode() === "disabled") return false;
+  return commandExists("/usr/bin/security");
+}
+async function preferredStorage() {
+  const mode = storageMode();
+  if (mode === "disabled") return "disabled";
+  if (mode === "file") return "file";
+  if (mode === "keychain") return await keychainAvailable() ? "keychain" : "file";
+  return await keychainAvailable() ? "keychain" : "file";
+}
+async function readKeychainToken(baseUrl) {
+  try {
+    const { stdout } = await execFileAsync("/usr/bin/security", [
+      "find-generic-password",
+      "-a",
+      accountForBaseUrl(baseUrl),
+      "-s",
+      KEYCHAIN_SERVICE,
+      "-w"
+    ], { encoding: "utf8" });
+    return normalize(String(stdout)) ?? null;
+  } catch {
+    return null;
+  }
+}
+async function writeKeychainToken(token, baseUrl) {
+  await execFileAsync("/usr/bin/security", [
+    "add-generic-password",
+    "-a",
+    accountForBaseUrl(baseUrl),
+    "-s",
+    KEYCHAIN_SERVICE,
+    "-w",
+    token,
+    "-U"
+  ]);
+}
+async function deleteKeychainToken(baseUrl) {
+  try {
+    await execFileAsync("/usr/bin/security", [
+      "delete-generic-password",
+      "-a",
+      accountForBaseUrl(baseUrl),
+      "-s",
+      KEYCHAIN_SERVICE
+    ]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function readFileToken(baseUrl) {
+  const path = tokenPath();
+  if (!(0, import_node_fs.existsSync)(path)) return null;
+  try {
+    const raw = await (0, import_promises.readFile)(path, "utf8");
+    const payload = JSON.parse(raw);
+    const token = normalize(payload.token);
+    const storedBaseUrl = normalize(payload.baseUrl);
+    const requestedBaseUrl = normalize(baseUrl);
+    if (!token) return null;
+    if (storedBaseUrl !== requestedBaseUrl) return null;
+    return token;
+  } catch {
+    return null;
+  }
+}
+async function writeFileToken(token, baseUrl) {
+  const home = authHome();
+  const path = tokenPath();
+  await (0, import_promises.mkdir)(home, { recursive: true, mode: 448 });
+  await (0, import_promises.writeFile)(
+    path,
+    `${JSON.stringify({ token, baseUrl: baseUrl ?? null, updatedAt: (/* @__PURE__ */ new Date()).toISOString() })}
+`,
+    { mode: 384 }
+  );
+  await (0, import_promises.chmod)(path, 384);
+}
+async function deleteFileToken() {
+  const path = tokenPath();
+  if (!(0, import_node_fs.existsSync)(path)) return false;
+  await (0, import_promises.rm)(path, { force: true });
+  return true;
+}
+async function readStoredToken(baseUrl) {
+  const mode = await preferredStorage();
+  if (mode === "disabled") return null;
+  if (mode === "keychain") {
+    const keychainToken = await readKeychainToken(baseUrl);
+    if (keychainToken) return { token: keychainToken, source: "keychain" };
+  }
+  const fileToken = await readFileToken(baseUrl);
+  return fileToken ? { token: fileToken, source: "file" } : null;
+}
+async function writeStoredToken(token, baseUrl) {
+  const mode = await preferredStorage();
+  if (mode === "disabled") {
+    return { kind: "disabled", available: false };
+  }
+  if (mode === "keychain") {
+    try {
+      await writeKeychainToken(token, baseUrl);
+      return {
+        kind: "keychain",
+        available: true,
+        service: KEYCHAIN_SERVICE,
+        account: accountForBaseUrl(baseUrl)
+      };
+    } catch {
+      await writeFileToken(token, baseUrl);
+      return { kind: "file", available: true, path: tokenPath() };
+    }
+  }
+  await writeFileToken(token, baseUrl);
+  return { kind: "file", available: true, path: tokenPath() };
+}
+async function persistBaseUrl(baseUrl) {
+  const path = configPath();
+  let existing = {};
+  if ((0, import_node_fs.existsSync)(path)) {
+    const raw = await (0, import_promises.readFile)(path, "utf8");
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error(`Wave config file must contain a JSON object: ${path}`);
+    }
+    existing = parsed;
+  }
+  await (0, import_promises.mkdir)((0, import_node_path.dirname)(path), { recursive: true, mode: 448 });
+  await (0, import_promises.writeFile)(path, `${JSON.stringify({ ...existing, baseUrl }, null, 2)}
+`, {
+    mode: 384
+  });
+  await (0, import_promises.chmod)(path, 384);
+  return path;
+}
+async function removeStoredToken(baseUrl) {
+  const removedKeychain = await deleteKeychainToken(baseUrl);
+  const removedFile = await deleteFileToken();
+  return removedKeychain || removedFile;
+}
+async function getAuthStorageInfo(baseUrl) {
+  const mode = await preferredStorage();
+  if (mode === "disabled") return { kind: "disabled", available: false };
+  if (mode === "keychain") {
+    return {
+      kind: "keychain",
+      available: true,
+      service: KEYCHAIN_SERVICE,
+      account: accountForBaseUrl(baseUrl)
+    };
+  }
+  const path = tokenPath();
+  let available = true;
+  if ((0, import_node_fs.existsSync)(path)) {
+    try {
+      const modeBits = (await (0, import_promises.stat)(path)).mode & 511;
+      available = modeBits === 384;
+    } catch {
+      available = false;
+    }
+  }
+  return { kind: "file", available, path };
+}
+
 // src/commands/tasks.ts
 var import_zod3 = require("zod");
 
@@ -192,7 +411,7 @@ var ATLAS_LEDGER_VARIABLE_TYPES = {
 };
 var SECRET_KEY_PATTERN = /(authorization|password|passwd|secret|token|jwt|credential|api[_-]?key)/i;
 var MAX_EVIDENCE_DEPTH = 5;
-function normalize(raw) {
+function normalize2(raw) {
   if (typeof raw !== "string") {
     return void 0;
   }
@@ -200,12 +419,12 @@ function normalize(raw) {
   return trimmed.length > 0 ? trimmed : void 0;
 }
 function atlasContextFromConfig(config) {
-  const organizationId = normalize(config.organizationId);
-  const memberId = normalize(config.atlasMemberId);
-  const chatId = normalize(config.atlasChatId);
-  const assistantMessageId = normalize(config.atlasAssistantMessageId);
-  const activeTool = normalize(config.atlasActiveTool);
-  const targetTool = normalize(config.atlasTargetTool);
+  const organizationId = normalize2(config.organizationId);
+  const memberId = normalize2(config.atlasMemberId);
+  const chatId = normalize2(config.atlasChatId);
+  const assistantMessageId = normalize2(config.atlasAssistantMessageId);
+  const activeTool = normalize2(config.atlasActiveTool);
+  const targetTool = normalize2(config.atlasTargetTool);
   if (!organizationId || !memberId || !chatId || !assistantMessageId || !activeTool || !targetTool) {
     return null;
   }
@@ -216,8 +435,8 @@ function atlasContextFromConfig(config) {
     assistantMessageId,
     activeTool,
     targetTool,
-    routeReason: normalize(config.atlasRouteReason),
-    actionId: normalize(config.atlasActionId)
+    routeReason: normalize2(config.atlasRouteReason),
+    actionId: normalize2(config.atlasActionId)
   };
 }
 function summarizeVariableShape(value, key = void 0, depth = 0) {
@@ -253,7 +472,7 @@ function shouldReportAtlasActionLedgerEvent(input) {
   return input.operationType === "mutation" && input.field !== ATLAS_LEDGER_FIELD;
 }
 function deterministicAtlasActionId(input, config) {
-  const requestSegment = normalize(config.requestId) ? `:${config.requestId}` : "";
+  const requestSegment = normalize2(config.requestId) ? `:${config.requestId}` : "";
   return `cli:${input.command}:${input.field}${requestSegment}`;
 }
 function buildAtlasEvidenceRefs(params) {
@@ -584,118 +803,6 @@ function buildSparse422Diagnostic(input) {
     }
   };
 }
-function isFeedbackCreateCommand(input) {
-  return input.operationType === "mutation" && input.command === "feedbacks.create";
-}
-function asRecord(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    return null;
-  }
-  return value;
-}
-function asNonEmptyString(value) {
-  if (typeof value !== "string") {
-    return null;
-  }
-  const trimmed = value.trim();
-  return trimmed.length > 0 ? trimmed : null;
-}
-function extractFeedbackIdentity(variables) {
-  const organizationId = asNonEmptyString(variables.organization_id) ?? asNonEmptyString(variables.organizationId);
-  const params = asRecord(variables.params);
-  const feedback = params ? asRecord(params.feedback) : null;
-  const name = feedback ? asNonEmptyString(feedback.name) : null;
-  const quarter = feedback ? asNonEmptyString(feedback.quarter) : null;
-  const year = feedback ? asNonEmptyString(feedback.year) : null;
-  if (!organizationId || !name || !quarter || !year) {
-    return null;
-  }
-  return {
-    organizationId,
-    name,
-    quarter,
-    year
-  };
-}
-function collectMessageStrings(value) {
-  if (typeof value === "string") {
-    return [value];
-  }
-  if (Array.isArray(value)) {
-    return value.flatMap((entry2) => collectMessageStrings(entry2));
-  }
-  if (!value || typeof value !== "object") {
-    return [];
-  }
-  return Object.values(value).flatMap(
-    (entry2) => collectMessageStrings(entry2)
-  );
-}
-function isDuplicateFeedbackMutationError(mutationPayload) {
-  const messages = collectMessageStrings(mutationPayload.errors);
-  return messages.some(
-    (message) => message.toLowerCase().includes("already been taken")
-  );
-}
-function extractFeedbackListNode(graph) {
-  const data = asRecord(graph.data);
-  const feedbacks = data ? asRecord(data.feedbacks) : null;
-  if (!feedbacks) {
-    return null;
-  }
-  const rows = Array.isArray(feedbacks.data) ? feedbacks.data : [];
-  const first = rows.find((entry2) => asRecord(entry2));
-  return first ? first : null;
-}
-function buildFeedbackReuseEnvelope(params) {
-  return {
-    envelope: buildEnvelope({
-      ok: true,
-      command: params.command,
-      status: params.status,
-      data: {
-        [params.field]: {
-          ok: true,
-          status: params.status,
-          errorCode: null,
-          data: {
-            data: params.feedbackNode
-          },
-          errors: null,
-          reusedExisting: true,
-          idempotency: {
-            reason: params.reason
-          }
-        }
-      },
-      error: null,
-      requestId: params.requestId
-    }),
-    exitCode: EXIT_CODES.success
-  };
-}
-function buildFeedbackFindRequestBody(command, identity) {
-  return buildGraphqlBody({
-    config: {
-      baseUrl: "http://localhost",
-      token: "placeholder",
-      timeoutMs: 1e3,
-      debug: false
-    },
-    command,
-    operationType: "query",
-    field: "feedbacks",
-    variables: {
-      organization_id: identity.organizationId,
-      name: identity.name,
-      quarter: identity.quarter,
-      year: identity.year,
-      page: 1,
-      per: 1
-    },
-    selectionSet: "{ data { id type attributes { id name slug year quarter organizationId memberIds } } count currentPage totalPages }"
-  });
-}
 async function requestGraphqlHttp(params) {
   const response = await fetch(params.url, {
     method: "POST",
@@ -787,29 +894,6 @@ async function finalizeGraphqlResult(input, url, result) {
   }
   return result;
 }
-async function findExistingFeedback(params) {
-  const command = `${params.input.command}.find-existing`;
-  const body = buildFeedbackFindRequestBody(command, params.identity);
-  const http = await requestGraphqlHttp({
-    input: params.input,
-    url: params.url,
-    requestId: params.requestId,
-    body,
-    controller: params.controller
-  });
-  const gqlErrors = http.graph.errors;
-  if (Array.isArray(gqlErrors) && gqlErrors.length > 0) {
-    return null;
-  }
-  const feedbackNode = extractFeedbackListNode(http.graph);
-  if (!feedbackNode) {
-    return null;
-  }
-  return {
-    feedbackNode,
-    requestId: http.requestId
-  };
-}
 function graphqlTypeForValue(value) {
   if (Array.isArray(value)) {
     const firstNonNull = value.find((item) => item !== null && item !== void 0);
@@ -909,32 +993,6 @@ async function graphqlRequest(input) {
   const controller = new AbortController();
   const timeoutId = setTimeout(() => controller.abort(), input.config.timeoutMs);
   try {
-    if (isFeedbackCreateCommand(input)) {
-      const feedbackIdentity = extractFeedbackIdentity(input.variables);
-      if (feedbackIdentity) {
-        const existing = await findExistingFeedback({
-          input,
-          url,
-          requestId,
-          controller,
-          identity: feedbackIdentity
-        });
-        if (existing) {
-          return finalizeGraphqlResult(
-            input,
-            url,
-            buildFeedbackReuseEnvelope({
-              command: input.command,
-              field: input.field,
-              status: 200,
-              requestId: existing.requestId,
-              feedbackNode: existing.feedbackNode,
-              reason: "preexisting"
-            })
-          );
-        }
-      }
-    }
     const http = await requestGraphqlHttpWithRetry({
       input,
       url,
@@ -979,32 +1037,6 @@ async function graphqlRequest(input) {
       const ok = Boolean(mutationPayload.ok);
       const status = typeof mutationPayload.status === "number" ? mutationPayload.status : ok ? 200 : 400;
       if (!ok) {
-        if (isFeedbackCreateCommand(input) && isDuplicateFeedbackMutationError(mutationPayload)) {
-          const feedbackIdentity = extractFeedbackIdentity(input.variables);
-          if (feedbackIdentity) {
-            const existing = await findExistingFeedback({
-              input,
-              url,
-              requestId: responseRequestId,
-              controller,
-              identity: feedbackIdentity
-            });
-            if (existing) {
-              return finalizeGraphqlResult(
-                input,
-                url,
-                buildFeedbackReuseEnvelope({
-                  command: input.command,
-                  field: input.field,
-                  status: 200,
-                  requestId: existing.requestId,
-                  feedbackNode: existing.feedbackNode,
-                  reason: "duplicate_race"
-                })
-              );
-            }
-          }
-        }
         const mutationErrors = mutationPayload.errors ?? null;
         const details = {
           errors: mutationErrors,
@@ -1094,7 +1126,7 @@ async function graphqlRequest(input) {
 }
 
 // src/output.ts
-var import_node_fs = require("fs");
+var import_node_fs2 = require("fs");
 var RETRYABLE_WRITE_CODES = /* @__PURE__ */ new Set(["EAGAIN", "EINTR"]);
 var RETRY_BACKOFF_MS = 1;
 var EnvelopeEmittedSignal = class extends Error {
@@ -1113,7 +1145,7 @@ function writeStdoutFully(text) {
   let offset = 0;
   while (offset < buffer.length) {
     try {
-      const bytesWritten = (0, import_node_fs.writeSync)(fd, buffer, offset, buffer.length - offset);
+      const bytesWritten = (0, import_node_fs2.writeSync)(fd, buffer, offset, buffer.length - offset);
       if (bytesWritten <= 0) {
         sleepBriefly(RETRY_BACKOFF_MS);
         continue;
@@ -1165,6 +1197,8 @@ var RESOURCE_QUERY_FIELDS = {
     "archivedAt",
     "organizationId",
     "memberId",
+    "member",
+    "assignee",
     "creatorId",
     "projectId",
     "projectSlug",
@@ -1212,6 +1246,7 @@ var RESOURCE_QUERY_FIELDS = {
     "role",
     "status",
     "title",
+    "rolePurpose",
     "firstName",
     "lastName",
     "createdAt",
@@ -1457,14 +1492,6 @@ var RESOURCE_QUERY_FIELDS = {
     "acceptedAnswerIds",
     "labelIds"
   ],
-  feedback: [
-    "name",
-    "slug",
-    "year",
-    "quarter",
-    "organizationId",
-    "memberIds"
-  ],
   survey: [
     "name",
     "slug",
@@ -1626,7 +1653,6 @@ var RESOURCE_FIELD_ALIASES = {
   stand_ups: "stand_up",
   headlines: "headline",
   questions: "question",
-  feedbacks: "feedback",
   surveys: "survey",
   responsibilities: "responsibility",
   smart_kpi_views: "smart_kpi_view",
@@ -1662,7 +1688,8 @@ function defaultQuerySelectionSet(field, isList) {
   const canonicalField = RESOURCE_FIELD_ALIASES[field] ?? field;
   const explicitFields = RESOURCE_QUERY_FIELDS[canonicalField];
   if (explicitFields) {
-    const attributes = explicitFields.length > 0 ? `attributes { ${Array.from(/* @__PURE__ */ new Set(["id", ...explicitFields])).join(" ")} }` : "attributes";
+    const detailFields = canonicalField === "smart_kpi" && !isList ? ["smartKpiMetrics { id date value }", "smartKpiGoals { id date value }"] : [];
+    const attributes = explicitFields.length > 0 ? `attributes { ${Array.from(/* @__PURE__ */ new Set(["id", ...explicitFields, ...detailFields])).join(" ")} }` : "attributes";
     if (isList) {
       return `{ data { id type ${attributes} } count currentPage totalPages }`;
     }
@@ -1881,213 +1908,6 @@ var import_node_fs3 = require("fs");
 var import_promises2 = require("fs/promises");
 var import_node_path2 = require("path");
 
-// src/authStorage.ts
-var import_node_child_process = require("child_process");
-var import_node_fs2 = require("fs");
-var import_promises = require("fs/promises");
-var import_node_os = require("os");
-var import_node_path = require("path");
-var import_node_util = require("util");
-var execFileAsync = (0, import_node_util.promisify)(import_node_child_process.execFile);
-var KEYCHAIN_SERVICE = "wave-cli";
-var FILE_NAME = "auth-token.json";
-function normalize2(raw) {
-  if (typeof raw !== "string") return void 0;
-  const trimmed = raw.trim();
-  return trimmed.length > 0 ? trimmed : void 0;
-}
-function authHome(env = process.env) {
-  return normalize2(env.WAVE_CLI_HOME) ?? (0, import_node_path.join)((0, import_node_os.homedir)(), ".wave");
-}
-function tokenPath(env = process.env) {
-  return (0, import_node_path.join)(authHome(env), FILE_NAME);
-}
-function configPath(env = process.env) {
-  return normalize2(env.WAVE_CONFIG_PATH) ?? (0, import_node_path.join)(authHome(env), "config.json");
-}
-function storageMode(env = process.env) {
-  const raw = normalize2(env.WAVE_CLI_AUTH_STORAGE)?.toLowerCase();
-  if (raw === "keychain" || raw === "file" || raw === "disabled") return raw;
-  return "auto";
-}
-function accountForBaseUrl(baseUrl) {
-  return normalize2(baseUrl) ?? "default";
-}
-async function commandExists(command) {
-  try {
-    await (0, import_promises.access)(command, import_node_fs2.constants.X_OK);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function keychainAvailable(env = process.env) {
-  if (process.platform !== "darwin") return false;
-  if (storageMode(env) === "file" || storageMode(env) === "disabled") return false;
-  return commandExists("/usr/bin/security");
-}
-async function preferredStorage(env = process.env) {
-  const mode = storageMode(env);
-  if (mode === "disabled") return "disabled";
-  if (mode === "file") return "file";
-  if (mode === "keychain") return await keychainAvailable(env) ? "keychain" : "file";
-  return await keychainAvailable(env) ? "keychain" : "file";
-}
-async function readKeychainToken(baseUrl) {
-  try {
-    const { stdout } = await execFileAsync("/usr/bin/security", [
-      "find-generic-password",
-      "-a",
-      accountForBaseUrl(baseUrl),
-      "-s",
-      KEYCHAIN_SERVICE,
-      "-w"
-    ], { encoding: "utf8" });
-    return normalize2(String(stdout)) ?? null;
-  } catch {
-    return null;
-  }
-}
-async function writeKeychainToken(token, baseUrl) {
-  await execFileAsync("/usr/bin/security", [
-    "add-generic-password",
-    "-a",
-    accountForBaseUrl(baseUrl),
-    "-s",
-    KEYCHAIN_SERVICE,
-    "-w",
-    token,
-    "-U"
-  ]);
-}
-async function deleteKeychainToken(baseUrl) {
-  try {
-    await execFileAsync("/usr/bin/security", [
-      "delete-generic-password",
-      "-a",
-      accountForBaseUrl(baseUrl),
-      "-s",
-      KEYCHAIN_SERVICE
-    ]);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function readFileToken(baseUrl, env = process.env) {
-  const path = tokenPath(env);
-  if (!(0, import_node_fs2.existsSync)(path)) return null;
-  try {
-    const raw = await (0, import_promises.readFile)(path, "utf8");
-    const payload = JSON.parse(raw);
-    const token = normalize2(payload.token);
-    const storedBaseUrl = normalize2(payload.baseUrl);
-    const requestedBaseUrl = normalize2(baseUrl);
-    if (!token) return null;
-    if (storedBaseUrl !== requestedBaseUrl) return null;
-    return token;
-  } catch {
-    return null;
-  }
-}
-async function writeFileToken(token, baseUrl, env = process.env) {
-  const home = authHome(env);
-  const path = tokenPath(env);
-  await (0, import_promises.mkdir)(home, { recursive: true, mode: 448 });
-  await (0, import_promises.writeFile)(
-    path,
-    `${JSON.stringify({ token, baseUrl: baseUrl ?? null, updatedAt: (/* @__PURE__ */ new Date()).toISOString() })}
-`,
-    { mode: 384 }
-  );
-  await (0, import_promises.chmod)(path, 384);
-}
-async function deleteFileToken(env = process.env) {
-  const path = tokenPath(env);
-  if (!(0, import_node_fs2.existsSync)(path)) return false;
-  await (0, import_promises.rm)(path, { force: true });
-  return true;
-}
-async function readStoredToken(baseUrl) {
-  const mode = await preferredStorage();
-  if (mode === "disabled") return null;
-  if (mode === "keychain") {
-    const keychainToken = await readKeychainToken(baseUrl);
-    if (keychainToken) return { token: keychainToken, source: "keychain" };
-  }
-  const fileToken = await readFileToken(baseUrl);
-  return fileToken ? { token: fileToken, source: "file" } : null;
-}
-async function writeStoredToken(token, baseUrl) {
-  const mode = await preferredStorage();
-  if (mode === "disabled") {
-    return { kind: "disabled", available: false };
-  }
-  if (mode === "keychain") {
-    try {
-      await writeKeychainToken(token, baseUrl);
-      return {
-        kind: "keychain",
-        available: true,
-        service: KEYCHAIN_SERVICE,
-        account: accountForBaseUrl(baseUrl)
-      };
-    } catch {
-      await writeFileToken(token, baseUrl);
-      return { kind: "file", available: true, path: tokenPath() };
-    }
-  }
-  await writeFileToken(token, baseUrl);
-  return { kind: "file", available: true, path: tokenPath() };
-}
-async function persistBaseUrl(baseUrl, env = process.env) {
-  const path = configPath(env);
-  let existing = {};
-  if ((0, import_node_fs2.existsSync)(path)) {
-    const raw = await (0, import_promises.readFile)(path, "utf8");
-    const parsed = JSON.parse(raw);
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-      throw new Error(`Wave config file must contain a JSON object: ${path}`);
-    }
-    existing = parsed;
-  }
-  await (0, import_promises.mkdir)((0, import_node_path.dirname)(path), { recursive: true, mode: 448 });
-  await (0, import_promises.writeFile)(path, `${JSON.stringify({ ...existing, baseUrl }, null, 2)}
-`, {
-    mode: 384
-  });
-  await (0, import_promises.chmod)(path, 384);
-  return path;
-}
-async function removeStoredToken(baseUrl) {
-  const removedKeychain = await deleteKeychainToken(baseUrl);
-  const removedFile = await deleteFileToken();
-  return removedKeychain || removedFile;
-}
-async function getAuthStorageInfo(baseUrl) {
-  const mode = await preferredStorage();
-  if (mode === "disabled") return { kind: "disabled", available: false };
-  if (mode === "keychain") {
-    return {
-      kind: "keychain",
-      available: true,
-      service: KEYCHAIN_SERVICE,
-      account: accountForBaseUrl(baseUrl)
-    };
-  }
-  const path = tokenPath();
-  let available = true;
-  if ((0, import_node_fs2.existsSync)(path)) {
-    try {
-      const modeBits = (await (0, import_promises.stat)(path)).mode & 511;
-      available = modeBits === 384;
-    } catch {
-      available = false;
-    }
-  }
-  return { kind: "file", available, path };
-}
-
 // src/authClient.ts
 var import_node_crypto2 = require("crypto");
 
@@ -2534,17 +2354,15 @@ async function resolveWithAuthenticatedOrganization(context) {
   if (organizationId) resolved.organizationId = organizationId;
   return resolved;
 }
-function defaultConfigPath(env) {
-  const explicitEnv = normalize3(env.WAVE_CONFIG_PATH);
-  if (explicitEnv) return explicitEnv;
-  const candidate = (0, import_node_path2.join)(authHome(env), "config.json");
+function defaultConfigPath() {
+  const candidate = (0, import_node_path2.join)(authHome(), "config.json");
   return (0, import_node_fs3.existsSync)(candidate) ? candidate : void 0;
 }
 async function resolveConfigFileContext(options, env) {
   const path = firstDefined(
     normalize3(options.configPath),
     normalize3(options.config),
-    defaultConfigPath(env)
+    defaultConfigPath()
   );
   if (!path) return {};
   if (!(0, import_node_fs3.existsSync)(path)) {
@@ -2689,13 +2507,13 @@ function parseRequiredOption(raw, flag) {
 function optionKey(flag) {
   return flag.replace(/-([a-z])/g, (_, char) => char.toUpperCase());
 }
-function asRecord2(value) {
+function asRecord(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function visibleSearchText(row) {
-  const record = asRecord2(row);
+  const record = asRecord(row);
   if (!record) return "";
-  const attributes = asRecord2(record.attributes);
+  const attributes = asRecord(record.attributes);
   const values = [];
   for (const field of SEARCHABLE_VISIBLE_FIELDS) {
     const topLevelValue = record[field];
@@ -2709,7 +2527,7 @@ function matchesSearchQuery(row, query) {
   return visibleSearchText(row).includes(query.toLowerCase());
 }
 function filterListEnvelopeByQuery(payload, query) {
-  const record = asRecord2(payload);
+  const record = asRecord(payload);
   if (!record || !Array.isArray(record.data)) return payload;
   const filteredData = record.data.filter((row) => matchesSearchQuery(row, query));
   return {
@@ -3636,9 +3454,65 @@ var subitemUpdateContract = {
   rootKey: "subitem",
   fields: subitemFields
 };
+var reminderFields = {
+  title: { type: "string", example: "Follow up with customer" },
+  description: { type: "string" },
+  due_at: { type: "string" },
+  starts_at: { type: "string" },
+  timezone: { type: "string", example: "America/Phoenix" },
+  schedule: {
+    type: "object",
+    example: { type: "once", due_at: "2026-09-01T09:00:00-07:00" }
+  },
+  notification: {
+    type: "object",
+    example: { channels: ["in_app"], lead_minutes: 15 }
+  },
+  resources_attributes: { type: "array" },
+  reminder_delegates_attributes: { type: "array" }
+};
+var reminderCreateContract = {
+  rootKey: "reminder",
+  fields: reminderFields,
+  required: ["title", "schedule", "notification"],
+  additionalProperties: false
+};
+var reminderUpdateContract = {
+  rootKey: "reminder",
+  fields: reminderFields,
+  additionalProperties: false
+};
+var sketchFields = {
+  name: { type: "string" },
+  creation_key: { type: "string" },
+  member_id: { type: "string" },
+  teams_ids: { type: "array", items: { type: "string" } },
+  status: {
+    type: "string",
+    enum: ["backlog", "planned", "in_progress", "completed", "cancelled", "ready_for_qa", "blocked"]
+  },
+  priority: { type: "string", enum: PRIORITIES }
+};
+var sketchCreateContract = {
+  rootKey: "sketch",
+  fields: sketchFields,
+  required: ["name", "teams_ids", "creation_key"],
+  additionalProperties: false
+};
+var sketchMetadataUpdateContract = {
+  rootKey: "sketch",
+  fields: Object.fromEntries(
+    Object.entries(sketchFields).filter(([field]) => field !== "creation_key")
+  ),
+  additionalProperties: false
+};
 var CONTRACTS = {
   "list-items.create": listItemCreateContract,
   "list-items.update": listItemUpdateContract,
+  "reminders.create": reminderCreateContract,
+  "reminders.update": reminderUpdateContract,
+  "sketches.create": sketchCreateContract,
+  "sketches.update-metadata": sketchMetadataUpdateContract,
   "subitems.create": subitemCreateContract,
   "subitems.update": subitemUpdateContract
 };
@@ -3710,8 +3584,10 @@ function validateOperationDataJson(operationId2, value) {
   const missing = (contract.required ?? []).filter(
     (field) => entity[field] === void 0 || entity[field] === null || entity[field] === ""
   );
+  const unsupported = contract.additionalProperties === false ? Object.keys(entity).filter((field) => !Object.prototype.hasOwnProperty.call(contract.fields, field)) : [];
   return [
     ...missing.map((field) => `${contract.rootKey}.${field} is required.`),
+    ...unsupported.map((field) => `${contract.rootKey}.${field} is not permitted.`),
     ...validateFields(contract.fields, entity, [contract.rootKey])
   ].map(
     (error) => `Invalid input value for dataJson: ${error}`
@@ -3755,14 +3631,25 @@ function entitySchema(contract) {
       ])
     ),
     ...contract.required ? { required: [...contract.required] } : {},
-    additionalProperties: true
+    additionalProperties: contract.additionalProperties ?? true
   };
 }
+function exampleValue2(contract) {
+  if (contract.example !== void 0) return contract.example;
+  if (contract.type === "array") return [];
+  if (contract.type === "object") return {};
+  if (contract.type === "number") return 0;
+  if (contract.type === "boolean") return false;
+  return "example";
+}
 function exampleDataJsonForOperation(operationId2) {
   const contract = CONTRACTS[operationId2];
   if (!contract) return null;
   const entity = Object.fromEntries(
-    (contract.required ?? []).map((field) => [field, "example"])
+    (contract.required ?? []).map((field) => {
+      const fieldContract = contract.fields[field];
+      return [field, fieldContract ? exampleValue2(fieldContract) : "example"];
+    })
   );
   return { [contract.rootKey]: entity };
 }
@@ -3868,7 +3755,7 @@ function registerEntityCrudCommands(program, config) {
   const entityCommand = program.command(config.command).description(config.description);
   const createHelp4 = buildDataJsonHelp(config.rootKey, "create") ?? "JSON object, optionally wrapped with root key";
   const updateHelp5 = buildDataJsonHelp(config.rootKey, "update") ?? "JSON object, optionally wrapped with root key";
-  const listField2 = config.listField ?? (config.resourcePath === "feedback" ? "feedbacks" : config.resourcePath);
+  const listField2 = config.listField ?? config.resourcePath;
   const list = entityCommand.command("list").option("--page <page>").option("--per <per>");
   const listParams = config.listParams ?? [];
   const listParamHelp = config.listParamHelp ?? {};
@@ -3908,12 +3795,14 @@ function registerEntityCrudCommands(program, config) {
       isList: true
     });
   });
-  registerGraphqlSearchCommand(entityCommand, {
-    command: config.command,
-    field: listField2,
-    variableTypes: config.listVariableTypes,
-    selectionSet: config.listSelectionSet
-  });
+  if (config.registerSearch !== false) {
+    registerGraphqlSearchCommand(entityCommand, {
+      command: config.command,
+      field: listField2,
+      variableTypes: config.listVariableTypes,
+      selectionSet: config.listSelectionSet
+    });
+  }
   const show = entityCommand.command("show").requiredOption("--id <id>");
   showParams.forEach((param) => {
     const cliParam = param.replace(/_/g, "-");
@@ -3924,7 +3813,7 @@ function registerEntityCrudCommands(program, config) {
     const context = await resolveCommandContext(cmd.optsWithGlobals());
     const organizationId = resolveOrganizationId(context.organizationId);
     const defaultCommand = `${config.command}.show`;
-    const defaultField = config.showField ?? (config.resourcePath === "feedback" ? "feedback" : toSingularResourceName(config.resourcePath));
+    const defaultField = config.showField ?? toSingularResourceName(config.resourcePath);
     const mappedShowParams = Object.fromEntries(
       showParams.map((param) => {
         const optionKey2 = param.replace(/_([a-z])/g, (_, char) => char.toUpperCase());
@@ -4008,6 +3897,22 @@ function registerEntityCrudCommands(program, config) {
       }
     });
   });
+  for (const mutation of config.idMutationCommands ?? []) {
+    entityCommand.command(mutation.command).description(mutation.description).requiredOption("--id <id>").action(async (opts, cmd) => {
+      const id = idSchema2.parse(opts.id);
+      const context = await resolveCommandContext(cmd.optsWithGlobals());
+      const organizationId = resolveOrganizationId(context.organizationId);
+      await runGraphqlMutationCommand({
+        command: `${config.command}.${mutation.command}`,
+        runtimeOptions: context.runtimeOptions,
+        field: mutation.field,
+        variables: {
+          organization_id: organizationId,
+          [mutation.idVariable]: id
+        }
+      });
+    });
+  }
 }
 var __testables = {
   toSingularResourceName,
@@ -4038,13 +3943,13 @@ var projectPriorityValues = projectPrioritySchema.options.join(", ");
 var projectCreateDataJsonHelp = buildDataJsonHelp("project", "create") ?? 'JSON object for project or {"project": {...}}';
 var projectUpdateDataJsonHelp = buildDataJsonHelp("project", "update") ?? 'JSON object for project or {"project": {...}}';
 function projectsIndexMinimalSelectionSet(includeProjectTypes = false) {
-  return `{ count currentPage totalPages data { id type attributes { name slug status priority${includeProjectTypes ? " projectType" : ""} } } }`;
+  return `{ count currentPage totalPages data { id type attributes { name slug status priority createdAt updatedAt${includeProjectTypes ? " projectType" : ""} } } }`;
 }
 var displayPreferenceAttributesSelectionSet = "attributes { id viewType favorite groupingField groupToggleState memberId focusMemberId focusTeamId displayableId displayableType preferenceType agendaItemId }";
 var filterPreferenceAttributesSelectionSet = "attributes { id filterType filter memberId focusMemberId focusTeamId filterableId filterableType preferenceType agendaItemId }";
 var healthUpdateSummarySelectionSet = "id type value memberId status createdAt updatedAt updatableType updatableId parentUpdateId emojis { id name memberId } resources { ...ResourceSummaryFull }";
 var projectShowFullSelectionSet = `{ id type name slug description status priority createdAt updatedAt startDate targetDate archivedAt memberId organizationId teamIds emoji { id name memberId } backgroundImage { backgroundType gradientStart gradientEnd gradientDegrees color imageUrl image { url lowUrl } } favorites { id memberId } resources { ...ResourceSummaryFull } displayPreference { id type ${displayPreferenceAttributesSelectionSet} viewType favorite groupingField groupToggleState memberId focusMemberId focusTeamId displayableId displayableType preferenceType agendaItemId } filterPreferences { id type ${filterPreferenceAttributesSelectionSet} filterType filter memberId focusMemberId focusTeamId filterableId filterableType preferenceType agendaItemId } healthUpdates { ${healthUpdateSummarySelectionSet} replies { ${healthUpdateSummarySelectionSet} replies { id type } } } } fragment ResourceSummaryFull on ResourceSummary { id resourceType slug url skillId skill { id name slug emoji scope description } metadata { urlName imageUrl siteName providerName mediaType skillId skillName skillSlug skillScope skillEmoji skillDescription } attachment { id fileKey filename url } content { id name slug type firstChildSlug childCount } }`;
-function asRecord3(value) {
+function asRecord2(value) {
   return value && typeof value === "object" ? value : null;
 }
 function toNonEmptyString(value) {
@@ -4077,9 +3982,9 @@ function parseProjectPriority(value) {
   return parsed.data.toUpperCase();
 }
 function normalizeProjectRowForDisplay(row) {
-  const record = asRecord3(row);
+  const record = asRecord2(row);
   if (!record) return row;
-  const attributes = asRecord3(record.attributes);
+  const attributes = asRecord2(record.attributes);
   const topLevelName = toNonEmptyString(record.name);
   const topLevelTitle = toNonEmptyString(record.title);
   const attributeName = toNonEmptyString(attributes?.name);
@@ -4094,7 +3999,7 @@ function normalizeProjectRowForDisplay(row) {
   };
 }
 function normalizeProjectsListForDisplay(payload) {
-  const record = asRecord3(payload);
+  const record = asRecord2(payload);
   if (!record || !Array.isArray(record.data)) return payload;
   return {
     ...record,
@@ -4312,7 +4217,7 @@ var MEETING_STATUSES = /* @__PURE__ */ new Set(["upcoming", "active", "completed
 var MEETING_REPEATS = /* @__PURE__ */ new Set(["never", "weekly", "biweekly", "monthly", "quarterly"]);
 var createHelp2 = buildDataJsonHelp("meeting", "create") ?? 'JSON object for meeting or {"meeting": {...}}';
 var updateHelp2 = buildDataJsonHelp("meeting", "update") ?? 'JSON object for meeting or {"meeting": {...}}';
-function asNonEmptyString2(value) {
+function asNonEmptyString(value) {
   if (typeof value !== "string") {
     return void 0;
   }
@@ -4370,7 +4275,7 @@ function normalizeMeetingCreateBody(body) {
     });
   }
   const meeting = { ...entity };
-  const type = asNonEmptyString2(meeting.type);
+  const type = asNonEmptyString(meeting.type);
   if (!type || !MEETING_TYPES.has(type)) {
     throw new CliError({
       message: "Invalid meeting.type. Use one of: TeamMeeting, OneOnOneMeeting.",
@@ -4380,8 +4285,8 @@ function normalizeMeetingCreateBody(body) {
       details: { field: "meeting.type", allowed: Array.from(MEETING_TYPES) }
     });
   }
-  const memberId = asNonEmptyString2(meeting.member_id);
-  const date = asNonEmptyString2(meeting.date);
+  const memberId = asNonEmptyString(meeting.member_id);
+  const date = asNonEmptyString(meeting.date);
   const startTime = toFiniteNumber(meeting.start_time, "meeting.start_time");
   const missingRequired = [];
   if (!memberId) missingRequired.push("member_id");
@@ -4396,7 +4301,7 @@ function normalizeMeetingCreateBody(body) {
       details: { requiredFields: ["member_id", "date", "start_time"], rootKey: "meeting" }
     });
   }
-  const status = asNonEmptyString2(meeting.status);
+  const status = asNonEmptyString(meeting.status);
   if (status && !MEETING_STATUSES.has(status)) {
     throw new CliError({
       message: "Invalid meeting.status. Use one of: upcoming, active, completed.",
@@ -4406,7 +4311,7 @@ function normalizeMeetingCreateBody(body) {
       details: { field: "meeting.status", allowed: Array.from(MEETING_STATUSES) }
     });
   }
-  const repeats = asNonEmptyString2(meeting.repeats) ?? "never";
+  const repeats = asNonEmptyString(meeting.repeats) ?? "never";
   if (!MEETING_REPEATS.has(repeats)) {
     throw new CliError({
       message: "Invalid meeting.repeats. Use one of: never, weekly, biweekly, monthly, quarterly.",
@@ -4485,6 +4390,22 @@ function registerMeetingCommands(program) {
       isShow: true
     });
   });
+  meetings.command("note-show").description("Read the authorized AI note context for a meeting").requiredOption("--id <id>").action(async (opts, cmd) => {
+    const meetingId = idSchema5.parse(opts.id);
+    const context = await resolveCommandContext(cmd.optsWithGlobals());
+    const organizationId = resolveOrganizationId(context.organizationId);
+    await runGraphqlQueryCommand({
+      command: "meetings.note-show",
+      runtimeOptions: context.runtimeOptions,
+      field: "meeting_note_by_meeting",
+      variables: {
+        organization_id: organizationId,
+        meeting_id: meetingId
+      },
+      selectionSet: "{ answerContext }",
+      isShow: true
+    });
+  });
   meetings.command("notes").requiredOption("--id <id>").requiredOption("--content <content>").action(async (opts, cmd) => {
     const id = idSchema5.parse(opts.id);
     const notes = notesSchema.parse(opts.content);
@@ -4540,10 +4461,25 @@ function registerMeetingCommands(program) {
 
 // src/commands/members.ts
 var import_zod8 = require("zod");
-var idSchema6 = import_zod8.z.string().min(1);
+var idSchema6 = import_zod8.z.string().trim().min(1);
 var createHelp3 = buildDataJsonHelp("member", "create") ?? 'JSON object for member or {"member": {...}}';
 var updateHelp3 = buildDataJsonHelp("member", "update") ?? 'JSON object for member or {"member": {...}}';
 var MEMBER_META_PROFILE_SELECTION = "{ id type memberId summary profile attributes { id memberId summary profile } }";
+var MEMBER_REFERENCE_RESOLUTION_SELECTION = `{
+  status
+  reasonCode
+  organizationId
+  reference
+  eligibilityPolicy
+  complete
+  source
+  asOf
+  traceId
+  receiptId
+  memberId
+  memberName
+  candidates { memberId memberName status eligible }
+}`;
 function parseStrictBooleanOption(value, optionName) {
   if (typeof value === "boolean") {
     return value;
@@ -4600,6 +4536,29 @@ function registerMemberCommands(program) {
     command: "members",
     field: "members"
   });
+  members.command("resolve").description("Resolve a member reference within the authenticated organization").requiredOption("--query <query>", "Member name or email reference").action(async (opts, cmd) => {
+    const reference = idSchema6.parse(opts.query);
+    const context = await resolveCommandContext(cmd.optsWithGlobals());
+    const organizationId = resolveOrganizationId(context.organizationId);
+    await runGraphqlQueryCommand({
+      command: "members.resolve",
+      runtimeOptions: context.runtimeOptions,
+      operationName: "MemberReferenceResolution",
+      field: "member_reference_resolution",
+      variables: normalizeGraphqlVariables2({
+        organization_id: organizationId,
+        reference,
+        trace_id: context.runtimeOptions.requestId
+      }),
+      variableTypes: {
+        organization_id: "ID!",
+        reference: "String!",
+        trace_id: "String"
+      },
+      selectionSet: MEMBER_REFERENCE_RESOLUTION_SELECTION,
+      isShow: true
+    });
+  });
   members.command("meta-profile").description("Read a member meta profile by member id").requiredOption("--member-id <memberId>", "Member id").requiredOption("--json", "Emit the stable JSON envelope").action(async (opts, cmd) => {
     const memberId = idSchema6.parse(opts.memberId);
     const context = await resolveCommandContext(cmd.optsWithGlobals());
@@ -4668,10 +4627,69 @@ function registerMemberCommands(program) {
   });
 }
 
-// src/commands/skills.ts
+// src/commands/resources.ts
 var import_zod9 = require("zod");
-var idSchema7 = import_zod9.z.string().min(1);
-var limitSchema = import_zod9.z.coerce.number().int().positive();
+var resourceTypeSchema = import_zod9.z.enum([
+  "project",
+  "team",
+  "agent",
+  "automation",
+  "file"
+]);
+var referenceSchema = import_zod9.z.string().trim().min(1);
+var RESOURCE_REFERENCE_RESOLUTION_SELECTION = `{
+  status
+  reasonCode
+  organizationId
+  resourceType
+  reference
+  eligibilityPolicy
+  complete
+  source
+  asOf
+  traceId
+  receiptId
+  resourceId
+  resourceName
+  candidates { resourceId resourceName resourceType status eligible }
+}`;
+function registerResourceCommands(program) {
+  const resources = program.command("resources").description("Organization-scoped resource resolution");
+  resources.command("resolve").description("Resolve a project, team, agent, automation, or file reference").requiredOption(
+    "--type <type>",
+    "Resource type: project, team, agent, automation, or file"
+  ).requiredOption("--query <query>", "Resource name or reference").action(async (opts, cmd) => {
+    const resourceType = resourceTypeSchema.parse(opts.type);
+    const reference = referenceSchema.parse(opts.query);
+    const context = await resolveCommandContext(cmd.optsWithGlobals());
+    const organizationId = resolveOrganizationId(context.organizationId);
+    await runGraphqlQueryCommand({
+      command: "resources.resolve",
+      runtimeOptions: context.runtimeOptions,
+      operationName: "OrganizationResourceReferenceResolution",
+      field: "organization_resource_reference_resolution",
+      variables: normalizeGraphqlVariables2({
+        organization_id: organizationId,
+        resource_type: resourceType,
+        reference,
+        trace_id: context.runtimeOptions.requestId
+      }),
+      variableTypes: {
+        organization_id: "ID!",
+        resource_type: "String!",
+        reference: "String!",
+        trace_id: "String"
+      },
+      selectionSet: RESOURCE_REFERENCE_RESOLUTION_SELECTION,
+      isShow: true
+    });
+  });
+}
+
+// src/commands/skills.ts
+var import_zod10 = require("zod");
+var idSchema7 = import_zod10.z.string().min(1);
+var limitSchema = import_zod10.z.coerce.number().int().positive();
 var SKILL_SELECTION = `{
   id
   type
@@ -4747,14 +4765,14 @@ function registerSkillCommands(program) {
 }
 
 // src/commands/issues.ts
-var import_zod10 = require("zod");
-var issueGroupIdSchema = import_zod10.z.string().min(1);
-var idSchema8 = import_zod10.z.string().min(1);
-var nameSchema = import_zod10.z.string().min(1);
-var issueTypeSchema = import_zod10.z.string().min(1).refine((value) => value === "short_term" || value === "long_term", {
+var import_zod11 = require("zod");
+var issueGroupIdSchema = import_zod11.z.string().min(1);
+var idSchema8 = import_zod11.z.string().min(1);
+var nameSchema = import_zod11.z.string().min(1);
+var issueTypeSchema = import_zod11.z.string().min(1).refine((value) => value === "short_term" || value === "long_term", {
   message: "Invalid issue type. Use one of: short_term, long_term."
 });
-var issueStatusSchema = import_zod10.z.string().min(1).refine((value) => value === "open" || value === "completed", {
+var issueStatusSchema = import_zod11.z.string().min(1).refine((value) => value === "open" || value === "completed", {
   message: "Invalid issue status. Use one of: open, completed."
 });
 var updateHelp4 = buildDataJsonHelp("issue", "update") ?? 'JSON object for issue or {"issue": {...}}';
@@ -5022,13 +5040,35 @@ var SMART_KPI_NAMES = [
 var SMART_KPI_NAME_SET = new Set(SMART_KPI_NAMES);
 
 // src/commands/systemTools.ts
+var REMINDER_ATTRIBUTES_SELECTION = `
+  id
+  organizationId
+  creatorId
+  title
+  description
+  dueAt
+  startsAt
+  timezone
+  schedule
+  notification
+  status
+  nextTriggerAt
+  lastTriggeredAt
+  clearedAt
+  reminderDelegates { id memberId organizationId }
+  delegateMembers { id email firstName lastName organizationId }
+  resources { id resourceType url creatorId attachment { id fileKey filename } }
+  createdAt
+  updatedAt
+`;
+var REMINDER_LIST_SELECTION = `{ data { id type attributes { ${REMINDER_ATTRIBUTES_SELECTION} } } count currentPage totalPages }`;
+var REMINDER_SHOW_SELECTION = `{ id type attributes { ${REMINDER_ATTRIBUTES_SELECTION} } }`;
 var TODO_STATUSES = /* @__PURE__ */ new Set(["open", "completed"]);
 var KNOWLEDGE_CONTENT_TYPES = /* @__PURE__ */ new Set(["company", "policy", "process"]);
 var KNOWLEDGE_STATUSES = /* @__PURE__ */ new Set(["draft", "published"]);
 var NEWS_STATUSES = /* @__PURE__ */ new Set(["active", "completed"]);
 var NEWS_HEADLINE_TYPES = /* @__PURE__ */ new Set(["team", "org_wide"]);
 var QUESTION_STATUSES = /* @__PURE__ */ new Set(["asked", "answered"]);
-var PULSE_STATUSES = /* @__PURE__ */ new Set(["on_track", "at_risk", "off_track"]);
 var SURVEY_RECIPIENT_TYPES = /* @__PURE__ */ new Set(["member", "team", "org_wide"]);
 var SURVEY_NAMES = /* @__PURE__ */ new Set([
   "employee_net_promoter_score",
@@ -5041,21 +5081,6 @@ var SURVEY_NAMES = /* @__PURE__ */ new Set([
   "manager_review",
   "onboarding"
 ]);
-var FEEDBACK_QUARTERS = /* @__PURE__ */ new Set(["q1", "q2", "q3", "q4"]);
-var FEEDBACK_NAMES = /* @__PURE__ */ new Set([
-  "productivity_and_focus",
-  "company_collaboration",
-  "project_management",
-  "employee_engagement",
-  "training_and_development",
-  "innovation_and_creativity",
-  "customer_insights",
-  "process_improvement",
-  "leadership_and_management",
-  "company_culture",
-  "roadmap_and_strategy",
-  "customer_testing_and_feedback"
-]);
 var SCORECARD_INTERVALS = /* @__PURE__ */ new Set([
   "daily",
   "weekly",
@@ -5106,7 +5131,7 @@ function normalizeTodosCreateBody(body) {
   }
   return { ...body, todo };
 }
-function asNonEmptyString3(value) {
+function asNonEmptyString2(value) {
   if (typeof value !== "string") {
     return void 0;
   }
@@ -5114,7 +5139,7 @@ function asNonEmptyString3(value) {
   return trimmed.length > 0 ? trimmed : void 0;
 }
 function validateEnumField(params) {
-  const value = asNonEmptyString3(params.rawValue);
+  const value = asNonEmptyString2(params.rawValue);
   if (!value) {
     return void 0;
   }
@@ -5148,7 +5173,7 @@ function normalizeKnowledgeCreateBody(body) {
     message: "Invalid content.status. Use one of: draft, published."
   });
   content.status = status ?? "draft";
-  const memberId = asNonEmptyString3(content.member_id);
+  const memberId = asNonEmptyString2(content.member_id);
   if (!memberId) {
     throwMissingRequiredCreateFields("content", ["member_id"]);
   }
@@ -5157,7 +5182,7 @@ function normalizeKnowledgeCreateBody(body) {
 }
 function normalizeNewsCreateBody(body) {
   const headline = ensureEntityObject(body, "headline");
-  const memberId = asNonEmptyString3(headline.member_id);
+  const memberId = asNonEmptyString2(headline.member_id);
   if (!memberId) {
     throwMissingRequiredCreateFields("headline", ["member_id"]);
   }
@@ -5186,14 +5211,14 @@ function normalizeNewsCreateBody(body) {
 }
 function normalizeQuestionsCreateBody(body) {
   const question = ensureEntityObject(body, "question");
-  const summary = asNonEmptyString3(question.summary);
-  const currentName = asNonEmptyString3(question.name);
+  const summary = asNonEmptyString2(question.summary);
+  const currentName = asNonEmptyString2(question.name);
   if (!currentName && summary) {
     question.name = summary;
   }
   delete question.summary;
-  const name = asNonEmptyString3(question.name);
-  const memberId = asNonEmptyString3(question.member_id);
+  const name = asNonEmptyString2(question.name);
+  const memberId = asNonEmptyString2(question.member_id);
   const missing = [];
   if (!name) missing.push("name");
   if (!memberId) missing.push("member_id");
@@ -5215,13 +5240,13 @@ function normalizeQuestionsCreateBody(body) {
 }
 function normalizeQuestionsUpdateBody(body) {
   const question = ensureEntityObject(body, "question");
-  const summary = asNonEmptyString3(question.summary);
-  const currentName = asNonEmptyString3(question.name);
+  const summary = asNonEmptyString2(question.summary);
+  const currentName = asNonEmptyString2(question.name);
   if (!currentName && summary) {
     question.name = summary;
   }
   delete question.summary;
-  const name = asNonEmptyString3(question.name);
+  const name = asNonEmptyString2(question.name);
   if (name) {
     question.name = name;
   }
@@ -5236,37 +5261,10 @@ function normalizeQuestionsUpdateBody(body) {
   }
   return { ...body, question };
 }
-function normalizePulseCreateBody(body) {
-  const healthUpdate = ensureEntityObject(body, "health_update");
-  const healthUpdatableId = asNonEmptyString3(healthUpdate.health_updatable_id) ?? asNonEmptyString3(healthUpdate.updatable_id);
-  const healthUpdatableType = asNonEmptyString3(healthUpdate.health_updatable_type) ?? asNonEmptyString3(healthUpdate.updatable_type);
-  const memberId = asNonEmptyString3(healthUpdate.member_id);
-  const status = validateEnumField({
-    rawValue: healthUpdate.status,
-    field: "health_update.status",
-    allowed: PULSE_STATUSES,
-    message: "Invalid health_update.status. Use one of: on_track, at_risk, off_track."
-  });
-  const missing = [];
-  if (!healthUpdatableId) missing.push("health_updatable_id");
-  if (!healthUpdatableType) missing.push("health_updatable_type");
-  if (!memberId) missing.push("member_id");
-  if (!status) missing.push("status");
-  if (missing.length > 0) {
-    throwMissingRequiredCreateFields("health_update", missing);
-  }
-  healthUpdate.health_updatable_id = healthUpdatableId;
-  healthUpdate.health_updatable_type = healthUpdatableType;
-  healthUpdate.member_id = memberId;
-  healthUpdate.status = status;
-  delete healthUpdate.updatable_id;
-  delete healthUpdate.updatable_type;
-  return { ...body, health_update: healthUpdate };
-}
 function normalizeSurveysCreateBody(body) {
   const survey = ensureEntityObject(body, "survey");
-  const title = asNonEmptyString3(survey.title);
-  const currentName = asNonEmptyString3(survey.name);
+  const title = asNonEmptyString2(survey.title);
+  const currentName = asNonEmptyString2(survey.name);
   if (!currentName && title) {
     survey.name = title;
   }
@@ -5295,8 +5293,8 @@ function normalizeSurveysCreateBody(body) {
 }
 function normalizeSurveysUpdateBody(body) {
   const survey = ensureEntityObject(body, "survey");
-  const title = asNonEmptyString3(survey.title);
-  const currentName = asNonEmptyString3(survey.name);
+  const title = asNonEmptyString2(survey.title);
+  const currentName = asNonEmptyString2(survey.name);
   if (!currentName && title) {
     survey.name = title;
   }
@@ -5321,77 +5319,16 @@ function normalizeSurveysUpdateBody(body) {
   }
   return { ...body, survey };
 }
-function normalizeFeedbacksCreateBody(body) {
-  const feedback = ensureEntityObject(body, "feedback");
-  const title = asNonEmptyString3(feedback.title);
-  const currentName = asNonEmptyString3(feedback.name);
-  if (!currentName && title) {
-    feedback.name = title;
-  }
-  delete feedback.title;
-  const name = validateEnumField({
-    rawValue: feedback.name,
-    field: "feedback.name",
-    allowed: FEEDBACK_NAMES,
-    message: "Invalid feedback.name. Use one of: productivity_and_focus, company_collaboration, project_management, employee_engagement, training_and_development, innovation_and_creativity, customer_insights, process_improvement, leadership_and_management, company_culture, roadmap_and_strategy, customer_testing_and_feedback."
-  });
-  const quarter = validateEnumField({
-    rawValue: feedback.quarter,
-    field: "feedback.quarter",
-    allowed: FEEDBACK_QUARTERS,
-    message: "Invalid feedback.quarter. Use one of: q1, q2, q3, q4."
-  });
-  const year = asNonEmptyString3(feedback.year);
-  const missing = [];
-  if (!name) missing.push("name");
-  if (!quarter) missing.push("quarter");
-  if (!year) missing.push("year");
-  if (missing.length > 0) {
-    throwMissingRequiredCreateFields("feedback", missing);
-  }
-  feedback.name = name;
-  feedback.quarter = quarter;
-  feedback.year = year;
-  return { ...body, feedback };
-}
-function normalizeFeedbacksUpdateBody(body) {
-  const feedback = ensureEntityObject(body, "feedback");
-  const title = asNonEmptyString3(feedback.title);
-  const currentName = asNonEmptyString3(feedback.name);
-  if (!currentName && title) {
-    feedback.name = title;
-  }
-  delete feedback.title;
-  const name = validateEnumField({
-    rawValue: feedback.name,
-    field: "feedback.name",
-    allowed: FEEDBACK_NAMES,
-    message: "Invalid feedback.name. Use one of: productivity_and_focus, company_collaboration, project_management, employee_engagement, training_and_development, innovation_and_creativity, customer_insights, process_improvement, leadership_and_management, company_culture, roadmap_and_strategy, customer_testing_and_feedback."
-  });
-  if (name) {
-    feedback.name = name;
-  }
-  const quarter = validateEnumField({
-    rawValue: feedback.quarter,
-    field: "feedback.quarter",
-    allowed: FEEDBACK_QUARTERS,
-    message: "Invalid feedback.quarter. Use one of: q1, q2, q3, q4."
-  });
-  if (quarter) {
-    feedback.quarter = quarter;
-  }
-  return { ...body, feedback };
-}
 function normalizeAccountabilityCreateBody(body) {
   const responsibility = ensureEntityObject(body, "responsibility");
-  const summary = asNonEmptyString3(responsibility.summary);
-  const currentName = asNonEmptyString3(responsibility.name);
+  const summary = asNonEmptyString2(responsibility.summary);
+  const currentName = asNonEmptyString2(responsibility.name);
   if (!currentName && summary) {
     responsibility.name = summary;
   }
   delete responsibility.summary;
-  const name = asNonEmptyString3(responsibility.name);
-  const memberId = asNonEmptyString3(responsibility.member_id);
+  const name = asNonEmptyString2(responsibility.name);
+  const memberId = asNonEmptyString2(responsibility.member_id);
   const missing = [];
   if (!name) missing.push("name");
   if (!memberId) missing.push("member_id");
@@ -5406,8 +5343,8 @@ function normalizeAccountabilityCreateBody(body) {
 }
 function normalizeAccountabilityUpdateBody(body) {
   const responsibility = ensureEntityObject(body, "responsibility");
-  const summary = asNonEmptyString3(responsibility.summary);
-  const currentName = asNonEmptyString3(responsibility.name);
+  const summary = asNonEmptyString2(responsibility.summary);
+  const currentName = asNonEmptyString2(responsibility.name);
   if (!currentName && summary) {
     responsibility.name = summary;
   }
@@ -5439,7 +5376,7 @@ function parseSmartKpiViewCreateBody(raw) {
 }
 function normalizeSmartKpiViewCreateBody(body) {
   const smartKpiView = ensureEntityObject(body, "smart_kpi_view");
-  const name = asNonEmptyString3(smartKpiView.name);
+  const name = asNonEmptyString2(smartKpiView.name);
   if (!name) {
     throwMissingRequiredCreateFields("smart_kpi_view", ["name"]);
   }
@@ -5477,9 +5414,9 @@ function buildKpisCreateMutation(params) {
     });
   }
   const smartKpi = { ...entity };
-  const name = asNonEmptyString3(smartKpi.name);
-  const smartKpiViewId = asNonEmptyString3(smartKpi.smart_kpi_view_id);
-  const measurableGroupId = asNonEmptyString3(smartKpi.measurable_group_id);
+  const name = asNonEmptyString2(smartKpi.name);
+  const smartKpiViewId = asNonEmptyString2(smartKpi.smart_kpi_view_id);
+  const measurableGroupId = asNonEmptyString2(smartKpi.measurable_group_id);
   const hasAllowedName = typeof name === "string" && SMART_KPI_NAME_SET.has(name);
   if (!name) {
     throw new CliError({
@@ -5499,7 +5436,7 @@ function buildKpisCreateMutation(params) {
       measurable_type: "number",
       condition: "greater_than_or_equal_to"
     };
-    const notes = asNonEmptyString3(smartKpi.notes);
+    const notes = asNonEmptyString2(smartKpi.notes);
     if (notes) {
       measurable.notes = notes;
     }
@@ -5568,6 +5505,32 @@ function registerSmartKpiViewCommands(program) {
   });
 }
 function registerSystemToolCommands(program) {
+  registerEntityCrudCommands(program, {
+    command: "reminders",
+    description: "Reminder operations",
+    resourcePath: "reminders",
+    rootKey: "reminder",
+    requiredCreateFields: ["title"],
+    listParams: ["status", "sort"],
+    allowQueryJson: false,
+    registerSearch: false,
+    listSelectionSet: REMINDER_LIST_SELECTION,
+    showSelectionSet: REMINDER_SHOW_SELECTION,
+    idMutationCommands: [
+      {
+        command: "clear",
+        description: "Clear a reminder while retaining its history",
+        field: "clear_reminder",
+        idVariable: "reminder_id"
+      },
+      {
+        command: "destroy",
+        description: "Cancel a reminder while retaining its history",
+        field: "destroy_reminder",
+        idVariable: "reminder_id"
+      }
+    ]
+  });
   registerEntityCrudCommands(program, {
     command: "lists",
     description: "List operations",
@@ -5712,18 +5675,6 @@ function registerSystemToolCommands(program) {
     listParams: ["answered", "asked"],
     allowQueryJson: false
   });
-  registerEntityCrudCommands(program, {
-    command: "pulse",
-    description: "Pulse operations",
-    resourcePath: "health_updates",
-    rootKey: "health_update",
-    listField: "feedbacks",
-    showField: "feedback",
-    requiredCreateFields: ["health_updatable_id", "health_updatable_type", "member_id", "status"],
-    normalizeCreateBody: normalizePulseCreateBody,
-    listParams: ["last", "latest", "start_date", "name", "quarter", "year"],
-    allowQueryJson: false
-  });
   registerEntityCrudCommands(program, {
     command: "surveys",
     description: "Survey operations",
@@ -5735,17 +5686,6 @@ function registerSystemToolCommands(program) {
     listParams: ["completed", "current_member", "due", "exclude_completed", "sent"],
     allowQueryJson: false
   });
-  registerEntityCrudCommands(program, {
-    command: "feedbacks",
-    description: "Feedback operations",
-    resourcePath: "feedback",
-    rootKey: "feedback",
-    requiredCreateFields: ["name", "quarter", "year"],
-    normalizeCreateBody: normalizeFeedbacksCreateBody,
-    normalizeUpdateBody: normalizeFeedbacksUpdateBody,
-    listParams: ["last", "latest", "start_date"],
-    allowQueryJson: false
-  });
   registerEntityCrudCommands(program, {
     command: "accountability",
     description: "Accountability operations",
@@ -5818,8 +5758,8 @@ function registerSystemToolCommands(program) {
 }
 
 // src/commands/teams.ts
-var import_zod11 = require("zod");
-var idSchema9 = import_zod11.z.string().min(1);
+var import_zod12 = require("zod");
+var idSchema9 = import_zod12.z.string().min(1);
 function registerTeamCommands(program) {
   const teams = program.command("teams").description("Team operations");
   teams.command("list").option("--page <page>").option("--per <per>").action(async (opts, cmd) => {
@@ -5885,8 +5825,8 @@ function registerTeamCommands(program) {
 }
 
 // src/commands/organizations.ts
-var import_zod12 = require("zod");
-var idSchema10 = import_zod12.z.string().min(1);
+var import_zod13 = require("zod");
+var idSchema10 = import_zod13.z.string().min(1);
 function isRecord3(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
@@ -5902,7 +5842,7 @@ function ensureRootObject(body, rootKey) {
   }
   return { ...root };
 }
-function asNonEmptyString4(value) {
+function asNonEmptyString3(value) {
   if (typeof value !== "string") {
     return void 0;
   }
@@ -5912,7 +5852,7 @@ function asNonEmptyString4(value) {
 function normalizeOrganizationUpdateBody(body) {
   const organization = ensureRootObject(body, "organization");
   const detail = isRecord3(organization.organization_detail_attributes) ? { ...organization.organization_detail_attributes } : {};
-  const workspaceName = asNonEmptyString4(organization.workspace_name);
+  const workspaceName = asNonEmptyString3(organization.workspace_name);
   if (workspaceName) {
     detail.workspace_name = workspaceName;
   }
@@ -5925,7 +5865,7 @@ function normalizeOrganizationUpdateBody(body) {
 function normalizeOrganizationMetaProfileUpdateBody(body) {
   const root = ensureRootObject(body, "organization_meta_profile");
   const profile = isRecord3(root.profile) ? { ...root.profile } : {};
-  const title = asNonEmptyString4(root.title);
+  const title = asNonEmptyString3(root.title);
   if (title) {
     const companyIdentity = isRecord3(profile.company_identity) ? { ...profile.company_identity } : {};
     companyIdentity.one_sentence_summary = title;
@@ -5955,7 +5895,7 @@ function normalizeOrganizationMetaProfileUpdateBody(body) {
 function normalizeKeyMetricMetaProfileUpdateBody(body) {
   const root = ensureRootObject(body, "key_metric_meta_profile");
   const profile = isRecord3(root.profile) ? { ...root.profile } : {};
-  const annualRevenue = asNonEmptyString4(root.annual_revenue);
+  const annualRevenue = asNonEmptyString3(root.annual_revenue);
   if (annualRevenue) {
     const financial = isRecord3(profile.financial) ? { ...profile.financial } : {};
     financial.revenue = annualRevenue;
@@ -6111,8 +6051,8 @@ function registerOrganizationCommands(program) {
 }
 
 // src/commands/foundation.ts
-var import_zod13 = require("zod");
-var idSchema11 = import_zod13.z.string().min(1);
+var import_zod14 = require("zod");
+var idSchema11 = import_zod14.z.string().min(1);
 var STRATEGIC_PLAN_ALLOWED_UPDATE_KEYS = /* @__PURE__ */ new Set([
   "published_at",
   "profile",
@@ -6139,7 +6079,7 @@ function ensureRootObject2(body, rootKey) {
   }
   return { ...root };
 }
-function asNonEmptyString5(value) {
+function asNonEmptyString4(value) {
   if (typeof value !== "string") {
     return void 0;
   }
@@ -6167,8 +6107,8 @@ function normalizeStrategicPlanUpdateBody(body) {
 }
 function normalizeStrategicObjectiveUpdateBody(body) {
   const strategicObjective = ensureRootObject2(body, "strategic_objective");
-  const title = asNonEmptyString5(strategicObjective.title);
-  if (!asNonEmptyString5(strategicObjective.summary) && title) {
+  const title = asNonEmptyString4(strategicObjective.title);
+  if (!asNonEmptyString4(strategicObjective.summary) && title) {
     strategicObjective.summary = title;
   }
   delete strategicObjective.title;
@@ -6191,8 +6131,8 @@ function normalizeStrategicObjectiveUpdateBody(body) {
 }
 function normalizeAnnualObjectiveCreateBody(body) {
   const annualObjective = ensureRootObject2(body, "annual_objective");
-  const title = asNonEmptyString5(annualObjective.title);
-  if (!asNonEmptyString5(annualObjective.name) && title) {
+  const title = asNonEmptyString4(annualObjective.title);
+  if (!asNonEmptyString4(annualObjective.name) && title) {
     annualObjective.name = title;
   }
   delete annualObjective.title;
@@ -6200,8 +6140,8 @@ function normalizeAnnualObjectiveCreateBody(body) {
 }
 function normalizeQuarterlyObjectiveCreateBody(body) {
   const quarterlyObjective = ensureRootObject2(body, "quarterly_objective");
-  const title = asNonEmptyString5(quarterlyObjective.title);
-  if (!asNonEmptyString5(quarterlyObjective.name) && title) {
+  const title = asNonEmptyString4(quarterlyObjective.title);
+  if (!asNonEmptyString4(quarterlyObjective.name) && title) {
     quarterlyObjective.name = title;
   }
   delete quarterlyObjective.title;
@@ -6313,9 +6253,9 @@ function registerFoundationCommands(program) {
 }
 
 // src/commands/childEntities.ts
-var import_zod14 = require("zod");
-var idSchema12 = import_zod14.z.string().min(1);
-var jsonObjectSchema = import_zod14.z.record(import_zod14.z.string(), import_zod14.z.unknown());
+var import_zod15 = require("zod");
+var idSchema12 = import_zod15.z.string().min(1);
+var jsonObjectSchema = import_zod15.z.record(import_zod15.z.string(), import_zod15.z.unknown());
 var NOTE_DETAIL_FIELDS = [
   "notes",
   "hasNotes",
@@ -6344,7 +6284,18 @@ function requiredParentSearchOption(parentFlag, parentKind) {
 }
 function buildChildResourceSelectionSet(parentField, extraFields = []) {
   const fields = Array.from(
-    /* @__PURE__ */ new Set(["id", "type", "name", "status", "priority", "rank", "dueDate", "memberId", parentField, ...extraFields])
+    /* @__PURE__ */ new Set([
+      "id",
+      "type",
+      "name",
+      "status",
+      "priority",
+      "rank",
+      "dueDate",
+      "memberId",
+      parentField,
+      ...extraFields
+    ])
   );
   const attributeFields = fields.filter((field) => field !== "type");
   return `{ ${fields.join(" ")} attributes { ${attributeFields.join(" ")} } }`;
@@ -6352,6 +6303,30 @@ function buildChildResourceSelectionSet(parentField, extraFields = []) {
 function buildChildListSelectionSet(parentField, extraFields = []) {
   return `{ data ${buildChildResourceSelectionSet(parentField, extraFields)} count currentPage totalPages }`;
 }
+function buildChildShowSelectionSet(parentField, extraFields = []) {
+  const fields = Array.from(
+    /* @__PURE__ */ new Set([
+      "id",
+      "type",
+      "name",
+      "status",
+      "priority",
+      "rank",
+      "dueDate",
+      "memberId",
+      parentField,
+      "notes",
+      "hasNotes",
+      "hasUnreadNotes",
+      "notesUpdatedAt",
+      "notesLastReadAt",
+      "estimateIds",
+      ...extraFields
+    ])
+  );
+  const attributeFields = fields.filter((field) => field !== "type");
+  return `{ ${fields.join(" ")} attributes { ${attributeFields.join(" ")} } }`;
+}
 function parseJsonObject2(raw) {
   try {
     const parsed = JSON.parse(raw);
@@ -6729,19 +6704,22 @@ function registerChildEntityCommands(program) {
     updateField: "update_talking_point",
     destroyField: "destroy_talking_point",
     idVariable: "talking_point_id",
+    showField: "talking_point",
     listOperationName: "TalkingPointsList",
+    showOperationName: "TalkingPointsShow",
     createOperationName: "TalkingPointsCreate",
     updateOperationName: "TalkingPointsUpdate",
     destroyOperationName: "TalkingPointsDestroy",
     listSelectionSet: buildChildListSelectionSet("meetingId", ["description", "creatorId", "slug"]),
+    showSelectionSet: buildChildShowSelectionSet("meetingId", ["description", "creatorId", "slug"]),
     listParentTypedField: "meetingId"
   });
 }
 
 // src/commands/content.ts
-var import_zod15 = require("zod");
-var idSchema13 = import_zod15.z.string().min(1);
-var nonEmptyString = import_zod15.z.string().min(1);
+var import_zod16 = require("zod");
+var idSchema13 = import_zod16.z.string().min(1);
+var nonEmptyString = import_zod16.z.string().min(1);
 var contentAttributesSelection = "attributes { id type name slug content firstChildSlug rootParentSlug status contentType lastEdited organizationId memberId focusMemberId focusTeamId teamId creatorId createdAt updatedAt childCount assignmentType contentableId contentableSlug contentableType votesTotal labelIds rootContentId parentContentId }";
 function assertUpdateFields(params) {
   if (!params.name && !params.content && !params.status) {
@@ -6929,9 +6907,9 @@ function registerContentCommands(program) {
 }
 
 // src/commands/markdownTree.ts
-var import_zod16 = require("zod");
-var nonEmptyString2 = import_zod16.z.string().min(1);
-var nonNegativeInt = import_zod16.z.coerce.number().int().min(0);
+var import_zod17 = require("zod");
+var nonEmptyString2 = import_zod17.z.string().min(1);
+var nonNegativeInt = import_zod17.z.coerce.number().int().min(0);
 function addScopeOptions(command) {
   return command.requiredOption("--tool-key <toolKey>").requiredOption("--node-key <nodeKey>").option("--parent-id <parentId>").option("--record-id <recordId>").option("--member-id <memberId>").option("--team-id <teamId>").option("--content-type <contentType>").option("--tree-view");
 }
@@ -7096,11 +7074,11 @@ function registerMarkdownTreeCommands(program) {
 }
 
 // src/commands/navigation.ts
-var import_zod17 = require("zod");
+var import_zod18 = require("zod");
 
 // src/internalOptions.ts
 var INTERNAL_OPTIONS_KEY = "__waveInternalOptions";
-function asRecord4(value) {
+function asRecord3(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     return null;
   }
@@ -7114,7 +7092,7 @@ function setInternalCliOptions(program, options) {
 function getInternalCliOptions(command) {
   let current = command;
   while (current) {
-    const record = asRecord4(current[INTERNAL_OPTIONS_KEY]);
+    const record = asRecord3(current[INTERNAL_OPTIONS_KEY]);
     if (record) {
       return {
         enableRetryOnEmptyPhrase: record.enableRetryOnEmptyPhrase === true
@@ -7126,8 +7104,8 @@ function getInternalCliOptions(command) {
 }
 
 // src/commands/navigation.ts
-var nonEmpty = import_zod17.z.string().min(1);
-var nonNegativeInt2 = import_zod17.z.coerce.number().int().min(0);
+var nonEmpty = import_zod18.z.string().min(1);
+var nonNegativeInt2 = import_zod18.z.coerce.number().int().min(0);
 var MIGRATED_BRANCHES = ["directory", "projects", "knowledge"];
 function normalizeText(input) {
   if (typeof input !== "string") return "";
@@ -7910,14 +7888,14 @@ function registerMutationCapabilityCommands(program) {
 // src/commands/osmd.ts
 var import_promises3 = require("fs/promises");
 var import_node_path3 = require("path");
-var import_zod18 = require("zod");
+var import_zod19 = require("zod");
 var import_commander = require("commander");
 
 // src/operationManifest.ts
 var import_node_crypto3 = require("crypto");
 
 // src/version.ts
-var CLI_VERSION = "0.1.85";
+var CLI_VERSION = "0.1.88";
 
 // src/operationMetadata.ts
 var DISCOVERY_OPERATION_IDS = [
@@ -7945,14 +7923,14 @@ var DISCOVERY_OPERATION_IDS = [
   "customers.examples",
   "customers.schema",
   "datasheets.examples",
+  "data-pipeline.examples",
+  "data-pipeline.schema",
   "datasheets.schema",
   "desktop-context.examples",
   "desktop-context.schema",
   "doctor",
   "doctor.examples",
   "doctor.schema",
-  "feedbacks.examples",
-  "feedbacks.schema",
   "foundation.examples",
   "foundation.schema",
   "issue-groups.examples",
@@ -7989,8 +7967,6 @@ var DISCOVERY_OPERATION_IDS = [
   "project-content.schema",
   "projects.examples",
   "projects.schema",
-  "pulse.examples",
-  "pulse.schema",
   "questions.examples",
   "questions.schema",
   "recognition.examples",
@@ -8032,7 +8008,9 @@ var DISCOVERY_OPERATION_IDS = [
   "todos.examples",
   "todos.schema",
   "whiteboards.examples",
-  "whiteboards.schema"
+  "whiteboards.schema",
+  "sketches.examples",
+  "sketches.schema"
 ];
 var READ_OPERATION_IDS = [
   "accountability.list",
@@ -8060,12 +8038,15 @@ var READ_OPERATION_IDS = [
   "customers.show",
   "datasheets.list",
   "datasheets.open",
+  "data-pipeline.execute-source-action",
+  "data-pipeline.overview",
+  "data-pipeline.source-actions",
+  "data-pipeline.sources",
   "datasheets.show",
+  "desktop-context.activity",
+  "desktop-context.member-statuses",
   "desktop-context.recent",
   "desktop-context.status",
-  "feedbacks.list",
-  "feedbacks.search",
-  "feedbacks.show",
   "find",
   "foundation.annual-objectives.list",
   "foundation.annual-objectives.search",
@@ -8101,6 +8082,7 @@ var READ_OPERATION_IDS = [
   "mail.message",
   "mail.messages",
   "mail.open",
+  "mail.relay-evidence",
   "mail.settings",
   "mail.snippets",
   "mail.sync-status",
@@ -8112,12 +8094,15 @@ var READ_OPERATION_IDS = [
   "markdown-tree.root",
   "markdown-tree.subtree",
   "meetings.list",
+  "meetings.note-show",
   "meetings.search",
   "meetings.show",
   "members.list",
   "members.meta-profile",
+  "members.resolve",
   "members.search",
   "members.show",
+  "resources.resolve",
   "milestones.list",
   "milestones.search",
   "milestones.show",
@@ -8162,9 +8147,6 @@ var READ_OPERATION_IDS = [
   "projects.list",
   "projects.search",
   "projects.show",
-  "pulse.list",
-  "pulse.search",
-  "pulse.show",
   "questions.list",
   "questions.search",
   "questions.show",
@@ -8176,6 +8158,8 @@ var READ_OPERATION_IDS = [
   "rock-collections.list",
   "rock-collections.search",
   "rock-collections.show",
+  "reminders.list",
+  "reminders.show",
   "rocks.list",
   "rocks.search",
   "rocks.show",
@@ -8188,6 +8172,8 @@ var READ_OPERATION_IDS = [
   "skills.list",
   "skills.show",
   "stand-ups.list",
+  "signatures.list",
+  "signatures.show",
   "stand-ups.search",
   "stand-ups.show",
   "subissues.list",
@@ -8211,13 +8197,12 @@ var READ_OPERATION_IDS = [
   "support.settings",
   "support.ticket-counts",
   "support.tickets",
-  "signatures.list",
-  "signatures.show",
   "surveys.list",
   "surveys.search",
   "surveys.show",
   "talking-points.list",
   "talking-points.search",
+  "talking-points.show",
   "tasks.list",
   "tasks.search",
   "tasks.show",
@@ -8239,7 +8224,10 @@ var READ_OPERATION_IDS = [
   "tree",
   "whiteboards.list",
   "whiteboards.open",
-  "whiteboards.show"
+  "whiteboards.show",
+  "sketches.list",
+  "sketches.open",
+  "sketches.show"
 ];
 var WRITE_OPERATION_IDS = [
   "accountability.create",
@@ -8290,8 +8278,6 @@ var WRITE_OPERATION_IDS = [
   "datasheets.view.delete",
   "datasheets.view.reorder",
   "datasheets.view.update",
-  "feedbacks.create",
-  "feedbacks.update",
   "foundation.annual-objectives.create",
   "foundation.annual-objectives.update",
   "foundation.quarterly-objectives.create",
@@ -8339,8 +8325,6 @@ var WRITE_OPERATION_IDS = [
   "project-content.update",
   "projects.create",
   "projects.update",
-  "pulse.create",
-  "pulse.update",
   "questions.create",
   "questions.update",
   "rock-collections.create",
@@ -8348,6 +8332,10 @@ var WRITE_OPERATION_IDS = [
   "rocks.create",
   "rocks.update",
   "rocks.update-status",
+  "reminders.clear",
+  "reminders.create",
+  "reminders.destroy",
+  "reminders.update",
   "scorecard-groups.create",
   "scorecard-groups.update",
   "scorecards.create",
@@ -8389,7 +8377,9 @@ var WRITE_OPERATION_IDS = [
   "todo-groups.create",
   "todo-groups.update",
   "todos.create",
-  "todos.update"
+  "todos.update",
+  "sketches.create",
+  "sketches.update-metadata"
 ];
 var DIRECT_MACHINE_WRITE_OPERATION_IDS = /* @__PURE__ */ new Set(["automations.create"]);
 var AUTH_OPERATION_IDS = ["login", "logout"];
@@ -8410,6 +8400,8 @@ var DESTRUCTIVE_OPERATION_IDS = /* @__PURE__ */ new Set([
   "datasheets.view.delete",
   "milestones.destroy",
   "project-content.destroy",
+  "reminders.clear",
+  "reminders.destroy",
   "signatures.destroy",
   "signatures.void",
   "subissues.destroy",
@@ -8426,6 +8418,14 @@ var OPERATION_IDS_BY_CLASSIFICATION = {
   auth: AUTH_OPERATION_IDS
 };
 var metadataByOperationId = /* @__PURE__ */ new Map();
+function assertDataPipelineReadOnlyRegistration(id, metadata) {
+  if (!id.startsWith("data-pipeline.")) return;
+  const isReadOnlyOperation = metadata.classification === "read" && metadata.atlasSafetyClass === "read_only" || metadata.classification === "discovery" && metadata.atlasSafetyClass === "discovery";
+  if (isReadOnlyOperation && !metadata.requiresApproval && !metadata.machine.supportsPreview) {
+    return;
+  }
+  throw new Error(`Data Pipeline operations must remain read-only: ${id}`);
+}
 for (const [classification, operationIds] of Object.entries(OPERATION_IDS_BY_CLASSIFICATION)) {
   for (const id of operationIds) {
     if (metadataByOperationId.has(id)) {
@@ -8435,7 +8435,7 @@ for (const [classification, operationIds] of Object.entries(OPERATION_IDS_BY_CLA
     if (DESTRUCTIVE_OPERATION_IDS.has(id) && classification !== "write") {
       throw new Error(`Destructive Wave CLI operation must be a write: ${id}`);
     }
-    metadataByOperationId.set(id, {
+    const metadata = {
       classification,
       requiresApproval: classification === "write" && !DIRECT_MACHINE_WRITE_OPERATION_IDS.has(id),
       atlasSafetyClass,
@@ -8445,7 +8445,9 @@ for (const [classification, operationIds] of Object.entries(OPERATION_IDS_BY_CLA
         supportsExecute: true,
         executionMode: "sync"
       }
-    });
+    };
+    assertDataPipelineReadOnlyRegistration(id, metadata);
+    metadataByOperationId.set(id, metadata);
   }
 }
 function registeredOperationMetadata(id) {
@@ -8607,15 +8609,15 @@ function buildOperationManifest(program) {
 }
 
 // src/commands/osmd.ts
-var sourceSchema = import_zod18.z.enum([
+var sourceSchema = import_zod19.z.enum([
   "canonical_osmd",
   "agent_overlay",
   "agent_wiki",
   "thread_workspace"
 ]);
-var accessSchema = import_zod18.z.enum(["read_only", "read_write", "append_only"]).catch("read_write");
-var ownerSchema = import_zod18.z.enum(["system", "atlas"]);
-var suggestedActionSchema = import_zod18.z.enum([
+var accessSchema = import_zod19.z.enum(["read_only", "read_write", "append_only"]).catch("read_write");
+var ownerSchema = import_zod19.z.enum(["system", "atlas"]);
+var suggestedActionSchema = import_zod19.z.enum([
   "read",
   "create",
   "init",
@@ -8624,7 +8626,7 @@ var suggestedActionSchema = import_zod18.z.enum([
   "forbidden",
   "invalid_parent"
 ]).catch("update");
-var agentMarkdownErrorCodeSchema = import_zod18.z.enum([
+var agentMarkdownErrorCodeSchema = import_zod19.z.enum([
   "canonical_osmd_read_only",
   "agent_parent_not_found",
   "agent_file_not_found",
@@ -8635,9 +8637,9 @@ var agentMarkdownErrorCodeSchema = import_zod18.z.enum([
   "invalid_agent_wiki_path"
 ]);
 var agentMarkdownErrorCodeFieldSchema = agentMarkdownErrorCodeSchema.nullable().catch(null);
-var nonEmptyString3 = import_zod18.z.string().min(1);
-var nonNegativeInt3 = import_zod18.z.coerce.number().int().min(0);
-var positiveInt = import_zod18.z.coerce.number().int().min(1);
+var nonEmptyString3 = import_zod19.z.string().min(1);
+var nonNegativeInt3 = import_zod19.z.coerce.number().int().min(0);
+var positiveInt = import_zod19.z.coerce.number().int().min(1);
 var supportedAgentOverlaySystemFiles = ["notes.md", "summary.md"];
 var supportedWikiIndexFile = "index.md";
 var supportedWikiLogFile = "log.md";
@@ -8653,20 +8655,20 @@ var supportedWikiControlledPatterns = supportedWikiControlledFolders.map(
 );
 var controlledWikiSlugPattern = /^[a-z0-9][a-z0-9-]*$/;
 var agentMarkdownSlugPattern = /^[a-z0-9][a-z0-9-]*$/;
-var osmdSearchScopeSchema = import_zod18.z.enum([
+var osmdSearchScopeSchema = import_zod19.z.enum([
   "os-only",
   "agent-overlay-only",
   "agent-wiki-only",
   "combined"
 ]);
-var osmdLintScopeSchema = import_zod18.z.enum([
+var osmdLintScopeSchema = import_zod19.z.enum([
   "combined",
   "agent-overlay-only",
   "agent-wiki-only"
 ]);
-var osmdMemoryQualityScopeSchema = import_zod18.z.enum(["agent-overlay-only"]);
-var osmdIngestKindSchema = import_zod18.z.enum(["text", "file", "url", "transcript"]);
-var osmdRawSourceTypeSchema = import_zod18.z.enum([
+var osmdMemoryQualityScopeSchema = import_zod19.z.enum(["agent-overlay-only"]);
+var osmdIngestKindSchema = import_zod19.z.enum(["text", "file", "url", "transcript"]);
+var osmdRawSourceTypeSchema = import_zod19.z.enum([
   "pasted_text",
   "uploaded_markdown",
   "uploaded_text",
@@ -8675,37 +8677,37 @@ var osmdRawSourceTypeSchema = import_zod18.z.enum([
   "meeting_transcript",
   "url"
 ]);
-var agentMarkdownFileSchema = import_zod18.z.preprocess(
+var agentMarkdownFileSchema = import_zod19.z.preprocess(
   normalizeAgentMarkdownJsonKeys,
-  import_zod18.z.object({
-    path: import_zod18.z.string(),
+  import_zod19.z.object({
+    path: import_zod19.z.string(),
     source: sourceSchema,
     access: accessSchema,
     owner: ownerSchema,
-    exists: import_zod18.z.boolean(),
-    canCreate: import_zod18.z.boolean(),
-    canUpdate: import_zod18.z.boolean(),
-    canAppend: import_zod18.z.boolean(),
-    wikiRole: import_zod18.z.string().nullable().optional(),
-    formatVersion: import_zod18.z.string().nullable().optional(),
-    createdAt: import_zod18.z.string().nullable().optional(),
-    updatedAt: import_zod18.z.string().nullable().optional(),
-    ingestedAt: import_zod18.z.string().nullable().optional(),
-    lastSeenAt: import_zod18.z.string().nullable().optional(),
-    canonicalParentUpdatedAt: import_zod18.z.string().nullable().optional(),
-    parentRef: import_zod18.z.string().nullable().optional(),
-    agentChildrenAllowed: import_zod18.z.boolean(),
+    exists: import_zod19.z.boolean(),
+    canCreate: import_zod19.z.boolean(),
+    canUpdate: import_zod19.z.boolean(),
+    canAppend: import_zod19.z.boolean(),
+    wikiRole: import_zod19.z.string().nullable().optional(),
+    formatVersion: import_zod19.z.string().nullable().optional(),
+    createdAt: import_zod19.z.string().nullable().optional(),
+    updatedAt: import_zod19.z.string().nullable().optional(),
+    ingestedAt: import_zod19.z.string().nullable().optional(),
+    lastSeenAt: import_zod19.z.string().nullable().optional(),
+    canonicalParentUpdatedAt: import_zod19.z.string().nullable().optional(),
+    parentRef: import_zod19.z.string().nullable().optional(),
+    agentChildrenAllowed: import_zod19.z.boolean(),
     suggestedAction: suggestedActionSchema,
     errorCode: agentMarkdownErrorCodeFieldSchema.optional(),
-    content: import_zod18.z.string().nullable().optional(),
-    url: import_zod18.z.string().nullable().optional(),
-    workspaceId: import_zod18.z.string().nullable().optional(),
-    fileId: import_zod18.z.string().nullable().optional(),
-    name: import_zod18.z.string().nullable().optional(),
-    displayName: import_zod18.z.string().nullable().optional(),
-    contentSha: import_zod18.z.string().nullable().optional(),
-    versionSha: import_zod18.z.string().nullable().optional(),
-    mediaType: import_zod18.z.string().nullable().optional()
+    content: import_zod19.z.string().nullable().optional(),
+    url: import_zod19.z.string().nullable().optional(),
+    workspaceId: import_zod19.z.string().nullable().optional(),
+    fileId: import_zod19.z.string().nullable().optional(),
+    name: import_zod19.z.string().nullable().optional(),
+    displayName: import_zod19.z.string().nullable().optional(),
+    contentSha: import_zod19.z.string().nullable().optional(),
+    versionSha: import_zod19.z.string().nullable().optional(),
+    mediaType: import_zod19.z.string().nullable().optional()
   }).transform((value) => ({
     ...value,
     wikiRole: value.wikiRole ?? null,
@@ -8728,31 +8730,31 @@ var agentMarkdownFileSchema = import_zod18.z.preprocess(
     mediaType: value.mediaType ?? null
   }))
 );
-var agentMarkdownFilesSchema = import_zod18.z.array(agentMarkdownFileSchema);
-var agentMarkdownMutationDataSchema = import_zod18.z.union([
+var agentMarkdownFilesSchema = import_zod19.z.array(agentMarkdownFileSchema);
+var agentMarkdownMutationDataSchema = import_zod19.z.union([
   agentMarkdownFileSchema,
-  import_zod18.z.object({ files: agentMarkdownFilesSchema })
+  import_zod19.z.object({ files: agentMarkdownFilesSchema })
 ]);
-var osmdSearchCandidateSchema = import_zod18.z.preprocess(
+var osmdSearchCandidateSchema = import_zod19.z.preprocess(
   normalizeAgentMarkdownJsonKeys,
-  import_zod18.z.object({
-    path: import_zod18.z.string(),
+  import_zod19.z.object({
+    path: import_zod19.z.string(),
     source: sourceSchema,
     access: accessSchema,
     owner: ownerSchema,
-    wikiRole: import_zod18.z.string().nullable().optional(),
-    formatVersion: import_zod18.z.string().nullable().optional(),
-    parentRef: import_zod18.z.string().nullable().optional(),
-    exists: import_zod18.z.boolean(),
-    agentChildrenAllowed: import_zod18.z.boolean(),
-    title: import_zod18.z.string(),
-    label: import_zod18.z.string(),
-    snippet: import_zod18.z.string().nullable().optional(),
-    rank: import_zod18.z.number().int(),
-    matchReason: import_zod18.z.string().nullable().optional(),
-    toolKey: import_zod18.z.string().nullable().optional(),
-    nodeKey: import_zod18.z.string().nullable().optional(),
-    nodeKind: import_zod18.z.string().nullable().optional()
+    wikiRole: import_zod19.z.string().nullable().optional(),
+    formatVersion: import_zod19.z.string().nullable().optional(),
+    parentRef: import_zod19.z.string().nullable().optional(),
+    exists: import_zod19.z.boolean(),
+    agentChildrenAllowed: import_zod19.z.boolean(),
+    title: import_zod19.z.string(),
+    label: import_zod19.z.string(),
+    snippet: import_zod19.z.string().nullable().optional(),
+    rank: import_zod19.z.number().int(),
+    matchReason: import_zod19.z.string().nullable().optional(),
+    toolKey: import_zod19.z.string().nullable().optional(),
+    nodeKey: import_zod19.z.string().nullable().optional(),
+    nodeKind: import_zod19.z.string().nullable().optional()
   }).transform((value) => ({
     ...value,
     wikiRole: value.wikiRole ?? null,
@@ -8765,26 +8767,26 @@ var osmdSearchCandidateSchema = import_zod18.z.preprocess(
     nodeKind: value.nodeKind ?? null
   }))
 );
-var osmdSearchResultSchema = import_zod18.z.preprocess(
+var osmdSearchResultSchema = import_zod19.z.preprocess(
   normalizeAgentMarkdownJsonKeys,
-  import_zod18.z.object({
-    query: import_zod18.z.string(),
-    scope: import_zod18.z.string(),
-    count: import_zod18.z.number().int().min(0),
-    candidates: import_zod18.z.array(osmdSearchCandidateSchema)
+  import_zod19.z.object({
+    query: import_zod19.z.string(),
+    scope: import_zod19.z.string(),
+    count: import_zod19.z.number().int().min(0),
+    candidates: import_zod19.z.array(osmdSearchCandidateSchema)
   })
 );
-var osmdWikiLintIssueSchema = import_zod18.z.preprocess(
+var osmdWikiLintIssueSchema = import_zod19.z.preprocess(
   normalizeAgentMarkdownJsonKeys,
-  import_zod18.z.object({
-    code: import_zod18.z.string(),
-    severity: import_zod18.z.string(),
-    path: import_zod18.z.string(),
-    source: import_zod18.z.string().nullable().optional(),
-    parentRef: import_zod18.z.string().nullable().optional(),
-    message: import_zod18.z.string(),
-    suggestedAction: import_zod18.z.string().nullable().optional(),
-    canAutoFix: import_zod18.z.boolean()
+  import_zod19.z.object({
+    code: import_zod19.z.string(),
+    severity: import_zod19.z.string(),
+    path: import_zod19.z.string(),
+    source: import_zod19.z.string().nullable().optional(),
+    parentRef: import_zod19.z.string().nullable().optional(),
+    message: import_zod19.z.string(),
+    suggestedAction: import_zod19.z.string().nullable().optional(),
+    canAutoFix: import_zod19.z.boolean()
   }).transform((value) => ({
     ...value,
     source: value.source ?? null,
@@ -8792,37 +8794,37 @@ var osmdWikiLintIssueSchema = import_zod18.z.preprocess(
     suggestedAction: value.suggestedAction ?? null
   }))
 );
-var osmdWikiLintResultSchema = import_zod18.z.preprocess(
+var osmdWikiLintResultSchema = import_zod19.z.preprocess(
   normalizeAgentMarkdownJsonKeys,
-  import_zod18.z.object({
-    status: import_zod18.z.string(),
-    summary: import_zod18.z.object({
-      totalIssues: import_zod18.z.number().int().min(0),
-      errors: import_zod18.z.number().int().min(0),
-      warnings: import_zod18.z.number().int().min(0),
-      suggestions: import_zod18.z.number().int().min(0)
+  import_zod19.z.object({
+    status: import_zod19.z.string(),
+    summary: import_zod19.z.object({
+      totalIssues: import_zod19.z.number().int().min(0),
+      errors: import_zod19.z.number().int().min(0),
+      warnings: import_zod19.z.number().int().min(0),
+      suggestions: import_zod19.z.number().int().min(0)
     }),
-    issues: import_zod18.z.array(osmdWikiLintIssueSchema)
+    issues: import_zod19.z.array(osmdWikiLintIssueSchema)
   })
 );
-var nullableCountSchema = import_zod18.z.preprocess(
+var nullableCountSchema = import_zod19.z.preprocess(
   (value) => value === void 0 || value === null || value === "" ? null : value,
-  import_zod18.z.coerce.number().int().min(0).nullable()
+  import_zod19.z.coerce.number().int().min(0).nullable()
 ).catch(null);
-var osmdMemoryQualityIssueSchema = import_zod18.z.preprocess(
+var osmdMemoryQualityIssueSchema = import_zod19.z.preprocess(
   normalizeAgentMarkdownJsonKeys,
-  import_zod18.z.object({
-    code: import_zod18.z.string().nullable().optional(),
-    issueCode: import_zod18.z.string().nullable().optional(),
-    path: import_zod18.z.string().nullable().optional(),
-    parentRef: import_zod18.z.string().nullable().optional(),
-    dimension: import_zod18.z.string().nullable().optional(),
-    evidence: import_zod18.z.string().nullable().optional(),
-    evidenceSnippet: import_zod18.z.string().nullable().optional(),
-    message: import_zod18.z.string().nullable().optional(),
-    severity: import_zod18.z.string().nullable().optional(),
-    suggestedAction: import_zod18.z.string().nullable().optional(),
-    canAutoFix: import_zod18.z.boolean().nullable().optional()
+  import_zod19.z.object({
+    code: import_zod19.z.string().nullable().optional(),
+    issueCode: import_zod19.z.string().nullable().optional(),
+    path: import_zod19.z.string().nullable().optional(),
+    parentRef: import_zod19.z.string().nullable().optional(),
+    dimension: import_zod19.z.string().nullable().optional(),
+    evidence: import_zod19.z.string().nullable().optional(),
+    evidenceSnippet: import_zod19.z.string().nullable().optional(),
+    message: import_zod19.z.string().nullable().optional(),
+    severity: import_zod19.z.string().nullable().optional(),
+    suggestedAction: import_zod19.z.string().nullable().optional(),
+    canAutoFix: import_zod19.z.boolean().nullable().optional()
   }).passthrough().transform((value) => ({
     ...value,
     code: value.code ?? value.issueCode ?? "unknown_issue",
@@ -8837,16 +8839,16 @@ var osmdMemoryQualityIssueSchema = import_zod18.z.preprocess(
     canAutoFix: value.canAutoFix === true ? true : false
   }))
 );
-var osmdMemoryQualityOverlaySchema = import_zod18.z.preprocess(
+var osmdMemoryQualityOverlaySchema = import_zod19.z.preprocess(
   normalizeAgentMarkdownJsonKeys,
-  import_zod18.z.object({
-    path: import_zod18.z.string().nullable().optional(),
-    parentRef: import_zod18.z.string().nullable().optional(),
-    status: import_zod18.z.string().nullable().optional(),
-    score: import_zod18.z.union([import_zod18.z.number(), import_zod18.z.string()]).nullable().optional(),
-    overallScore: import_zod18.z.union([import_zod18.z.number(), import_zod18.z.string()]).nullable().optional(),
-    dimensions: import_zod18.z.unknown().nullable().optional(),
-    issues: import_zod18.z.array(osmdMemoryQualityIssueSchema).optional()
+  import_zod19.z.object({
+    path: import_zod19.z.string().nullable().optional(),
+    parentRef: import_zod19.z.string().nullable().optional(),
+    status: import_zod19.z.string().nullable().optional(),
+    score: import_zod19.z.union([import_zod19.z.number(), import_zod19.z.string()]).nullable().optional(),
+    overallScore: import_zod19.z.union([import_zod19.z.number(), import_zod19.z.string()]).nullable().optional(),
+    dimensions: import_zod19.z.unknown().nullable().optional(),
+    issues: import_zod19.z.array(osmdMemoryQualityIssueSchema).optional()
   }).passthrough().transform((value) => ({
     ...value,
     path: value.path ?? null,
@@ -8858,9 +8860,9 @@ var osmdMemoryQualityOverlaySchema = import_zod18.z.preprocess(
     issues: value.issues ?? []
   }))
 );
-var osmdMemoryQualitySummarySchema = import_zod18.z.preprocess(
+var osmdMemoryQualitySummarySchema = import_zod19.z.preprocess(
   normalizeAgentMarkdownJsonKeys,
-  import_zod18.z.object({
+  import_zod19.z.object({
     evaluatedCount: nullableCountSchema.optional(),
     passCount: nullableCountSchema.optional(),
     warnCount: nullableCountSchema.optional(),
@@ -8878,19 +8880,19 @@ var osmdMemoryQualitySummarySchema = import_zod18.z.preprocess(
     failCount: value.failCount ?? value.failures ?? null
   }))
 );
-var osmdMemoryQualityResultSchema = import_zod18.z.preprocess(
+var osmdMemoryQualityResultSchema = import_zod19.z.preprocess(
   normalizeAgentMarkdownJsonKeys,
-  import_zod18.z.object({
-    status: import_zod18.z.string(),
-    scope: import_zod18.z.string().nullable().optional(),
+  import_zod19.z.object({
+    status: import_zod19.z.string(),
+    scope: import_zod19.z.string().nullable().optional(),
     evaluatedCount: nullableCountSchema.optional(),
     passCount: nullableCountSchema.optional(),
     warnCount: nullableCountSchema.optional(),
     failCount: nullableCountSchema.optional(),
     summary: osmdMemoryQualitySummarySchema.optional(),
-    weakestOverlays: import_zod18.z.array(osmdMemoryQualityOverlaySchema).optional(),
-    issues: import_zod18.z.array(osmdMemoryQualityIssueSchema).optional(),
-    scores: import_zod18.z.array(osmdMemoryQualityOverlaySchema).optional()
+    weakestOverlays: import_zod19.z.array(osmdMemoryQualityOverlaySchema).optional(),
+    issues: import_zod19.z.array(osmdMemoryQualityIssueSchema).optional(),
+    scores: import_zod19.z.array(osmdMemoryQualityOverlaySchema).optional()
   }).passthrough().transform((value) => {
     const summary = isRecord5(value.summary) ? value.summary : null;
     return {
@@ -8914,24 +8916,24 @@ function normalizeOsmdIngestFileRecordInput(value) {
   }
   return normalized;
 }
-var osmdIngestFileRecordSchema = import_zod18.z.preprocess(
+var osmdIngestFileRecordSchema = import_zod19.z.preprocess(
   normalizeOsmdIngestFileRecordInput,
-  import_zod18.z.object({
-    path: import_zod18.z.string(),
-    source: import_zod18.z.string().nullable().optional(),
-    access: import_zod18.z.string().nullable().optional(),
-    owner: import_zod18.z.string().nullable().optional(),
-    parentRef: import_zod18.z.string().nullable().optional(),
-    exists: import_zod18.z.boolean().nullable().optional(),
-    canCreate: import_zod18.z.boolean().nullable().optional(),
-    canUpdate: import_zod18.z.boolean().nullable().optional(),
-    canAppend: import_zod18.z.boolean().nullable().optional(),
-    wikiRole: import_zod18.z.string().nullable().optional(),
-    formatVersion: import_zod18.z.string().nullable().optional(),
-    createdAt: import_zod18.z.string().nullable().optional(),
-    updatedAt: import_zod18.z.string().nullable().optional(),
-    suggestedAction: import_zod18.z.string().nullable().optional(),
-    errorCode: import_zod18.z.string().nullable().optional()
+  import_zod19.z.object({
+    path: import_zod19.z.string(),
+    source: import_zod19.z.string().nullable().optional(),
+    access: import_zod19.z.string().nullable().optional(),
+    owner: import_zod19.z.string().nullable().optional(),
+    parentRef: import_zod19.z.string().nullable().optional(),
+    exists: import_zod19.z.boolean().nullable().optional(),
+    canCreate: import_zod19.z.boolean().nullable().optional(),
+    canUpdate: import_zod19.z.boolean().nullable().optional(),
+    canAppend: import_zod19.z.boolean().nullable().optional(),
+    wikiRole: import_zod19.z.string().nullable().optional(),
+    formatVersion: import_zod19.z.string().nullable().optional(),
+    createdAt: import_zod19.z.string().nullable().optional(),
+    updatedAt: import_zod19.z.string().nullable().optional(),
+    suggestedAction: import_zod19.z.string().nullable().optional(),
+    errorCode: import_zod19.z.string().nullable().optional()
   }).passthrough().transform((value) => ({
     ...value,
     source: value.source ?? null,
@@ -8950,17 +8952,17 @@ var osmdIngestFileRecordSchema = import_zod18.z.preprocess(
     errorCode: value.errorCode ?? null
   }))
 );
-var osmdIngestResultSchema = import_zod18.z.preprocess(
+var osmdIngestResultSchema = import_zod19.z.preprocess(
   normalizeAgentMarkdownJsonKeys,
-  import_zod18.z.object({
-    rawSourceId: import_zod18.z.union([import_zod18.z.string(), import_zod18.z.number()]).nullable().optional(),
-    sourceSummaryPath: import_zod18.z.string().nullable().optional(),
+  import_zod19.z.object({
+    rawSourceId: import_zod19.z.union([import_zod19.z.string(), import_zod19.z.number()]).nullable().optional(),
+    sourceSummaryPath: import_zod19.z.string().nullable().optional(),
     sourceSummaryFile: osmdIngestFileRecordSchema.nullable().optional(),
-    slug: import_zod18.z.string().nullable().optional(),
-    runLint: import_zod18.z.boolean().nullable().optional(),
-    createdFiles: import_zod18.z.array(osmdIngestFileRecordSchema).optional(),
-    updatedFiles: import_zod18.z.array(osmdIngestFileRecordSchema).optional(),
-    skippedUpdates: import_zod18.z.array(import_zod18.z.unknown()).optional(),
+    slug: import_zod19.z.string().nullable().optional(),
+    runLint: import_zod19.z.boolean().nullable().optional(),
+    createdFiles: import_zod19.z.array(osmdIngestFileRecordSchema).optional(),
+    updatedFiles: import_zod19.z.array(osmdIngestFileRecordSchema).optional(),
+    skippedUpdates: import_zod19.z.array(import_zod19.z.unknown()).optional(),
     lintResult: osmdWikiLintResultSchema.nullable().optional()
   }).passthrough().transform((value) => ({
     ...value,
@@ -8975,37 +8977,37 @@ var osmdIngestResultSchema = import_zod18.z.preprocess(
     lintResult: value.lintResult ?? null
   }))
 );
-var mutationPayloadSchema = import_zod18.z.object({
-  ok: import_zod18.z.boolean(),
-  status: import_zod18.z.number(),
-  errorCode: import_zod18.z.string().nullable().optional(),
-  data: import_zod18.z.unknown().nullable().optional(),
-  errors: import_zod18.z.unknown().nullable().optional()
+var mutationPayloadSchema = import_zod19.z.object({
+  ok: import_zod19.z.boolean(),
+  status: import_zod19.z.number(),
+  errorCode: import_zod19.z.string().nullable().optional(),
+  data: import_zod19.z.unknown().nullable().optional(),
+  errors: import_zod19.z.unknown().nullable().optional()
 });
-var markdownTreeNodeSchema = import_zod18.z.lazy(
-  () => import_zod18.z.object({
-    toolKey: import_zod18.z.string(),
-    nodeKey: import_zod18.z.string(),
-    nodeKind: import_zod18.z.string(),
-    runtimeLabel: import_zod18.z.string(),
-    path: import_zod18.z.string().nullable().optional().transform((value) => value ?? null),
+var markdownTreeNodeSchema = import_zod19.z.lazy(
+  () => import_zod19.z.object({
+    toolKey: import_zod19.z.string(),
+    nodeKey: import_zod19.z.string(),
+    nodeKind: import_zod19.z.string(),
+    runtimeLabel: import_zod19.z.string(),
+    path: import_zod19.z.string().nullable().optional().transform((value) => value ?? null),
     source: sourceSchema,
     access: accessSchema,
     owner: ownerSchema,
-    parentRef: import_zod18.z.string().nullable().optional().transform((value) => value ?? null),
-    agentChildrenAllowed: import_zod18.z.boolean(),
-    exists: import_zod18.z.boolean(),
-    resolvedScope: import_zod18.z.object({
-      parentId: import_zod18.z.string().nullable().optional().transform((value) => value ?? null),
-      recordId: import_zod18.z.string().nullable().optional().transform((value) => value ?? null),
-      memberId: import_zod18.z.string().nullable().optional().transform((value) => value ?? null),
-      teamId: import_zod18.z.string().nullable().optional().transform((value) => value ?? null),
-      contentType: import_zod18.z.string().nullable().optional().transform((value) => value ?? null)
+    parentRef: import_zod19.z.string().nullable().optional().transform((value) => value ?? null),
+    agentChildrenAllowed: import_zod19.z.boolean(),
+    exists: import_zod19.z.boolean(),
+    resolvedScope: import_zod19.z.object({
+      parentId: import_zod19.z.string().nullable().optional().transform((value) => value ?? null),
+      recordId: import_zod19.z.string().nullable().optional().transform((value) => value ?? null),
+      memberId: import_zod19.z.string().nullable().optional().transform((value) => value ?? null),
+      teamId: import_zod19.z.string().nullable().optional().transform((value) => value ?? null),
+      contentType: import_zod19.z.string().nullable().optional().transform((value) => value ?? null)
     }),
-    isLeaf: import_zod18.z.boolean(),
-    treeView: import_zod18.z.boolean(),
-    details: import_zod18.z.unknown().nullable(),
-    children: import_zod18.z.array(markdownTreeNodeSchema).optional().transform((value) => value ?? [])
+    isLeaf: import_zod19.z.boolean(),
+    treeView: import_zod19.z.boolean(),
+    details: import_zod19.z.unknown().nullable(),
+    children: import_zod19.z.array(markdownTreeNodeSchema).optional().transform((value) => value ?? [])
   })
 );
 var AGENT_MARKDOWN_FILE_SELECTION = `{
@@ -9697,15 +9699,15 @@ function normalizeAgentFilePath(file, parentRef) {
   const trimmed = nonEmptyString3.parse(file).trim().replace(/^\/+|\/+$/g, "");
   const fileName = trimmed.startsWith(".agent/") ? trimmed.slice(".agent/".length) : trimmed;
   const isThreadWorkspace = atlasThreadWorkspaceParentRefPattern.test(parentRef);
-  const isSupportedFile = isThreadWorkspace ? /^[a-z0-9][a-z0-9-]*\.(?:md|txt)$/.test(fileName) : isSupportedAgentOverlayFileName(fileName);
+  const isSupportedFile = isThreadWorkspace ? /^[a-z0-9][a-z0-9-]*\.(?:md|txt|csv)$/.test(fileName) : isSupportedAgentOverlayFileName(fileName);
   if (fileName.includes("\\") || fileName.includes("/") || fileName === "." || fileName === ".." || !isSupportedFile) {
     throw new CliError({
-      message: isThreadWorkspace ? "Atlas task workspaces support only lowercase kebab-case .md or .txt basenames." : ".agent supports only notes.md, summary.md, or <lowercase-kebab-slug>.md.",
+      message: isThreadWorkspace ? "Atlas task workspaces support only lowercase kebab-case .md, .txt, or .csv basenames." : ".agent supports only notes.md, summary.md, or <lowercase-kebab-slug>.md.",
       kind: "invalid_args",
       status: 400,
       exitCode: EXIT_CODES.invalidArgs,
       details: {
-        supportedFiles: isThreadWorkspace ? ["<lowercase-kebab-slug>.md", "<lowercase-kebab-slug>.txt"] : [...supportedAgentOverlaySystemFiles, "<lowercase-kebab-slug>.md"]
+        supportedFiles: isThreadWorkspace ? ["<lowercase-kebab-slug>.md", "<lowercase-kebab-slug>.txt", "<lowercase-kebab-slug>.csv"] : [...supportedAgentOverlaySystemFiles, "<lowercase-kebab-slug>.md"]
       }
     });
   }
@@ -11188,7 +11190,7 @@ function positiveInt2(raw, fallback) {
 function requestTimeoutMs(totalTimeoutMs) {
   return Math.max(1e3, Math.min(totalTimeoutMs, 1e4));
 }
-function asRecord5(value) {
+function asRecord4(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function asString(value) {
@@ -11238,9 +11240,9 @@ function cliTokenFromPoll(payload) {
   return asString(payload.cliToken) ?? asString(payload.cli_token) ?? asString(payload.token);
 }
 function unwrapMutationResult(value) {
-  const record = asRecord5(value);
+  const record = asRecord4(value);
   if (!record) return null;
-  const data = asRecord5(record.data);
+  const data = asRecord4(record.data);
   if (data && (Object.prototype.hasOwnProperty.call(record, "ok") || Object.prototype.hasOwnProperty.call(record, "errors") || Object.prototype.hasOwnProperty.call(record, "errorCode") || Object.prototype.hasOwnProperty.call(record, "error_code"))) {
     return data;
   }
@@ -11305,7 +11307,7 @@ async function runTokenLogin(cmd, opts) {
       exitCode: mapStatusToExitCode(status.error.status)
     });
   }
-  const statusData = asRecord5(status.result.data.cliAuthStatus) ?? {};
+  const statusData = asRecord4(status.result.data.cliAuthStatus) ?? {};
   const storage = await writeStoredToken(token, baseUrl);
   const configPath2 = opts.saveBaseUrl ? await persistBaseUrl(baseUrl) : void 0;
   return printEnvelopeAndExit({
@@ -11522,7 +11524,7 @@ async function runLogout(cmd) {
     });
     if (result.ok) {
       requestId = result.result.requestId;
-      const payload = asRecord5(result.result.data.revokeCliToken) ?? {};
+      const payload = asRecord4(result.result.data.revokeCliToken) ?? {};
       revokedRemote = payload.ok !== false;
     } else {
       requestId = result.requestId;
@@ -11585,7 +11587,7 @@ async function runAuthStatus(cmd) {
       exitCode: mapStatusToExitCode(result.error.status)
     });
   }
-  const status = asRecord5(result.result.data.cliAuthStatus) ?? {};
+  const status = asRecord4(result.result.data.cliAuthStatus) ?? {};
   const baseAuthStatus = status.baseAuthStatus;
   return printEnvelopeAndExit({
     envelope: envelope({
@@ -11852,6 +11854,26 @@ var RECENT_TOOL_SUPPORT_REGISTRY = [
       ]
     }
   }),
+  entry({
+    cliKey: "sketches",
+    displayName: "Sketches",
+    backend: backendToolKey("sketches"),
+    routes: ["/sketches", "/sketches/[sketchId]"],
+    capabilityCategories: ["collaboration", "design", "metadata", "read_only_discovery"],
+    sensitiveOutputNotes: [
+      "Sketch commands must not print document bytes, collaboration updates, embedded files, comments, or auth material."
+    ],
+    implementation: {
+      milestone: "WAVE-12",
+      status: "implemented_command_surface",
+      enabledCommands: ["open", "list", "show", "create", "update-metadata"],
+      forbiddenCommands: ["save-document", "render", "export", "import"],
+      notes: [
+        "The Sketch surface is limited to metadata and does not provide an editor, renderer, binary transport, or provider connector.",
+        "Create and metadata update use the existing typed GraphQL mutations."
+      ]
+    }
+  }),
   entry({
     cliKey: "time-tracking",
     displayName: "Time Tracking",
@@ -12855,36 +12877,188 @@ function registerWhiteboardsCommands(program) {
     return printEnvelopeAndExit({
       envelope: {
         ok: true,
-        command: "whiteboards.open",
+        command: "whiteboards.open",
+        status: 200,
+        data,
+        error: null,
+        meta: { requestId: "local_whiteboards" }
+      }
+    });
+  });
+  addListFilterOptions2(
+    whiteboards.command("list").description("Read safe Whiteboards metadata")
+  ).action(async (opts, cmd) => {
+    await runWhiteboardsQuery(cmd, {
+      command: "whiteboards.list",
+      operationName: "Whiteboards",
+      field: "whiteboards",
+      variables: listFilters2(opts),
+      variableTypes: listVariableTypes2(),
+      isList: true,
+      selectionSet: WHITEBOARDS_SELECTION
+    });
+  });
+  whiteboards.command("show").description("Read safe Whiteboard detail metadata").requiredOption("--slug <slug>").action(async (opts, cmd) => {
+    await runWhiteboardsQuery(cmd, {
+      command: "whiteboards.show",
+      operationName: "Whiteboard",
+      field: "whiteboard",
+      variables: { slug: opts.slug },
+      variableTypes: { organization_id: "ID!", slug: "ID!" },
+      isShow: true,
+      selectionSet: WHITEBOARD_SELECTION
+    });
+  });
+}
+
+// src/commands/sketches.ts
+var SKETCH_METADATA_SELECTION = "id name slug status priority archivedAt organizationId memberId teamIds documentGeneration documentVersion partytimeRoomId partytimeRoomVersion createdAt updatedAt";
+var SKETCHES_SELECTION = `{ count currentPage totalPages data { ${SKETCH_METADATA_SELECTION} } }`;
+var SKETCH_SELECTION = `{ ${SKETCH_METADATA_SELECTION} }`;
+function baseVariables4(contextOrganizationId) {
+  return { organization_id: resolveOrganizationId(contextOrganizationId) };
+}
+function listFilters3(opts) {
+  return {
+    page: opts.page,
+    per: opts.per,
+    team_id: opts.teamId,
+    member_id: opts.memberId,
+    include_archived: opts.includeArchived
+  };
+}
+function listVariableTypes3() {
+  return {
+    organization_id: "ID!",
+    page: "Int",
+    per: "Int",
+    team_id: "ID",
+    member_id: "ID",
+    include_archived: "Boolean"
+  };
+}
+async function runSketchQuery(cmd, config) {
+  const context = await resolveCommandContext(cmd.optsWithGlobals());
+  await runGraphqlQueryCommand({
+    command: config.command,
+    operationName: config.operationName,
+    runtimeOptions: context.runtimeOptions,
+    field: config.field,
+    variables: normalizeGraphqlVariables2({
+      ...baseVariables4(context.organizationId),
+      ...config.variables
+    }),
+    ...config.variableTypes ? { variableTypes: config.variableTypes } : {},
+    ...config.isList ? { isList: true } : {},
+    ...config.isShow ? { isShow: true } : {},
+    selectionSet: config.selectionSet
+  });
+}
+function addListFilterOptions3(command) {
+  return command.option("--page <page>").option("--per <per>").option("--team-id <teamId>").option("--member-id <memberId>").option("--include-archived <includeArchived>");
+}
+function sketchOpenData() {
+  const tool = getRecentToolSupport("sketches");
+  return {
+    cliKey: "sketches",
+    displayName: "Sketches",
+    backend: {
+      toolKey: tool?.backend.toolKey ?? "sketches",
+      status: tool?.backend.status ?? "verified_wave_02",
+      sourceMilestone: tool?.backend.sourceMilestone ?? "WAVE-02"
+    },
+    route: tool?.safeRouteTargets.primaryRoute ?? "/sketches",
+    safeRouteTargets: tool?.safeRouteTargets ?? {
+      primaryRoute: "/sketches",
+      deepLinkTemplates: ["/sketches", "/sketches/[sketchId]"],
+      status: "verified_wave_03",
+      sourceMilestone: "WAVE-03"
+    },
+    implementation: {
+      enabledCommands: ["open", "list", "show", "create", "update-metadata"],
+      excludedCommands: ["save-document", "render", "export", "import"]
+    },
+    sensitiveOutputNotes: tool?.sensitiveOutputNotes ?? [
+      "Sketch commands return metadata only and never return document bytes, collaboration updates, embedded files, comments, or tokens."
+    ]
+  };
+}
+function registerSketchCommands(program) {
+  const sketches = program.command("sketches").description("Sketch metadata operations with bounded create and update support");
+  sketches.command("open").description("Return verified Sketches app routes without opening a browser").option("--readable", "Print the primary route path only").option("--json", "Emit the stable JSON envelope").action((opts) => {
+    const data = sketchOpenData();
+    if (opts.readable && !opts.json) return printTextAndExit({ text: String(data.route) });
+    return printEnvelopeAndExit({
+      envelope: {
+        ok: true,
+        command: "sketches.open",
         status: 200,
         data,
         error: null,
-        meta: { requestId: "local_whiteboards" }
+        meta: { requestId: "local_sketches" }
       }
     });
   });
-  addListFilterOptions2(
-    whiteboards.command("list").description("Read safe Whiteboards metadata")
-  ).action(async (opts, cmd) => {
-    await runWhiteboardsQuery(cmd, {
-      command: "whiteboards.list",
-      operationName: "Whiteboards",
-      field: "whiteboards",
-      variables: listFilters2(opts),
-      variableTypes: listVariableTypes2(),
-      isList: true,
-      selectionSet: WHITEBOARDS_SELECTION
-    });
-  });
-  whiteboards.command("show").description("Read safe Whiteboard detail metadata").requiredOption("--slug <slug>").action(async (opts, cmd) => {
-    await runWhiteboardsQuery(cmd, {
-      command: "whiteboards.show",
-      operationName: "Whiteboard",
-      field: "whiteboard",
+  addListFilterOptions3(sketches.command("list").description("Read safe Sketch metadata")).action(
+    async (opts, cmd) => {
+      await runSketchQuery(cmd, {
+        command: "sketches.list",
+        operationName: "Sketches",
+        field: "sketches",
+        variables: listFilters3(opts),
+        variableTypes: listVariableTypes3(),
+        isList: true,
+        selectionSet: SKETCHES_SELECTION
+      });
+    }
+  );
+  sketches.command("show").description("Read safe Sketch detail metadata").requiredOption("--slug <slug>").action(async (opts, cmd) => {
+    await runSketchQuery(cmd, {
+      command: "sketches.show",
+      operationName: "Sketch",
+      field: "sketch",
       variables: { slug: opts.slug },
       variableTypes: { organization_id: "ID!", slug: "ID!" },
       isShow: true,
-      selectionSet: WHITEBOARD_SELECTION
+      selectionSet: SKETCH_SELECTION
+    });
+  });
+  sketches.command("create").description("Create a Sketch with a required team and idempotency key").requiredOption("--data-json <dataJson>", 'Sketch JSON or {"sketch": {...}}').action(async (opts, cmd) => {
+    const context = await resolveCommandContext(cmd.optsWithGlobals());
+    const body = __testables.normalizeBody(String(opts.dataJson), "sketch");
+    assertOperationPayload("sketches.create", body);
+    await runGraphqlMutationCommand({
+      command: "sketches.create",
+      runtimeOptions: context.runtimeOptions,
+      field: "create_sketch",
+      variables: {
+        organization_id: resolveOrganizationId(context.organizationId),
+        params: body
+      },
+      variableTypes: {
+        organization_id: "ID!",
+        params: "CreateSketchParamsInput!"
+      }
+    });
+  });
+  sketches.command("update-metadata").description("Update bounded Sketch metadata; document content is never accepted").requiredOption("--id <id>").requiredOption("--data-json <dataJson>", 'Sketch metadata JSON or {"sketch": {...}}').action(async (opts, cmd) => {
+    const context = await resolveCommandContext(cmd.optsWithGlobals());
+    const body = __testables.normalizeBody(String(opts.dataJson), "sketch");
+    assertOperationPayload("sketches.update-metadata", body);
+    await runGraphqlMutationCommand({
+      command: "sketches.update-metadata",
+      runtimeOptions: context.runtimeOptions,
+      field: "update_sketch",
+      variables: {
+        organization_id: resolveOrganizationId(context.organizationId),
+        sketch_id: String(opts.id),
+        params: body
+      },
+      variableTypes: {
+        organization_id: "ID!",
+        sketch_id: "ID!",
+        params: "UpdateSketchParamsInput!"
+      }
     });
   });
 }
@@ -12919,7 +13093,7 @@ var TIME_TRACKING_FORBIDDEN_COMMANDS = [
   "payroll",
   "billing"
 ];
-function baseVariables4(contextOrganizationId) {
+function baseVariables5(contextOrganizationId) {
   return {
     organization_id: resolveOrganizationId(contextOrganizationId)
   };
@@ -12974,7 +13148,7 @@ async function runTimeTrackingQuery(cmd, config) {
     runtimeOptions: context.runtimeOptions,
     field: config.field,
     variables: normalizeGraphqlVariables2({
-      ...baseVariables4(context.organizationId),
+      ...baseVariables5(context.organizationId),
       ...config.variables
     }),
     variableTypes: config.variableTypes,
@@ -13236,11 +13410,11 @@ function sanitizePlannerJson(value) {
   }
   return output;
 }
-function asRecord6(value) {
+function asRecord5(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function readPlannerStateKey(value, keys) {
-  const record = asRecord6(value);
+  const record = asRecord5(value);
   if (!record) {
     return null;
   }
@@ -13435,6 +13609,7 @@ var MAIL_ENABLED_COMMANDS = [
   "open",
   "validate-provider",
   "workspace",
+  "relay-evidence",
   "accounts",
   "messages",
   "conversations",
@@ -13500,6 +13675,9 @@ var MAIL_SETTINGS_SELECTION = "{ id organizationId memberId defaultMailAccountId
 var MAIL_UNREAD_COUNT_SELECTION = "{ total byAccount byLabel }";
 var MAIL_SYNC_STATUS_SELECTION = "{ id status operationStatus operationToolKey accountId accountIds page per view importedCount updatedCount providerCount counts errorCode statusCode queuedAt startedAt completedAt createdAt updatedAt }";
 var MAIL_WORKSPACE_SELECTION = `{ accounts ${MAIL_ACCOUNT_SELECTION} messages ${MAIL_MESSAGES_SELECTION} labels ${MAIL_LABEL_SELECTION} snippets ${MAIL_SNIPPET_SELECTION} settings ${MAIL_SETTINGS_SELECTION} unreadCount ${MAIL_UNREAD_COUNT_SELECTION} }`;
+var MAIL_RELAY_EVIDENCE_ACCOUNT_SELECTION = "{ id provider service status connectionState syncStatus emailAddress displayName lastSyncedAt }";
+var MAIL_RELAY_EVIDENCE_MESSAGE_SELECTION = "{ id mailAccountId subject from status direction sentAt receivedAt snippet createdAt updatedAt }";
+var MAIL_RELAY_EVIDENCE_SELECTION = `{ accounts ${MAIL_RELAY_EVIDENCE_ACCOUNT_SELECTION} messages { count currentPage totalPages data ${MAIL_RELAY_EVIDENCE_MESSAGE_SELECTION} } }`;
 var OUTLOOK_PROVIDER_VALIDATION_EVIDENCE = {
   provider: "microsoft",
   oauthProviderId: "wave-microsoft-outlook",
@@ -13664,7 +13842,8 @@ function buildMailOpenData() {
       forbiddenCommands: [...MAIL_FORBIDDEN_COMMANDS]
     },
     sensitiveOutputNotes: tool?.sensitiveOutputNotes ?? [
-      "Mail commands are metadata-only and must not print message bodies, subjects, snippets, contacts, attachments, provider payloads, token material, account addresses/display names, label names/colors, snippet content, preferences, signatures, sync search text, sync error bodies, or user-authored mail content."
+      "Default Mail commands are metadata-only and must not print message bodies, subjects, snippets, contacts, attachments, provider payloads, token material, account addresses/display names, label names/colors, snippet content, preferences, signatures, sync search text, sync error bodies, or user-authored mail content.",
+      "mail relay-evidence is the explicit bounded exception for an authenticated, user-authorized relay: it exposes mailbox identity plus sender, subject, date, and snippet metadata, but never bodies, recipients, attachments, provider IDs, or token material."
     ]
   };
 }
@@ -13777,6 +13956,26 @@ function registerMailCommands(program) {
       isShow: true
     });
   });
+  addPaginationOptions(
+    mail.command("relay-evidence").description(
+      "Read bounded mailbox identity and recent message metadata for an explicitly authorized relay"
+    ).option("--account-id <accountId>")
+  ).action(async (opts, cmd) => {
+    await runMailQuery(cmd, opts, {
+      command: "mail.relay-evidence",
+      operationName: "MailRelayEvidence",
+      field: "mail_workspace",
+      variables: mailWorkspaceVariables,
+      variableTypes: {
+        organization_id: "ID!",
+        account_id: "ID",
+        page: "Int",
+        per: "Int"
+      },
+      selectionSet: MAIL_RELAY_EVIDENCE_SELECTION,
+      isShow: true
+    });
+  });
   mail.command("accounts").description("Read safe Mail account metadata").action(async (opts, cmd) => {
     await runMailQuery(cmd, opts, {
       command: "mail.accounts",
@@ -13932,14 +14131,14 @@ function registerMailCommands(program) {
 }
 
 // src/commands/phantom.ts
-var import_zod19 = require("zod");
-var nonNegativeInt4 = import_zod19.z.coerce.number().int().min(0);
-var nullableString = import_zod19.z.string().nullable().optional().transform((value) => value ?? null);
-var idString = import_zod19.z.union([import_zod19.z.string(), import_zod19.z.number()]).transform((value) => String(value));
-var nullableIdString = import_zod19.z.union([import_zod19.z.string(), import_zod19.z.number()]).nullable().optional().transform(
+var import_zod20 = require("zod");
+var nonNegativeInt4 = import_zod20.z.coerce.number().int().min(0);
+var nullableString = import_zod20.z.string().nullable().optional().transform((value) => value ?? null);
+var idString = import_zod20.z.union([import_zod20.z.string(), import_zod20.z.number()]).transform((value) => String(value));
+var nullableIdString = import_zod20.z.union([import_zod20.z.string(), import_zod20.z.number()]).nullable().optional().transform(
   (value) => value === void 0 || value === null ? null : String(value)
 );
-var jsonObject = import_zod19.z.record(import_zod19.z.string(), import_zod19.z.unknown());
+var jsonObject = import_zod20.z.record(import_zod20.z.string(), import_zod20.z.unknown());
 var PHANTOM_LEDGER_INVENTORY_SELECTION = `{
   schemaVersion
   runsCount
@@ -14152,10 +14351,10 @@ var PHANTOM_LEDGER_KEY_ALIASES = {
   content_hash: "contentHash",
   observed_at: "observedAt"
 };
-var phantomLedgerInventorySchema = import_zod19.z.preprocess(
+var phantomLedgerInventorySchema = import_zod20.z.preprocess(
   normalizePhantomLedgerKeys,
-  import_zod19.z.object({
-    schemaVersion: import_zod19.z.string(),
+  import_zod20.z.object({
+    schemaVersion: import_zod20.z.string(),
     runsCount: nonNegativeInt4,
     observationsCount: nonNegativeInt4,
     candidatesCount: nonNegativeInt4,
@@ -14165,16 +14364,16 @@ var phantomLedgerInventorySchema = import_zod19.z.preprocess(
     reportsCount: nonNegativeInt4
   })
 );
-var phantomRunSchema = import_zod19.z.preprocess(
+var phantomRunSchema = import_zod20.z.preprocess(
   normalizePhantomLedgerKeys,
-  import_zod19.z.object({
+  import_zod20.z.object({
     id: idString,
     organizationId: idString,
-    notificationId: import_zod19.z.union([import_zod19.z.string(), import_zod19.z.number()]).nullable().optional().transform(
+    notificationId: import_zod20.z.union([import_zod20.z.string(), import_zod20.z.number()]).nullable().optional().transform(
       (value) => value === void 0 || value === null ? null : String(value)
     ),
-    status: import_zod19.z.string(),
-    triggerType: import_zod19.z.string(),
+    status: import_zod20.z.string(),
+    triggerType: import_zod20.z.string(),
     startedAt: nullableString,
     completedAt: nullableString,
     scannedFileCount: nonNegativeInt4,
@@ -14184,163 +14383,163 @@ var phantomRunSchema = import_zod19.z.preprocess(
     errorCount: nonNegativeInt4,
     warningCount: nonNegativeInt4,
     errorMessage: nullableString,
-    dryRun: import_zod19.z.boolean(),
-    schemaVersion: import_zod19.z.string(),
+    dryRun: import_zod20.z.boolean(),
+    schemaVersion: import_zod20.z.string(),
     testRunId: nullableString,
     idempotencyKey: nullableString,
     ledgerMetadata: jsonObject.catch({}),
-    createdAt: import_zod19.z.string(),
-    updatedAt: import_zod19.z.string()
+    createdAt: import_zod20.z.string(),
+    updatedAt: import_zod20.z.string()
   })
 );
-var phantomRunListItemSchema = import_zod19.z.preprocess(
+var phantomRunListItemSchema = import_zod20.z.preprocess(
   normalizePhantomLedgerKeys,
-  import_zod19.z.object({
+  import_zod20.z.object({
     id: idString,
     organizationId: idString,
-    status: import_zod19.z.string(),
-    triggerType: import_zod19.z.string(),
-    dryRun: import_zod19.z.boolean(),
-    schemaVersion: import_zod19.z.string(),
+    status: import_zod20.z.string(),
+    triggerType: import_zod20.z.string(),
+    dryRun: import_zod20.z.boolean(),
+    schemaVersion: import_zod20.z.string(),
     testRunId: nullableString,
-    createdAt: import_zod19.z.string(),
-    updatedAt: import_zod19.z.string()
+    createdAt: import_zod20.z.string(),
+    updatedAt: import_zod20.z.string()
   })
 );
-var phantomReportSchema = import_zod19.z.preprocess(
+var phantomReportSchema = import_zod20.z.preprocess(
   normalizePhantomLedgerKeys,
-  import_zod19.z.object({
+  import_zod20.z.object({
     id: idString,
     organizationId: idString,
     phantomRunId: idString,
-    status: import_zod19.z.string(),
-    reportType: import_zod19.z.string(),
-    schemaVersion: import_zod19.z.string(),
+    status: import_zod20.z.string(),
+    reportType: import_zod20.z.string(),
+    schemaVersion: import_zod20.z.string(),
     markdownPath: nullableString,
     payload: jsonObject.catch({}),
     testRunId: nullableString,
-    idempotencyKey: import_zod19.z.string(),
-    createdAt: import_zod19.z.string(),
-    updatedAt: import_zod19.z.string()
+    idempotencyKey: import_zod20.z.string(),
+    createdAt: import_zod20.z.string(),
+    updatedAt: import_zod20.z.string()
   })
 );
-var phantomObservationSchema = import_zod19.z.preprocess(
+var phantomObservationSchema = import_zod20.z.preprocess(
   normalizePhantomLedgerKeys,
-  import_zod19.z.object({
+  import_zod20.z.object({
     id: idString,
     organizationId: idString,
     phantomRunId: idString,
-    status: import_zod19.z.string(),
-    observationType: import_zod19.z.string(),
+    status: import_zod20.z.string(),
+    observationType: import_zod20.z.string(),
     targetType: nullableString,
     targetId: nullableString,
     sourceTable: nullableString,
     sourceRecordId: nullableString,
     sourceEventId: nullableString,
     contentHash: nullableString,
-    observedAt: import_zod19.z.string(),
-    confidence: import_zod19.z.coerce.number(),
+    observedAt: import_zod20.z.string(),
+    confidence: import_zod20.z.coerce.number(),
     payload: jsonObject.catch({}),
-    schemaVersion: import_zod19.z.string(),
+    schemaVersion: import_zod20.z.string(),
     testRunId: nullableString,
-    idempotencyKey: import_zod19.z.string(),
-    createdAt: import_zod19.z.string(),
-    updatedAt: import_zod19.z.string()
+    idempotencyKey: import_zod20.z.string(),
+    createdAt: import_zod20.z.string(),
+    updatedAt: import_zod20.z.string()
   })
 );
-var phantomCandidateSchema = import_zod19.z.preprocess(
+var phantomCandidateSchema = import_zod20.z.preprocess(
   normalizePhantomLedgerKeys,
-  import_zod19.z.object({
+  import_zod20.z.object({
     id: idString,
     organizationId: idString,
     phantomRunId: idString,
     phantomObservationId: nullableString,
-    status: import_zod19.z.string(),
-    candidateType: import_zod19.z.string(),
+    status: import_zod20.z.string(),
+    candidateType: import_zod20.z.string(),
     targetType: nullableString,
     targetId: nullableString,
     title: nullableString,
-    dryRun: import_zod19.z.boolean(),
+    dryRun: import_zod20.z.boolean(),
     payload: jsonObject.catch({}),
-    approvalStatus: import_zod19.z.string(),
+    approvalStatus: import_zod20.z.string(),
     approvedById: nullableIdString,
     approvedAt: nullableString,
     approvalSource: nullableString,
     approvalReason: nullableString,
     approvalMetadata: jsonObject.catch({}),
-    schemaVersion: import_zod19.z.string(),
+    schemaVersion: import_zod20.z.string(),
     testRunId: nullableString,
-    idempotencyKey: import_zod19.z.string(),
-    createdAt: import_zod19.z.string(),
-    updatedAt: import_zod19.z.string()
+    idempotencyKey: import_zod20.z.string(),
+    createdAt: import_zod20.z.string(),
+    updatedAt: import_zod20.z.string()
   })
 );
-var phantomCandidateEvidenceSchema = import_zod19.z.preprocess(
+var phantomCandidateEvidenceSchema = import_zod20.z.preprocess(
   normalizePhantomLedgerKeys,
-  import_zod19.z.object({
+  import_zod20.z.object({
     id: idString,
     organizationId: idString,
     phantomCandidateId: idString,
     phantomObservationId: nullableString,
-    evidenceType: import_zod19.z.string(),
+    evidenceType: import_zod20.z.string(),
     sourceType: nullableString,
     sourceId: nullableString,
     contentHash: nullableString,
     payload: jsonObject.catch({}),
-    schemaVersion: import_zod19.z.string(),
+    schemaVersion: import_zod20.z.string(),
     testRunId: nullableString,
-    idempotencyKey: import_zod19.z.string(),
-    createdAt: import_zod19.z.string(),
-    updatedAt: import_zod19.z.string()
+    idempotencyKey: import_zod20.z.string(),
+    createdAt: import_zod20.z.string(),
+    updatedAt: import_zod20.z.string()
   })
 );
-var phantomValidationSchema = import_zod19.z.preprocess(
+var phantomValidationSchema = import_zod20.z.preprocess(
   normalizePhantomLedgerKeys,
-  import_zod19.z.object({
+  import_zod20.z.object({
     id: idString,
     organizationId: idString,
     phantomRunId: idString,
     phantomCandidateId: idString,
-    status: import_zod19.z.string(),
-    validationType: import_zod19.z.string(),
-    dryRun: import_zod19.z.boolean(),
+    status: import_zod20.z.string(),
+    validationType: import_zod20.z.string(),
+    dryRun: import_zod20.z.boolean(),
     payload: jsonObject.catch({}),
     resultPayload: jsonObject.catch({}),
-    schemaVersion: import_zod19.z.string(),
+    schemaVersion: import_zod20.z.string(),
     testRunId: nullableString,
-    idempotencyKey: import_zod19.z.string(),
-    createdAt: import_zod19.z.string(),
-    updatedAt: import_zod19.z.string()
+    idempotencyKey: import_zod20.z.string(),
+    createdAt: import_zod20.z.string(),
+    updatedAt: import_zod20.z.string()
   })
 );
-var phantomApplyOperationSchema = import_zod19.z.preprocess(
+var phantomApplyOperationSchema = import_zod20.z.preprocess(
   normalizePhantomLedgerKeys,
-  import_zod19.z.object({
+  import_zod20.z.object({
     id: idString,
     organizationId: idString,
     phantomRunId: idString,
     phantomCandidateId: idString,
-    status: import_zod19.z.string(),
-    operationType: import_zod19.z.string(),
-    dryRun: import_zod19.z.boolean(),
+    status: import_zod20.z.string(),
+    operationType: import_zod20.z.string(),
+    dryRun: import_zod20.z.boolean(),
     targetType: nullableString,
     targetId: nullableString,
     payload: jsonObject.catch({}),
     resultPayload: jsonObject.catch({}),
-    schemaVersion: import_zod19.z.string(),
+    schemaVersion: import_zod20.z.string(),
     testRunId: nullableString,
-    idempotencyKey: import_zod19.z.string(),
-    createdAt: import_zod19.z.string(),
-    updatedAt: import_zod19.z.string()
+    idempotencyKey: import_zod20.z.string(),
+    createdAt: import_zod20.z.string(),
+    updatedAt: import_zod20.z.string()
   })
 );
-var phantomRunsSchema = import_zod19.z.array(phantomRunListItemSchema);
-var phantomReportsSchema = import_zod19.z.array(phantomReportSchema);
-var phantomObservationsSchema = import_zod19.z.array(phantomObservationSchema);
-var phantomCandidatesSchema = import_zod19.z.array(phantomCandidateSchema);
-var phantomCandidateEvidencesSchema = import_zod19.z.array(phantomCandidateEvidenceSchema);
-var phantomValidationsSchema = import_zod19.z.array(phantomValidationSchema);
-var phantomApplyOperationsSchema = import_zod19.z.array(phantomApplyOperationSchema);
+var phantomRunsSchema = import_zod20.z.array(phantomRunListItemSchema);
+var phantomReportsSchema = import_zod20.z.array(phantomReportSchema);
+var phantomObservationsSchema = import_zod20.z.array(phantomObservationSchema);
+var phantomCandidatesSchema = import_zod20.z.array(phantomCandidateSchema);
+var phantomCandidateEvidencesSchema = import_zod20.z.array(phantomCandidateEvidenceSchema);
+var phantomValidationsSchema = import_zod20.z.array(phantomValidationSchema);
+var phantomApplyOperationsSchema = import_zod20.z.array(phantomApplyOperationSchema);
 function isRecord6(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
@@ -15818,7 +16017,7 @@ var URL_OR_TRANSPORT_KEY = /(?:^|_)(?:url|uri|token|nonce|post_fields|postfields
 function isRecord7(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
-function asNonEmptyString6(value) {
+function asNonEmptyString5(value) {
   if (typeof value !== "string") return null;
   const trimmed = value.trim();
   return trimmed.length > 0 ? trimmed : null;
@@ -15863,7 +16062,7 @@ function parseCreatePayload(raw, mode) {
     ["name", "subject", "message", "expires_at", "visibility", "metadata", "recipients"],
     "--data-json"
   );
-  const parsedMode = asNonEmptyString6(mode);
+  const parsedMode = asNonEmptyString5(mode);
   if (parsedMode !== "request" && parsedMode !== "self_sign") {
     throw new CliError({
       message: "signatures create requires --mode request or --mode self_sign.",
@@ -15881,9 +16080,9 @@ function parseUpdatePayload(raw, options) {
     ["name", "subject", "message", "expires_at", "visibility", "recipients", "fields"],
     "--data-json"
   );
-  const name = asNonEmptyString6(options.name);
-  const subject = asNonEmptyString6(options.subject);
-  const message = asNonEmptyString6(options.message);
+  const name = asNonEmptyString5(options.name);
+  const subject = asNonEmptyString5(options.subject);
+  const message = asNonEmptyString5(options.message);
   const patch = {
     ...data,
     ...name ? { name } : {},
@@ -16018,8 +16217,8 @@ function requireUploadTarget(payload) {
       exitCode: EXIT_CODES.networkOrUpstream
     });
   }
-  const postUrl = asNonEmptyString6(attributes.postUrl);
-  const fileKey = asNonEmptyString6(attributes.getUrl);
+  const postUrl = asNonEmptyString5(attributes.postUrl);
+  const fileKey = asNonEmptyString5(attributes.getUrl);
   const rawPostFields = attributes.postFields;
   if (!postUrl || !fileKey || !isRecord7(rawPostFields) || !fileKey.startsWith("uploads/signatures/")) {
     throw new CliError({
@@ -16269,72 +16468,72 @@ function registerSignatureCommands(program) {
 }
 
 // src/commands/atlasAuthoring.ts
-var import_zod20 = require("zod");
-var idSchema15 = import_zod20.z.string().trim().min(1);
-var idempotencyKeySchema = import_zod20.z.string().min(1).refine((value) => value.trim() === value, "Idempotency key must not have leading or trailing whitespace.");
-var skillScopeSchema = import_zod20.z.enum(["ADMIN_GLOBAL", "MEMBER_PERSONAL"]);
-var isoDateSchema = import_zod20.z.iso.date();
-var nonEmptyStringSchema = import_zod20.z.string().trim().min(1);
+var import_zod21 = require("zod");
+var idSchema15 = import_zod21.z.string().trim().min(1);
+var idempotencyKeySchema = import_zod21.z.string().min(1).refine((value) => value.trim() === value, "Idempotency key must not have leading or trailing whitespace.");
+var skillScopeSchema = import_zod21.z.enum(["ADMIN_GLOBAL", "MEMBER_PERSONAL"]);
+var isoDateSchema = import_zod21.z.iso.date();
+var nonEmptyStringSchema = import_zod21.z.string().trim().min(1);
 var AUTOMATION_RUN_HTTP_TIMEOUT_MS = 6e4;
-var agentToolAccessSchema = import_zod20.z.array(
-  import_zod20.z.object({
+var agentToolAccessSchema = import_zod21.z.array(
+  import_zod21.z.object({
     tool_key: nonEmptyStringSchema,
     scope_value: nonEmptyStringSchema
   }).strict()
 ).min(1);
 var agentToolAccessUpdateSchema = agentToolAccessSchema.min(0);
-var agentPluginConnectionsSchema = import_zod20.z.array(
-  import_zod20.z.object({
+var agentPluginConnectionsSchema = import_zod21.z.array(
+  import_zod21.z.object({
     external_tool_connection_id: nonEmptyStringSchema,
     tool_key: nonEmptyStringSchema,
     scope_value: nonEmptyStringSchema.optional(),
-    allowed_tools: import_zod20.z.array(nonEmptyStringSchema).optional(),
-    allowed_scopes: import_zod20.z.array(nonEmptyStringSchema).optional(),
-    requires_confirmation: import_zod20.z.boolean().optional(),
-    enabled: import_zod20.z.boolean().optional()
+    allowed_tools: import_zod21.z.array(nonEmptyStringSchema).optional(),
+    allowed_scopes: import_zod21.z.array(nonEmptyStringSchema).optional(),
+    requires_confirmation: import_zod21.z.boolean().optional(),
+    enabled: import_zod21.z.boolean().optional()
   }).strict()
 ).min(1);
-var agentPluginConnectionUpdateSchema = import_zod20.z.array(
-  import_zod20.z.union([
-    import_zod20.z.object({
+var agentPluginConnectionUpdateSchema = import_zod21.z.array(
+  import_zod21.z.union([
+    import_zod21.z.object({
       id: nonEmptyStringSchema,
-      _destroy: import_zod20.z.literal(true)
+      _destroy: import_zod21.z.literal(true)
     }).strict(),
-    import_zod20.z.object({
+    import_zod21.z.object({
       id: nonEmptyStringSchema.optional(),
       external_tool_connection_id: nonEmptyStringSchema.optional(),
       tool_key: nonEmptyStringSchema.optional(),
       scope_value: nonEmptyStringSchema.optional(),
-      allowed_tools: import_zod20.z.array(nonEmptyStringSchema).optional(),
-      allowed_scopes: import_zod20.z.array(nonEmptyStringSchema).optional(),
-      requires_confirmation: import_zod20.z.boolean().optional(),
-      enabled: import_zod20.z.boolean().optional()
+      allowed_tools: import_zod21.z.array(nonEmptyStringSchema).optional(),
+      allowed_scopes: import_zod21.z.array(nonEmptyStringSchema).optional(),
+      requires_confirmation: import_zod21.z.boolean().optional(),
+      enabled: import_zod21.z.boolean().optional()
     }).strict().superRefine((value, context) => {
       if (value.id || value.external_tool_connection_id && value.tool_key) return;
       context.addIssue({
-        code: import_zod20.z.ZodIssueCode.custom,
+        code: import_zod21.z.ZodIssueCode.custom,
         message: "Plugin updates require an id, or both external_tool_connection_id and tool_key for a new grant."
       });
     })
   ])
 );
-var agentTriggerSchema = import_zod20.z.object({
-  trigger_type: import_zod20.z.literal("cron"),
+var agentTriggerSchema = import_zod21.z.object({
+  trigger_type: import_zod21.z.literal("cron"),
   cron_expression: nonEmptyStringSchema,
   timezone: nonEmptyStringSchema,
-  starts_at: import_zod20.z.iso.datetime({ offset: true }).nullable().optional(),
-  ends_at: import_zod20.z.iso.datetime({ offset: true }).nullable().optional(),
-  max_runs: import_zod20.z.number().int().positive().nullable().optional(),
-  enabled: import_zod20.z.boolean().optional()
+  starts_at: import_zod21.z.iso.datetime({ offset: true }).nullable().optional(),
+  ends_at: import_zod21.z.iso.datetime({ offset: true }).nullable().optional(),
+  max_runs: import_zod21.z.number().int().positive().nullable().optional(),
+  enabled: import_zod21.z.boolean().optional()
 }).strict();
-var agentTriggerUpdateSchema = import_zod20.z.union([
+var agentTriggerUpdateSchema = import_zod21.z.union([
   agentTriggerSchema.extend({ id: nonEmptyStringSchema.optional() }).strict(),
-  import_zod20.z.object({
+  import_zod21.z.object({
     id: nonEmptyStringSchema,
-    _destroy: import_zod20.z.literal(true)
+    _destroy: import_zod21.z.literal(true)
   }).strict()
 ]);
-var automationConfigSchema = import_zod20.z.record(import_zod20.z.string(), import_zod20.z.unknown());
+var automationConfigSchema = import_zod21.z.record(import_zod21.z.string(), import_zod21.z.unknown());
 var AGENT_SELECTION = `{
   id
   type
@@ -16490,7 +16689,7 @@ var AUTOMATION_RUN_STATUS_SELECTION = `{
   queuedAt
   completedAt
 }`;
-function asRecord7(value) {
+function asRecord6(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function asRequiredString(value) {
@@ -16521,7 +16720,7 @@ function requirePaginationInteger(value, key, minimum) {
   });
 }
 function normalizeAutomationList(payload) {
-  const page = asRecord7(payload);
+  const page = asRecord6(payload);
   if (!page || !Array.isArray(page.data)) {
     throw new CliError({
       message: "Automation list response did not include a paginated data collection.",
@@ -16532,8 +16731,8 @@ function normalizeAutomationList(payload) {
   }
   const rows = page.data;
   const data = rows.map((value) => {
-    const row = asRecord7(value);
-    const attributes = asRecord7(row?.attributes);
+    const row = asRecord6(value);
+    const attributes = asRecord6(row?.attributes);
     if (!row || !attributes) {
       throw new CliError({
         message: "Automation list response included a malformed automation record.",
@@ -16618,13 +16817,13 @@ function parseJsonOption(value, optionName, schema) {
   return schema.parse(parseJson(String(value), optionName));
 }
 function normalizePersistedCreatePayload(payload) {
-  const mutation = asRecord7(payload);
-  const mutationData = asRecord7(mutation?.data);
-  const persisted = asRecord7(mutationData?.data) ?? mutationData;
-  const attributes = asRecord7(persisted?.attributes);
-  const automationExecution = asRecord7(attributes?.automation_execution) ?? asRecord7(attributes?.automationExecution);
-  const meta = asRecord7(mutationData?.meta);
-  const idempotency = asRecord7(meta?.atlas_idempotency);
+  const mutation = asRecord6(payload);
+  const mutationData = asRecord6(mutation?.data);
+  const persisted = asRecord6(mutationData?.data) ?? mutationData;
+  const attributes = asRecord6(persisted?.attributes);
+  const automationExecution = asRecord6(attributes?.automation_execution) ?? asRecord6(attributes?.automationExecution);
+  const meta = asRecord6(mutationData?.meta);
+  const idempotency = asRecord6(meta?.atlas_idempotency);
   const id = asRequiredString(persisted?.id);
   const slug = asRequiredString(persisted?.slug) ?? asRequiredString(attributes?.slug);
   const replay = idempotency?.replay;
@@ -16655,10 +16854,10 @@ function normalizePersistedCreatePayload(payload) {
   };
 }
 function normalizePersistedUpdatePayload(payload) {
-  const mutation = asRecord7(payload);
-  const mutationData = asRecord7(mutation?.data);
-  const persisted = asRecord7(mutationData?.data) ?? mutationData;
-  const attributes = asRecord7(persisted?.attributes);
+  const mutation = asRecord6(payload);
+  const mutationData = asRecord6(mutation?.data);
+  const persisted = asRecord6(mutationData?.data) ?? mutationData;
+  const attributes = asRecord6(persisted?.attributes);
   const id = asRequiredString(persisted?.id);
   const slug = asRequiredString(persisted?.slug) ?? asRequiredString(attributes?.slug);
   const updateVersion = asRequiredString(persisted?.updateVersion) ?? asRequiredString(attributes?.updateVersion) ?? asRequiredString(attributes?.update_version);
@@ -16679,7 +16878,7 @@ function normalizePersistedUpdatePayload(payload) {
   };
 }
 function normalizeAutomationRunPayload(payload) {
-  const mutation = asRecord7(payload);
+  const mutation = asRecord6(payload);
   if (!mutation) {
     throw new CliError({
       message: "Automation run response did not include a mutation payload.",
@@ -16697,7 +16896,7 @@ function normalizeAutomationRunPayload(payload) {
       data: mutation.data ?? null
     };
   }
-  const data = asRecord7(mutation.data);
+  const data = asRecord6(mutation.data);
   const automationTaskId = asRequiredString(data?.automation_task_id);
   const automationTaskSlug = asRequiredString(data?.automation_task_slug);
   const agentId = asRequiredString(data?.agent_id);
@@ -17012,7 +17211,7 @@ function registerAtlasAuthoringCommands(program) {
     "--service <service>",
     "Supported service: gmail, calendar, slack, or stripe"
   ).action(async (opts, cmd) => {
-    const service = import_zod20.z.enum(["gmail", "calendar", "slack", "stripe"]).parse(opts.service);
+    const service = import_zod21.z.enum(["gmail", "calendar", "slack", "stripe"]).parse(opts.service);
     const context = await resolveCommandContext(cmd.optsWithGlobals());
     const organizationId = resolveOrganizationId(context.organizationId);
     await runGraphqlQueryCommand({
@@ -17297,6 +17496,15 @@ var VARIABLE_TYPES = {
   organization_id: "ID!",
   member_id: "ID"
 };
+var ACTIVITY_VARIABLE_TYPES = {
+  ...VARIABLE_TYPES,
+  start_at: "ISO8601DateTime!",
+  end_at: "ISO8601DateTime!"
+};
+var MEMBER_STATUSES_VARIABLE_TYPES = {
+  organization_id: "ID!",
+  member_ids: "[ID!]!"
+};
 function parseRecentLimit(value) {
   const limit = Number(value);
   if (!Number.isInteger(limit) || limit < 1 || limit > 50) {
@@ -17304,6 +17512,25 @@ function parseRecentLimit(value) {
   }
   return limit;
 }
+function parseIsoDateTime(optionName, value) {
+  const timestamp = Date.parse(value);
+  if (!Number.isFinite(timestamp) || !value.includes("T")) {
+    throw new Error(`${optionName} must be an ISO 8601 date-time`);
+  }
+  return value;
+}
+function validateActivityRange(startAt, endAt) {
+  if (Date.parse(endAt) <= Date.parse(startAt)) {
+    throw new Error("end-at must be after start-at");
+  }
+}
+function parseMemberIds(value) {
+  const memberIds = [...new Set(value.split(",").map((id) => id.trim()).filter(Boolean))];
+  if (memberIds.length < 1 || memberIds.length > 100) {
+    throw new Error("member-ids must contain between 1 and 100 unique member IDs");
+  }
+  return memberIds;
+}
 async function runDesktopContextQuery(cmd, params) {
   const context = await resolveCommandContext(cmd.optsWithGlobals());
   await runGraphqlQueryCommand({
@@ -17314,9 +17541,12 @@ async function runDesktopContextQuery(cmd, params) {
     variables: normalizeGraphqlVariables2({
       organization_id: resolveOrganizationId(context.organizationId),
       member_id: params.memberId,
-      limit: params.limit
+      member_ids: params.memberIds,
+      limit: params.limit,
+      start_at: params.startAt,
+      end_at: params.endAt
     }),
-    variableTypes: {
+    variableTypes: params.command === "desktop-context.activity" ? ACTIVITY_VARIABLE_TYPES : params.command === "desktop-context.member-statuses" ? MEMBER_STATUSES_VARIABLE_TYPES : {
       ...VARIABLE_TYPES,
       ...params.command === "desktop-context.recent" ? { limit: "Int" } : {}
     },
@@ -17334,6 +17564,18 @@ function registerDesktopContextCommands(program) {
       memberId: opts.memberId
     });
   });
+  desktopContext.command("member-statuses").description("Read capture and enrollment status for up to 100 organization members").requiredOption(
+    "--member-ids <memberIds>",
+    "Comma-separated organization member IDs (1-100)",
+    parseMemberIds
+  ).action(async (opts, cmd) => {
+    await runDesktopContextQuery(cmd, {
+      command: "desktop-context.member-statuses",
+      operationName: "DesktopContextMemberStatuses",
+      field: "desktop_context_member_statuses",
+      memberIds: opts.memberIds
+    });
+  });
   desktopContext.command("recent").description("Read recent sanitized evidence excerpts").option("--member-id <memberId>", "Member scope; defaults to the authenticated member").option("--limit <limit>", "Maximum observations (1-50)", parseRecentLimit).action(async (opts, cmd) => {
     await runDesktopContextQuery(cmd, {
       command: "desktop-context.recent",
@@ -17343,6 +17585,380 @@ function registerDesktopContextCommands(program) {
       limit: opts.limit
     });
   });
+  desktopContext.command("activity").description("Read canonical active, AFK, gap, and app duration for a bounded range").requiredOption(
+    "--start-at <dateTime>",
+    "Inclusive ISO 8601 range start",
+    (value) => parseIsoDateTime("start-at", value)
+  ).requiredOption(
+    "--end-at <dateTime>",
+    "Exclusive ISO 8601 range end",
+    (value) => parseIsoDateTime("end-at", value)
+  ).option("--member-id <memberId>", "Member scope; defaults to the authenticated member").action(async (opts, cmd) => {
+    validateActivityRange(opts.startAt, opts.endAt);
+    await runDesktopContextQuery(cmd, {
+      command: "desktop-context.activity",
+      operationName: "DesktopContextActivity",
+      field: "desktop_context_activity_summary",
+      memberId: opts.memberId,
+      startAt: opts.startAt,
+      endAt: opts.endAt
+    });
+  });
+}
+
+// src/commands/dataPipeline.ts
+var MAX_PARAMETERS_JSON_BYTES = 16384;
+var SECRET_LIKE_PARAMETER_KEY = /(?:^|_)(?:api_?key|authorization|credential|password|secret|token)(?:$|_)/i;
+var UNSAFE_PARAMETER_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var ORGANIZATION_VARIABLE_TYPES = {
+  organization_id: "ID!"
+};
+var SOURCES_VARIABLE_TYPES = {
+  ...ORGANIZATION_VARIABLE_TYPES,
+  category_key: "String!"
+};
+var SOURCE_ACTIONS_VARIABLE_TYPES = {
+  ...ORGANIZATION_VARIABLE_TYPES,
+  source_id: "ID!"
+};
+var EXECUTE_SOURCE_ACTION_VARIABLE_TYPES = {
+  ...SOURCE_ACTIONS_VARIABLE_TYPES,
+  category_key: "String!",
+  provider_key: "String!",
+  action_key: "String!",
+  parameters: "JSON"
+};
+var PROVIDER_SELECTION = `
+organizationPluginId
+key
+name
+categories
+availability
+integrationKey
+connectorProvider
+connectorService
+logoAssetPath
+`.trim();
+var OVERVIEW_SELECTION = `
+{
+totalSourceCount
+connectedSourceCount
+categoriesConfiguredCount
+actionRequiredCount
+categories {
+  key
+  name
+  description
+  iconKey
+  sortOrder
+  allowedSourceTypes
+  suggestedSourceLabels
+  sourceCount
+  activeSourceCount
+  attentionSourceCount
+  status
+  providers {
+    ${PROVIDER_SELECTION}
+  }
+}
+}
+`.trim();
+var SOURCE_SELECTION = `
+{
+id
+type
+organizationId
+categoryKey
+sourceType
+providerKey
+organizationPluginId
+name
+url
+status
+connection
+configuration
+metadata
+lastSyncedAt
+lastSuccessfulSyncAt
+lastErrorAt
+lastErrorMessage
+createdById
+createdAt
+updatedAt
+}
+`.trim();
+var SOURCE_ACTION_SELECTION = `
+{
+key
+displayName
+inputSchema
+safetyClass
+requiresApproval
+}
+`.trim();
+var SOURCE_ACTION_RESULT_SELECTION = `
+{
+ok
+status
+errorCode
+errors
+traceId
+organizationId
+categoryKey
+providerKey
+sourceId
+actionKey
+records
+pageInfo
+metadata
+}
+`.trim();
+function invalidParameters(message, details = {}) {
+  return new CliError({
+    message,
+    kind: "invalid_args",
+    status: 400,
+    exitCode: EXIT_CODES.invalidArgs,
+    details
+  });
+}
+function parseNonBlank(value, optionName) {
+  const parsed = value.trim();
+  if (!parsed) {
+    throw invalidParameters(`${optionName} must not be blank`);
+  }
+  return parsed;
+}
+function parseCategoryKey(value) {
+  return parseNonBlank(value, "category-key");
+}
+function secretLikeParameterPath(value, path = []) {
+  if (!value || typeof value !== "object") return null;
+  if (Array.isArray(value)) {
+    for (let index = 0; index < value.length; index += 1) {
+      const nestedPath = secretLikeParameterPath(value[index], [...path, String(index)]);
+      if (nestedPath) return nestedPath;
+    }
+    return null;
+  }
+  for (const [key, nestedValue] of Object.entries(value)) {
+    const keyPath = [...path, key];
+    if (UNSAFE_PARAMETER_KEYS.has(key) || SECRET_LIKE_PARAMETER_KEY.test(key)) {
+      return keyPath.join(".");
+    }
+    const nestedPath = secretLikeParameterPath(nestedValue, keyPath);
+    if (nestedPath) return nestedPath;
+  }
+  return null;
+}
+function parseSourceActionParameters(raw) {
+  if (Buffer.byteLength(raw, "utf8") > MAX_PARAMETERS_JSON_BYTES) {
+    throw invalidParameters(
+      `parameters-json must not exceed ${MAX_PARAMETERS_JSON_BYTES} bytes`
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw invalidParameters("parameters-json must be a valid JSON object");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw invalidParameters("parameters-json must be a JSON object");
+  }
+  const secretPath = secretLikeParameterPath(parsed);
+  if (secretPath) {
+    throw invalidParameters(
+      `parameters-json contains a secret-like parameter key: ${secretPath}`,
+      { parameterPath: secretPath }
+    );
+  }
+  return parsed;
+}
+function isJsonRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function sourceActionFailureKind(errorCode, status) {
+  if (errorCode === "AUTH_REQUIRED" || errorCode === "UNAUTHORIZED") return "missing_auth";
+  if (errorCode === "NOT_FOUND") return "not_found";
+  if (errorCode === "PROVIDER_ERROR") return "upstream_error";
+  if (errorCode === "ACTION_NOT_ALLOWED") return "forbidden";
+  if (errorCode === "INVALID_INPUT" || errorCode === "INVALID_SOURCE") {
+    return "validation";
+  }
+  if (status === 403) return "forbidden";
+  if (status === 404) return "not_found";
+  if (status >= 500) return "upstream_error";
+  if (status === 400 || status === 422) return "validation";
+  return "generic_error";
+}
+function sourceActionFailureExitCode(kind, status) {
+  if (kind === "missing_auth") return EXIT_CODES.missingOrInvalidAuth;
+  if (kind === "forbidden") return EXIT_CODES.forbidden;
+  if (kind === "not_found") return EXIT_CODES.notFound;
+  if (kind === "validation") return EXIT_CODES.validationFailure;
+  if (kind === "upstream_error" || kind === "malformed_response") {
+    return EXIT_CODES.networkOrUpstream;
+  }
+  return mapStatusToExitCode(status);
+}
+function transformSourceActionResult(value) {
+  if (!isJsonRecord(value) || typeof value.ok !== "boolean") {
+    throw new CliError({
+      message: "Data Pipeline source action returned a malformed response",
+      kind: "malformed_response",
+      status: 502,
+      exitCode: EXIT_CODES.networkOrUpstream
+    });
+  }
+  if (value.ok) return value;
+  const status = typeof value.status === "number" && Number.isInteger(value.status) ? value.status : 500;
+  const errorCode = typeof value.errorCode === "string" && value.errorCode.length > 0 ? value.errorCode.toUpperCase() : "SOURCE_ACTION_FAILED";
+  const errors = Array.isArray(value.errors) ? value.errors.filter((error) => typeof error === "string") : [];
+  const traceId = typeof value.traceId === "string" ? value.traceId : null;
+  const kind = sourceActionFailureKind(errorCode, status);
+  throw new CliError({
+    message: errors.find((error) => error.trim().length > 0) ?? "Data Pipeline source action failed",
+    kind,
+    status,
+    exitCode: sourceActionFailureExitCode(kind, status),
+    details: { errorCode, traceId, errors }
+  });
+}
+function transformSourceActions(value) {
+  if (!Array.isArray(value)) {
+    throw new CliError({
+      message: "Data Pipeline source action discovery returned a malformed response",
+      kind: "malformed_response",
+      status: 502,
+      exitCode: EXIT_CODES.networkOrUpstream
+    });
+  }
+  for (const action of value) {
+    if (!isJsonRecord(action) || typeof action.key !== "string") {
+      throw new CliError({
+        message: "Data Pipeline source action discovery returned a malformed action",
+        kind: "malformed_response",
+        status: 502,
+        exitCode: EXIT_CODES.networkOrUpstream
+      });
+    }
+    if (action.safetyClass !== "read_only" || action.requiresApproval !== false) {
+      throw new CliError({
+        message: `Data Pipeline source action discovery returned a non-read-only action: ${action.key}`,
+        kind: "malformed_response",
+        status: 502,
+        exitCode: EXIT_CODES.networkOrUpstream,
+        details: {
+          actionKey: action.key,
+          safetyClass: action.safetyClass,
+          requiresApproval: action.requiresApproval
+        }
+      });
+    }
+  }
+  return value;
+}
+function registerDataPipelineCommands(program) {
+  const dataPipeline = program.command("data-pipeline").description("Inspect the organization's configured Data Pipeline control plane");
+  dataPipeline.command("overview").description("Read source counts, category status, and available organization plugins").action(async (_opts, cmd) => {
+    const context = await resolveCommandContext(cmd.optsWithGlobals());
+    await runGraphqlQueryCommand({
+      command: "data-pipeline.overview",
+      operationName: "DataPipelineOverview",
+      runtimeOptions: context.runtimeOptions,
+      field: "data_pipeline_overview",
+      variables: {
+        organization_id: resolveOrganizationId(context.organizationId)
+      },
+      variableTypes: ORGANIZATION_VARIABLE_TYPES,
+      isShow: true,
+      selectionSet: OVERVIEW_SELECTION
+    });
+  });
+  dataPipeline.command("sources").description("Read the saved source records configured for one Data Pipeline category").requiredOption(
+    "--category-key <categoryKey>",
+    "Data Pipeline category key from the overview response",
+    parseCategoryKey
+  ).action(async (opts, cmd) => {
+    const context = await resolveCommandContext(cmd.optsWithGlobals());
+    await runGraphqlQueryCommand({
+      command: "data-pipeline.sources",
+      operationName: "DataPipelineSources",
+      runtimeOptions: context.runtimeOptions,
+      field: "data_pipeline_sources",
+      variables: {
+        organization_id: resolveOrganizationId(context.organizationId),
+        category_key: opts.categoryKey
+      },
+      variableTypes: SOURCES_VARIABLE_TYPES,
+      isList: true,
+      selectionSet: SOURCE_SELECTION
+    });
+  });
+  dataPipeline.command("source-actions").description("Read the certified provider actions available for one configured source").requiredOption(
+    "--source-id <sourceId>",
+    "Configured Data Pipeline source ID",
+    (value) => parseNonBlank(value, "source-id")
+  ).action(async (opts, cmd) => {
+    const context = await resolveCommandContext(cmd.optsWithGlobals());
+    await runGraphqlQueryCommand({
+      command: "data-pipeline.source-actions",
+      operationName: "DataPipelineSourceActions",
+      runtimeOptions: context.runtimeOptions,
+      field: "data_pipeline_source_actions",
+      variables: {
+        organization_id: resolveOrganizationId(context.organizationId),
+        source_id: opts.sourceId
+      },
+      variableTypes: SOURCE_ACTIONS_VARIABLE_TYPES,
+      isList: true,
+      transformData: transformSourceActions,
+      selectionSet: SOURCE_ACTION_SELECTION
+    });
+  });
+  dataPipeline.command("execute-source-action").description("Execute one backend-certified read-only action for a configured source").requiredOption(
+    "--category-key <categoryKey>",
+    "Data Pipeline category key",
+    parseCategoryKey
+  ).requiredOption(
+    "--provider-key <providerKey>",
+    "Provider key from the configured source",
+    (value) => parseNonBlank(value, "provider-key")
+  ).requiredOption(
+    "--source-id <sourceId>",
+    "Configured Data Pipeline source ID",
+    (value) => parseNonBlank(value, "source-id")
+  ).requiredOption(
+    "--action-key <actionKey>",
+    "Action key returned by source-actions",
+    (value) => parseNonBlank(value, "action-key")
+  ).option(
+    "--parameters-json <parametersJson>",
+    "Bounded JSON object matching the discovered action input schema",
+    parseSourceActionParameters,
+    {}
+  ).action(async (opts, cmd) => {
+    const context = await resolveCommandContext(cmd.optsWithGlobals());
+    await runGraphqlQueryCommand({
+      command: "data-pipeline.execute-source-action",
+      operationName: "DataPipelineExecuteSourceAction",
+      runtimeOptions: context.runtimeOptions,
+      field: "data_pipeline_execute_source_action",
+      variables: {
+        organization_id: resolveOrganizationId(context.organizationId),
+        category_key: opts.categoryKey,
+        provider_key: opts.providerKey,
+        source_id: opts.sourceId,
+        action_key: opts.actionKey,
+        parameters: opts.parametersJson
+      },
+      variableTypes: EXECUTE_SOURCE_ACTION_VARIABLE_TYPES,
+      isShow: true,
+      transformData: transformSourceActionResult,
+      selectionSet: SOURCE_ACTION_RESULT_SELECTION
+    });
+  });
 }
 
 // src/commands/discovery.ts
@@ -17354,10 +17970,12 @@ var PRIMARY_NAMESPACES = [
   "support",
   "recognition",
   "whiteboards",
+  "sketches",
   "time-tracking",
   "planner",
   "mail",
   "datasheets",
+  "data-pipeline",
   "desktop-context",
   "phantom",
   "tasks",
@@ -17384,9 +18002,7 @@ var ADVANCED_NAMESPACES = [
   "stand-ups",
   "news",
   "questions",
-  "pulse",
   "surveys",
-  "feedbacks",
   "accountability",
   "kpis",
   "scorecard-groups",
@@ -17446,7 +18062,9 @@ var NAMESPACE_DOCS = {
     description: "Sanitized desktop capture health and recent evidence for Atlas grounding.",
     examples: [
       "wave desktop-context status",
+      "wave desktop-context member-statuses --member-ids 123,456",
       "wave desktop-context recent --limit 20",
+      "wave desktop-context activity --start-at 2026-08-18T08:00:00Z --end-at 2026-08-18T09:00:00Z",
       "wave desktop-context status --member-id 123"
     ],
     schema: {
@@ -17457,7 +18075,28 @@ var NAMESPACE_DOCS = {
         "Does not expose screenshots, raw audio, accessibility trees, clipboard contents, keystrokes, URLs, or filesystem paths.",
         "Cross-member reads remain subject to backend organization policy and every response carries backend trace correlation when available."
       ],
-      commands: ["status", "recent"]
+      commands: ["status", "member-statuses", "recent", "activity"]
+    }
+  },
+  "data-pipeline": {
+    name: "data-pipeline",
+    tier: "primary",
+    description: "Organization Data Pipeline configuration, saved sources, and certified provider reads.",
+    examples: [
+      "wave data-pipeline overview",
+      "wave data-pipeline sources --category-key communication_meetings",
+      "wave data-pipeline source-actions --source-id 123",
+      `wave data-pipeline execute-source-action --category-key marketing_analytics --provider-key posthog --source-id 123 --action-key posthog.list_dashboards --parameters-json '{"limit":10,"offset":0}'`
+    ],
+    schema: {
+      output: "json-envelope-default",
+      readOnly: true,
+      safety: [
+        "Reads organization-scoped Data Pipeline configuration and backend-certified provider records only.",
+        "Provider actions are discovered from the backend and remain read-only and approval-free.",
+        "Does not install, enable, disable, or uninstall plugins; manage credentials; or create, update, or delete sources."
+      ],
+      commands: ["overview", "sources", "source-actions", "execute-source-action"]
     }
   },
   phantom: {
@@ -17677,6 +18316,28 @@ var NAMESPACE_DOCS = {
       commands: ["open", "list", "show"]
     }
   },
+  sketches: {
+    name: "sketches",
+    tier: "primary",
+    description: "Sketch metadata, bounded create/update operations, and verified app-route metadata.",
+    examples: [
+      "wave sketches list --page 1 --per 20",
+      "wave sketches show --slug SKT-02",
+      `wave sketches create --data-json '{"name":"Design review","teams_ids":["team-1"],"creation_key":"design-review-1"}'`,
+      `wave sketches update-metadata --id 123 --data-json '{"name":"Design review"}'`,
+      "wave sketches open"
+    ],
+    schema: {
+      output: "json-envelope-default",
+      mutates: true,
+      safety: [
+        "Uses verified GraphQL fields sketches, sketch, createSketch, and updateSketch.",
+        "Create requires a team and an idempotency creation key; update accepts only bounded metadata fields.",
+        "Never accepts or emits native document bytes, collaboration updates, render/export data, embedded files, comments, or tokens."
+      ],
+      commands: ["open", "list", "show", "create", "update-metadata"]
+    }
+  },
   "time-tracking": {
     name: "time-tracking",
     tier: "primary",
@@ -17737,9 +18398,10 @@ var NAMESPACE_DOCS = {
   mail: {
     name: "mail",
     tier: "primary",
-    description: "Mail read-only metadata for workspace, accounts, messages, conversations, labels, snippets, settings, sync status, and verified app route metadata.",
+    description: "Mail read-only metadata for workspace, explicitly authorized relay evidence, accounts, messages, conversations, labels, snippets, settings, sync status, and verified app route metadata.",
     examples: [
       "wave mail workspace --page 1 --per 20",
+      "wave mail relay-evidence --account-id 123 --page 1 --per 20",
       "wave mail accounts",
       "wave mail messages --account-id 123 --view inbox --page 1 --per 20",
       "wave mail conversations --account-id 123 --view inbox --page 1 --per 20",
@@ -17761,7 +18423,8 @@ var NAMESPACE_DOCS = {
         "Microsoft Outlook Mail maps to service outlook_mail and Outlook Calendar maps to service outlook_calendar with custom OAuth provider wave-microsoft-outlook.",
         "Uses the verified WAVE-03 safe app route /mail.",
         "Account output is limited to ids, provider/service, status, connection state, sync status, and timestamps.",
-        "Message and conversation output omits bodies, subjects, snippets, contacts, attachments, provider payloads, provider ids, raw thread ids, and user-authored mail content.",
+        "Default message and conversation output omits bodies, subjects, snippets, contacts, attachments, provider payloads, provider ids, raw thread ids, and user-authored mail content.",
+        "relay-evidence is an explicit authenticated relay surface limited to mailbox identity plus sender, subject, date, and snippet metadata; it still omits bodies, recipients, attachments, provider ids, and token material.",
         "Label, snippet, settings, and sync-status output omits user label names/colors, snippet title/shortcut/body, signatures, preferences, sync search text, operation reasons, error bodies, and token material.",
         "Does not expose send, reply, reply-all, forward, draft, provider-action, sync/connect/disconnect, mark, archive, trash, star, label/snippet CRUD, export, print, or write commands."
       ],
@@ -17769,6 +18432,7 @@ var NAMESPACE_DOCS = {
         "open",
         "validate-provider",
         "workspace",
+        "relay-evidence",
         "accounts",
         "messages",
         "conversations",
@@ -18365,7 +19029,11 @@ function buildCli(options) {
     "Explicit organization ID override"
   ).option(
     "--config <configPath>",
-    "Optional JSON config file (default: WAVE_CONFIG_PATH or ~/.wave/config.json when present)"
+    "Optional JSON config file (default: ~/.wave/config.json when present)"
+  ).addOption(
+    new import_commander2.Option("--auth-home <path>", "Credential storage directory (default: ~/.wave)")
+  ).addOption(
+    new import_commander2.Option("--auth-storage <mode>", "Credential storage mode").choices(["auto", "keychain", "file", "disabled"]).default("auto")
   ).option("--timeout-ms <timeoutMs>", "HTTP timeout in milliseconds").option("--agent-name <agentName>", "Agent name for tracing").option("--agent-run-id <agentRunId>", "Agent run identifier for tracing").option("--request-id <requestId>", "Request identifier").option(
     "--atlas-member-id <memberId>",
     "Atlas ledger member ID (prefer WAVE_ATLAS_MEMBER_ID env var)"
@@ -18397,12 +19065,21 @@ function buildCli(options) {
     "--openapi-version <openapiVersion>",
     "Optional pinned OpenAPI version/hash"
   ).exitOverride();
+  program.hook("preAction", (_thisCommand, actionCommand) => {
+    const runtimeOptions = actionCommand.optsWithGlobals();
+    configureAuthStorage({
+      ...runtimeOptions.authHome ? { home: runtimeOptions.authHome } : {},
+      ...runtimeOptions.config ? { configPath: runtimeOptions.config } : {},
+      ...runtimeOptions.authStorage ? { mode: runtimeOptions.authStorage } : {}
+    });
+  });
   setInternalCliOptions(program, options?.internal);
   registerTaskCommands(program);
   registerProjectCommands(program);
   registerRockCommands(program);
   registerMeetingCommands(program);
   registerMemberCommands(program);
+  registerResourceCommands(program);
   registerSkillCommands(program);
   registerAtlasAuthoringCommands(program);
   registerTeamCommands(program);
@@ -18420,6 +19097,7 @@ function buildCli(options) {
   registerSupportCommands(program);
   registerRecognitionCommands(program);
   registerWhiteboardsCommands(program);
+  registerSketchCommands(program);
   registerTimeTrackingCommands(program);
   registerPlannerCommands(program);
   registerMailCommands(program);
@@ -18427,6 +19105,7 @@ function buildCli(options) {
   registerDatasheetsCommands(program);
   registerSignatureCommands(program);
   registerDesktopContextCommands(program);
+  registerDataPipelineCommands(program);
   registerAuthCommands(program);
   registerDiscoveryCommands(program);
   attachNamespaceDiscovery(program);
@@ -18683,9 +19362,10 @@ function withTrustedMachineAuth(auth, callback) {
   for (const key of Object.keys(process.env)) {
     if (key.startsWith("WAVE_")) delete process.env[key];
   }
-  process.env.WAVE_CLI_AUTH_STORAGE = "disabled";
-  process.env.WAVE_CLI_HOME = "/dev/null";
-  return withMachineRuntimeAuth(auth, callback).finally(() => {
+  return withAuthStorageOptions(
+    { home: "/dev/null", mode: "disabled" },
+    () => withMachineRuntimeAuth(auth, callback)
+  ).finally(() => {
     for (const key of Object.keys(process.env)) {
       if (key.startsWith("WAVE_")) delete process.env[key];
     }
@@ -18892,7 +19572,15 @@ async function maybeRunMachineExecute(argv, program) {
   }
   try {
     await withTrustedMachineAuth(auth, async () => {
-      await program.parseAsync([process.execPath, "wave", ...commandArgs(resolved.command, normalizedInput)]);
+      await program.parseAsync([
+        process.execPath,
+        "wave",
+        "--auth-storage",
+        "disabled",
+        "--auth-home",
+        "/dev/null",
+        ...commandArgs(resolved.command, normalizedInput)
+      ]);
     });
   } catch (error) {
     if (isEnvelopeEmittedSignal(error)) return true;
@@ -18953,13 +19641,13 @@ main().catch((error) => {
     });
     return;
   }
-  if (error instanceof import_zod21.ZodError || error instanceof import_commander3.InvalidArgumentError) {
+  if (error instanceof import_zod22.ZodError || error instanceof import_commander3.InvalidArgumentError) {
     printCliFailure({
       status: 400,
       code: "invalid_args",
       message: "Invalid command arguments.",
       details: {
-        issues: error instanceof import_zod21.ZodError ? error.issues : [{ message: error.message, code: "invalid_argument" }]
+        issues: error instanceof import_zod22.ZodError ? error.issues : [{ message: error.message, code: "invalid_argument" }]
       },
       exitCode: EXIT_CODES.invalidArgs
     });