@agentuity/cli 0.1.15 → 0.1.16

package/src/cmd/cloud/env/push.ts

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 import { createSubcommand } from '../../../types';
 import * as tui from '../../../tui';
-import { projectEnvUpdate } from '@agentuity/server';
+import { projectEnvUpdate, orgEnvUpdate } from '@agentuity/server';
 import {
 	findExistingEnvFile,
 	readEnvFile,
@@ -10,6 +10,7 @@ import {
 	validateNoPublicSecrets,
 } from '../../../env-util';
 import { getCommand } from '../../../command-prefix';
+import { resolveOrgId, isOrgScope } from './org-util';
 
 const EnvPushResponseSchema = z.object({
 	success: z.boolean().describe('Whether push succeeded'),
@@ -17,6 +18,7 @@ const EnvPushResponseSchema = z.object({
 	envCount: z.number().describe('Number of env vars pushed'),
 	secretCount: z.number().describe('Number of secrets pushed'),
 	source: z.string().describe('Source file path'),
+	scope: z.enum(['project', 'org']).describe('The scope where variables were pushed'),
 });
 
 export const pushSubcommand = createSubcommand({
@@ -28,18 +30,33 @@ export const pushSubcommand = createSubcommand({
 		'slow',
 		'api-intensive',
 		'requires-auth',
-		'requires-project',
 	],
 	idempotent: true,
-	examples: [{ command: getCommand('env push'), description: 'Push all variables to cloud' }],
-	requires: { auth: true, project: true, apiClient: true },
+	examples: [
+		{ command: getCommand('env push'), description: 'Push all variables to cloud (project)' },
+		{ command: getCommand('env push --org'), description: 'Push all variables to organization' },
+	],
+	requires: { auth: true, apiClient: true },
+	optional: { project: true },
 	prerequisites: ['env set'],
 	schema: {
+		options: z.object({
+			org: z
+				.union([z.boolean(), z.string()])
+				.optional()
+				.describe('push to organization level (use --org for default org)'),
+		}),
 		response: EnvPushResponseSchema,
 	},
 
 	async handler(ctx) {
-		const { apiClient, project, projectDir } = ctx;
+		const { apiClient, project, projectDir, config, opts } = ctx;
+		const useOrgScope = isOrgScope(opts?.org);
+
+		// Always require projectDir since push reads from local .env file
+		if (!projectDir) {
+			tui.fatal('Project directory required. Run from a project directory.');
+		}
 
 		// Read local env file
 		const envFilePath = await findExistingEnvFile(projectDir);
@@ -56,6 +73,7 @@ export const pushSubcommand = createSubcommand({
 				envCount: 0,
 				secretCount: 0,
 				source: envFilePath,
+				scope: useOrgScope ? 'org' as const : 'project' as const,
 			};
 		}
 
@@ -74,29 +92,64 @@ export const pushSubcommand = createSubcommand({
 			}
 		}
 
-		// Push to cloud
-		await tui.spinner('Pushing variables to cloud', () => {
-			return projectEnvUpdate(apiClient, {
-				id: project.projectId,
-				env,
-				secrets,
+		if (useOrgScope) {
+			// Organization scope
+			const orgId = await resolveOrgId(apiClient, config, opts!.org!);
+
+			await tui.spinner('Pushing variables to organization', () => {
+				return orgEnvUpdate(apiClient, {
+					id: orgId,
+					env,
+					secrets,
+				});
+			});
+
+			const envCount = Object.keys(env).length;
+			const secretCount = Object.keys(secrets).length;
+			const totalCount = envCount + secretCount;
+
+			tui.success(
+				`Pushed ${totalCount} variable${totalCount !== 1 ? 's' : ''} to organization (${envCount} env, ${secretCount} secret${secretCount !== 1 ? 's' : ''})`
+			);
+
+			return {
+				success: true,
+				pushed: totalCount,
+				envCount,
+				secretCount,
+				source: envFilePath,
+				scope: 'org' as const,
+			};
+		} else {
+			// Project scope (existing behavior)
+			if (!project) {
+				tui.fatal('Project context required. Run from a project directory or use --org for organization scope.');
+			}
+
+			await tui.spinner('Pushing variables to cloud', () => {
+				return projectEnvUpdate(apiClient, {
+					id: project.projectId,
+					env,
+					secrets,
+				});
 			});
-		});
-
-		const envCount = Object.keys(env).length;
-		const secretCount = Object.keys(secrets).length;
-		const totalCount = envCount + secretCount;
-
-		tui.success(
-			`Pushed ${totalCount} variable${totalCount !== 1 ? 's' : ''} to cloud (${envCount} env, ${secretCount} secret${secretCount !== 1 ? 's' : ''})`
-		);
-
-		return {
-			success: true,
-			pushed: totalCount,
-			envCount,
-			secretCount,
-			source: envFilePath,
-		};
+
+			const envCount = Object.keys(env).length;
+			const secretCount = Object.keys(secrets).length;
+			const totalCount = envCount + secretCount;
+
+			tui.success(
+				`Pushed ${totalCount} variable${totalCount !== 1 ? 's' : ''} to cloud (${envCount} env, ${secretCount} secret${secretCount !== 1 ? 's' : ''})`
+			);
+
+			return {
+				success: true,
+				pushed: totalCount,
+				envCount,
+				secretCount,
+				source: envFilePath,
+				scope: 'project' as const,
+			};
+		}
 	},
 });

package/src/cmd/cloud/env/set.ts

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 import { createSubcommand } from '../../../types';
 import * as tui from '../../../tui';
-import { projectEnvUpdate } from '@agentuity/server';
+import { projectEnvUpdate, orgEnvUpdate } from '@agentuity/server';
 import {
 	findExistingEnvFile,
 	readEnvFile,
@@ -13,20 +13,23 @@ import {
 	PUBLIC_VAR_PREFIXES,
 } from '../../../env-util';
 import { getCommand } from '../../../command-prefix';
+import { resolveOrgId, isOrgScope } from './org-util';
 
 const EnvSetResponseSchema = z.object({
 	success: z.boolean().describe('Whether the operation succeeded'),
 	key: z.string().describe('Environment variable key'),
-	path: z.string().describe('Local file path where env var was saved'),
+	path: z.string().optional().describe('Local file path where env var was saved (project scope only)'),
 	secret: z.boolean().describe('Whether the value was stored as a secret'),
+	scope: z.enum(['project', 'org']).describe('The scope where the variable was set'),
 });
 
 export const setSubcommand = createSubcommand({
 	name: 'set',
 	description: 'Set an environment variable or secret',
-	tags: ['mutating', 'updates-resource', 'slow', 'requires-auth', 'requires-project'],
+	tags: ['mutating', 'updates-resource', 'slow', 'requires-auth'],
 	idempotent: true,
-	requires: { auth: true, project: true, apiClient: true },
+	requires: { auth: true, apiClient: true },
+	optional: { project: true },
 	examples: [
 		{
 			command: getCommand('env set NODE_ENV production'),
@@ -37,6 +40,10 @@ export const setSubcommand = createSubcommand({
 			command: getCommand('env set API_KEY "sk_..." --secret'),
 			description: 'Set a secret value',
 		},
+		{
+			command: getCommand('env set OPENAI_API_KEY "sk_..." --secret --org'),
+			description: 'Set an organization-wide secret',
+		},
 	],
 	schema: {
 		args: z.object({
@@ -48,12 +55,23 @@ export const setSubcommand = createSubcommand({
 				.boolean()
 				.default(false)
 				.describe('store as a secret (encrypted and masked in UI)'),
+			org: z
+				.union([z.boolean(), z.string()])
+				.optional()
+				.describe('set at organization level (use --org for default org, or --org <orgId> for specific org)'),
 		}),
 		response: EnvSetResponseSchema,
 	},
 
 	async handler(ctx) {
-		const { args, opts, apiClient, project, projectDir } = ctx;
+		const { args, opts, apiClient, project, projectDir, config } = ctx;
+		const useOrgScope = isOrgScope(opts?.org);
+
+		// Require project context if not using org scope
+		if (!useOrgScope && !project) {
+			tui.fatal('Project context required. Run from a project directory or use --org for organization scope.');
+		}
+
 		let isSecret = opts?.secret ?? false;
 		const isPublic = isPublicVarKey(args.key);
 
@@ -81,34 +99,65 @@ export const setSubcommand = createSubcommand({
 			}
 		}
 
-		// Set in cloud
-		const updatePayload = isSecret
-			? { id: project.projectId, secrets: { [args.key]: args.value } }
-			: { id: project.projectId, env: { [args.key]: args.value } };
-
 		const label = isSecret ? 'secret' : 'environment variable';
-		await tui.spinner(`Setting ${label} in cloud`, () => {
-			return projectEnvUpdate(apiClient, updatePayload);
-		});
-
-		// Update local .env file
-		const envFilePath = await findExistingEnvFile(projectDir);
-		const currentEnv = await readEnvFile(envFilePath);
-		currentEnv[args.key] = args.value;
-
-		// Filter out AGENTUITY_ keys before writing
-		const filteredEnv = filterAgentuitySdkKeys(currentEnv);
-		await writeEnvFile(envFilePath, filteredEnv);
-
-		tui.success(
-			`${isSecret ? 'Secret' : 'Environment variable'} '${args.key}' set successfully (cloud + ${envFilePath})`
-		);
-
-		return {
-			success: true,
-			key: args.key,
-			path: envFilePath,
-			secret: isSecret,
-		};
+
+		if (useOrgScope) {
+			// Organization scope
+			const orgId = await resolveOrgId(apiClient, config, opts!.org!);
+
+			const updatePayload = isSecret
+				? { id: orgId, secrets: { [args.key]: args.value } }
+				: { id: orgId, env: { [args.key]: args.value } };
+
+			await tui.spinner(`Setting organization ${label} in cloud`, () => {
+				return orgEnvUpdate(apiClient, updatePayload);
+			});
+
+			tui.success(
+				`Organization ${isSecret ? 'secret' : 'environment variable'} '${args.key}' set successfully (affects all projects in org)`
+			);
+
+			return {
+				success: true,
+				key: args.key,
+				secret: isSecret,
+				scope: 'org' as const,
+			};
+		} else {
+			// Project scope (existing behavior)
+			const updatePayload = isSecret
+				? { id: project!.projectId, secrets: { [args.key]: args.value } }
+				: { id: project!.projectId, env: { [args.key]: args.value } };
+
+			await tui.spinner(`Setting ${label} in cloud`, () => {
+				return projectEnvUpdate(apiClient, updatePayload);
+			});
+
+			// Update local .env file only if we have a project directory
+			// (not when using --project-id without being in a project folder)
+			let envFilePath: string | undefined;
+			if (projectDir) {
+				envFilePath = await findExistingEnvFile(projectDir);
+				const currentEnv = await readEnvFile(envFilePath);
+				currentEnv[args.key] = args.value;
+
+				// Filter out AGENTUITY_ keys before writing
+				const filteredEnv = filterAgentuitySdkKeys(currentEnv);
+				await writeEnvFile(envFilePath, filteredEnv);
+			}
+
+			const successMsg = envFilePath
+				? `${isSecret ? 'Secret' : 'Environment variable'} '${args.key}' set successfully (cloud + ${envFilePath})`
+				: `${isSecret ? 'Secret' : 'Environment variable'} '${args.key}' set successfully (cloud only)`;
+			tui.success(successMsg);
+
+			return {
+				success: true,
+				key: args.key,
+				path: envFilePath,
+				secret: isSecret,
+				scope: 'project' as const,
+			};
+		}
 	},
 });

package/src/cmd/cloud/keyvalue/create-namespace.ts

@@ -9,7 +9,7 @@ export const createNamespaceSubcommand = createCommand({
 	description: 'Create a new keyvalue namespace',
 	tags: ['mutating', 'creates-resource', 'slow', 'requires-auth'],
 	idempotent: false,
-	requires: { auth: true, project: true },
+	requires: { auth: true },
 	examples: [
 		{
 			command: getCommand('kv create-namespace production'),

package/src/cmd/cloud/keyvalue/delete-namespace.ts

@@ -8,9 +8,9 @@ export const deleteNamespaceSubcommand = createCommand({
 	name: 'delete-namespace',
 	aliases: ['rm-namespace'],
 	description: 'Delete a keyvalue namespace and all its keys',
-	tags: ['destructive', 'deletes-resource', 'slow', 'requires-auth', 'requires-project'],
+	tags: ['destructive', 'deletes-resource', 'slow', 'requires-auth'],
 	idempotent: true,
-	requires: { auth: true, project: true },
+	requires: { auth: true },
 	examples: [
 		{
 			command: getCommand('kv delete-namespace staging'),

package/src/cmd/cloud/keyvalue/delete.ts

@@ -16,7 +16,7 @@ export const deleteSubcommand = createCommand({
 	description: 'Delete a key from the keyvalue storage',
 	tags: ['destructive', 'deletes-resource', 'slow', 'requires-auth'],
 	idempotent: true,
-	requires: { auth: true, project: true },
+	requires: { auth: true },
 	examples: [
 		{ command: getCommand('kv delete production user:123'), description: 'Delete user data' },
 		{ command: getCommand('kv delete cache session:abc'), description: 'Delete cached session' },

package/src/cmd/cloud/keyvalue/get.ts

@@ -14,7 +14,7 @@ export const getSubcommand = createCommand({
 	name: 'get',
 	description: 'Get a value from the keyvalue storage',
 	tags: ['read-only', 'fast', 'requires-auth'],
-	requires: { auth: true, project: true },
+	requires: { auth: true },
 	examples: [
 		{ command: getCommand('kv get production user:123'), description: 'Get user data' },
 		{ command: getCommand('kv get cache session:abc'), description: 'Get cached session' },

package/src/cmd/cloud/keyvalue/index.ts

@@ -35,6 +35,6 @@ export const command = createCommand({
 		createNamespaceSubcommand,
 		deleteNamespaceSubcommand,
 	],
-	requires: { auth: true, project: true },
+	requires: { auth: true },
 });
 export default command;

package/src/cmd/cloud/keyvalue/keys.ts

@@ -13,7 +13,7 @@ export const keysSubcommand = createCommand({
 	aliases: ['ls', 'list'],
 	description: 'List all keys in a keyvalue namespace',
 	tags: ['read-only', 'slow', 'requires-auth'],
-	requires: { auth: true, project: true },
+	requires: { auth: true },
 	idempotent: true,
 	examples: [
 		{ command: getCommand('kv keys production'), description: 'List all keys in production' },

package/src/cmd/cloud/keyvalue/list-namespaces.ts

@@ -10,7 +10,7 @@ export const listNamespacesSubcommand = createCommand({
 	aliases: ['namespaces', 'ns'],
 	description: 'List all keyvalue namespaces',
 	tags: ['read-only', 'fast', 'requires-auth'],
-	requires: { auth: true, project: true },
+	requires: { auth: true },
 	examples: [
 		{ command: getCommand('kv list-namespaces'), description: 'List all namespaces' },
 		{ command: getCommand('kv namespaces'), description: 'List namespaces (using alias)' },

package/src/cmd/cloud/keyvalue/repl.ts

@@ -11,16 +11,19 @@ export const replSubcommand = createCommand({
 	description: 'Start an interactive repl for working with keyvalue database',
 	tags: ['slow', 'requires-auth'],
 	idempotent: false,
-	requires: { auth: true, project: true },
+	requires: { auth: true },
+	optional: { project: true },
 	examples: [{ command: getCommand('kv repl'), description: 'Start interactive KV session' }],
 
 	async handler(ctx) {
 		showBanner(undefined, true);
-		tui.info('Managing keyvalue store for project');
-		tui.newline();
-		console.log(tui.bold('Org:'.padEnd(10, ' ')), ' ', tui.muted(ctx.project.orgId));
-		console.log(tui.bold('Project:'.padEnd(10, ' ')), ' ', tui.muted(ctx.project.projectId));
+		tui.info('Managing keyvalue store');
 		tui.newline();
+		if (ctx.project) {
+			console.log(tui.bold('Org:'.padEnd(10, ' ')), ' ', tui.muted(ctx.project.orgId));
+			console.log(tui.bold('Project:'.padEnd(10, ' ')), ' ', tui.muted(ctx.project.projectId));
+			tui.newline();
+		}
 
 		const storage = await createStorageAdapter(ctx);
 

package/src/cmd/cloud/keyvalue/search.ts

@@ -20,7 +20,7 @@ export const searchSubcommand = createCommand({
 	name: 'search',
 	description: 'Search for keys matching a keyword in a keyvalue namespace',
 	tags: ['read-only', 'slow', 'requires-auth'],
-	requires: { auth: true, project: true },
+	requires: { auth: true },
 	idempotent: true,
 	examples: [
 		{

package/src/cmd/cloud/keyvalue/set.ts

@@ -19,7 +19,7 @@ export const setSubcommand = createCommand({
 	description: 'Set a key and value in the keyvalue storage',
 	tags: ['mutating', 'updates-resource', 'slow', 'requires-auth'],
 	idempotent: true,
-	requires: { auth: true, project: true },
+	requires: { auth: true },
 	examples: [
 		{
 			command: getCommand(

package/src/cmd/cloud/keyvalue/stats.ts

@@ -26,7 +26,7 @@ export const statsSubcommand = createCommand({
 	name: 'stats',
 	description: 'Get statistics for keyvalue storage',
 	tags: ['read-only', 'fast', 'requires-auth'],
-	requires: { auth: true, project: true },
+	requires: { auth: true },
 	idempotent: true,
 	examples: [
 		{ command: getCommand('kv stats'), description: 'Show stats for all namespaces' },

package/src/cmd/cloud/keyvalue/util.ts

@@ -1,34 +1,25 @@
-import { KeyValueStorageService, Logger } from '@agentuity/core';
+import { KeyValueStorageService, type Logger } from '@agentuity/core';
 import { createServerFetchAdapter, getServiceUrls } from '@agentuity/server';
-import { loadProjectSDKKey } from '../../../config';
-import { ErrorCode } from '../../../errors';
-import type { Config } from '../../../types';
-import * as tui from '../../../tui';
+import { getDefaultRegion } from '../../../config';
+import type { AuthData, Config } from '../../../types';
 
 export async function createStorageAdapter(ctx: {
 	logger: Logger;
-	projectDir: string;
 	config: Config | null;
-	project: { region: string };
+	auth: AuthData;
+	project?: { region: string };
 }) {
-	const sdkKey = await loadProjectSDKKey(ctx.logger, ctx.projectDir);
-	if (!sdkKey) {
-		tui.fatal(
-			`Couldn't find the AGENTUITY_SDK_KEY in ${ctx.projectDir} .env file`,
-			ErrorCode.CONFIG_NOT_FOUND
-		);
-	}
-
 	const adapter = createServerFetchAdapter(
 		{
 			headers: {
-				Authorization: `Bearer ${sdkKey}`,
+				Authorization: `Bearer ${ctx.auth.apiKey}`,
 			},
 		},
 		ctx.logger
 	);
 
-	const urls = getServiceUrls(ctx.project.region);
+	const region = ctx.project?.region || (await getDefaultRegion(ctx.config?.name, ctx.config));
+	const urls = getServiceUrls(region);
 	const baseUrl = urls.catalyst;
 	return new KeyValueStorageService(baseUrl, adapter);
 }

package/src/cmd/project/create.ts

@@ -69,6 +69,15 @@ export const createProjectSubcommand = createSubcommand({
 				.default(true)
 				.optional()
 				.describe('Register the project, if authenticated (use --no-register to skip)'),
+			database: z
+				.string()
+				.optional()
+				.describe('Database action: "skip", "new", or existing database name'),
+			storage: z
+				.string()
+				.optional()
+				.describe('Storage action: "skip", "new", or existing bucket name'),
+			enableAuth: z.boolean().optional().describe('Enable Agentuity Auth'),
 		}),
 		response: ProjectCreateResponseSchema,
 	},
@@ -101,6 +110,9 @@ export const createProjectSubcommand = createSubcommand({
 			apiClient,
 			orgId: opts.register === true ? orgId : undefined,
 			region,
+			database: opts.database,
+			storage: opts.storage,
+			enableAuth: opts.enableAuth,
 		});
 
 		// Exit with error code if setup failed and not in JSON mode