@agentuity/cli 0.1.9 → 0.1.10

package/dist/utils/apt-validator.js

@@ -0,0 +1,157 @@
+import { StructuredError } from '@agentuity/core';
+import { getAppBaseURL } from '@agentuity/server';
+import { getUserAgent } from '../api';
+import { getDefaultConfigDir } from '../config';
+import { join, dirname } from 'node:path';
+import { mkdir } from 'node:fs/promises';
+import { z } from 'zod';
+const AptValidationError = StructuredError('AptValidationError');
+const AptValidationAPIError = StructuredError('AptValidationAPIError')();
+const AptValidationResponseError = StructuredError('AptValidationResponseError')();
+const InvalidPackageSchema = z.object({
+    package: z.string(),
+    error: z.string(),
+    requestedVersion: z.string().optional(),
+    availableVersions: z.array(z.string()).optional(),
+    searchUrl: z.string(),
+});
+const ValidateAptDependenciesResponseSchema = z.object({
+    success: z.boolean(),
+    data: z
+        .object({
+        valid: z.array(z.string()),
+        invalid: z.array(InvalidPackageSchema),
+    })
+        .optional(),
+    message: z.string().optional(),
+});
+const REQUEST_TIMEOUT_MS = 30000; // 30 seconds client-side timeout
+const CacheEntrySchema = z.object({
+    timestamp: z.number(),
+});
+const ValidationCacheSchema = z.object({
+    version: z.number(),
+    entries: z.record(z.string(), CacheEntrySchema),
+});
+const CACHE_VERSION = 1;
+const CACHE_TTL_MS = 90 * 24 * 60 * 60 * 1000; // 90 days
+function getCachePath() {
+    return join(getDefaultConfigDir(), 'dependency-validation.json');
+}
+async function loadCache(logger) {
+    const cachePath = getCachePath();
+    try {
+        const file = Bun.file(cachePath);
+        if (await file.exists()) {
+            const content = await file.json();
+            const parsed = ValidationCacheSchema.safeParse(content);
+            if (parsed.success && parsed.data.version === CACHE_VERSION) {
+                return parsed.data;
+            }
+            logger.debug('Cache invalid or version mismatch, starting fresh');
+        }
+    }
+    catch (err) {
+        logger.debug('Failed to load validation cache: %s', err);
+    }
+    return { version: CACHE_VERSION, entries: {} };
+}
+async function saveCache(cache, logger) {
+    const cachePath = getCachePath();
+    try {
+        await mkdir(dirname(cachePath), { recursive: true });
+        await Bun.write(cachePath, JSON.stringify(cache, null, 2));
+    }
+    catch (err) {
+        logger.debug('Failed to save validation cache: %s', err);
+    }
+}
+function isCacheEntryValid(entry) {
+    return Date.now() - entry.timestamp < CACHE_TTL_MS;
+}
+/**
+ * Validate apt dependencies against the Debian package repository.
+ * Uses a local cache to avoid redundant API calls.
+ * Calls the app API which checks packages against snapshot.debian.org.
+ */
+export async function validateAptDependencies(packages, region, config, logger) {
+    if (packages.length === 0) {
+        return { valid: [], invalid: [] };
+    }
+    const cache = await loadCache(logger);
+    const now = Date.now();
+    const cachedValid = [];
+    const uncachedPackages = [];
+    // Check cache for each package (only valid packages are cached)
+    for (const pkg of packages) {
+        const entry = cache.entries[pkg];
+        if (entry && isCacheEntryValid(entry)) {
+            cachedValid.push(pkg);
+            logger.debug('Cache hit (valid): %s', pkg);
+        }
+        else {
+            uncachedPackages.push(pkg);
+            logger.debug('Cache miss: %s', pkg);
+        }
+    }
+    // If all packages are cached, return immediately
+    if (uncachedPackages.length === 0) {
+        logger.debug('All %d packages found in cache', packages.length);
+        return { valid: cachedValid, invalid: [] };
+    }
+    logger.debug('Validating %d uncached packages (%d cached)', uncachedPackages.length, packages.length - uncachedPackages.length);
+    const appBaseUrl = getAppBaseURL(region, config?.overrides);
+    const url = `${appBaseUrl}/api/cli/validate/apt-dependencies`;
+    const response = await fetch(url, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            'User-Agent': getUserAgent(config),
+        },
+        body: JSON.stringify({ packages: uncachedPackages }),
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+    });
+    if (!response.ok) {
+        const text = await response.text();
+        throw new AptValidationAPIError({
+            message: `Failed to validate apt dependencies: HTTP ${response.status}`,
+            status: response.status,
+            body: text,
+        });
+    }
+    let json;
+    try {
+        json = await response.json();
+    }
+    catch (err) {
+        throw new AptValidationResponseError({
+            message: 'Invalid JSON in API response',
+            parseError: err instanceof Error ? err.message : String(err),
+        });
+    }
+    const parsed = ValidateAptDependenciesResponseSchema.safeParse(json);
+    if (!parsed.success) {
+        throw new AptValidationResponseError({
+            message: 'Invalid API response structure',
+            parseError: parsed.error.message,
+        });
+    }
+    const result = parsed.data;
+    if (!result.success || !result.data) {
+        throw new AptValidationError({
+            message: result.message ?? 'Failed to validate apt dependencies',
+        });
+    }
+    // Update cache with valid results only (don't cache invalid packages)
+    for (const pkg of result.data.valid) {
+        cache.entries[pkg] = { timestamp: now };
+    }
+    await saveCache(cache, logger);
+    logger.debug('Apt validation complete: %d valid, %d invalid (from API)', result.data.valid.length, result.data.invalid.length);
+    // Combine cached and fresh results
+    return {
+        valid: [...cachedValid, ...result.data.valid],
+        invalid: result.data.invalid,
+    };
+}
+//# sourceMappingURL=apt-validator.js.map

package/dist/utils/apt-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apt-validator.js","sourceRoot":"","sources":["../../src/utils/apt-validator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAe,MAAM,iBAAiB,CAAC;AAE/D,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,kBAAkB,GAAG,eAAe,CAAC,oBAAoB,CAAC,CAAC;AACjE,MAAM,qBAAqB,GAAG,eAAe,CAAC,uBAAuB,CAAC,EAGlE,CAAC;AACL,MAAM,0BAA0B,GAAG,eAAe,CAAC,4BAA4B,CAAC,EAE5E,CAAC;AAeL,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACjD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACrB,CAAC,CAAC;AAEH,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,IAAI,EAAE,CAAC;SACL,MAAM,CAAC;QACP,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;KACtC,CAAC;SACD,QAAQ,EAAE;IACZ,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,KAAK,CAAC,CAAC,iCAAiC;AAEnE,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACrB,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC;CAC/C,CAAC,CAAC;AAIH,MAAM,aAAa,GAAG,CAAC,CAAC;AACxB,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,UAAU;AAEzD,SAAS,YAAY;IACpB,OAAO,IAAI,CAAC,mBAAmB,EAAE,EAAE,4BAA4B,CAAC,CAAC;AAClE,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,MAAc;IACtC,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IACjC,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,MAAM,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACxD,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;gBAC7D,OAAO,MAAM,CAAC,IAAI,CAAC;YACpB,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACnE,CAAC;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAsB,EAAE,MAAc;IAC9D,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IACjC,IAAI,CAAC;QACJ,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,MAAM,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;AACF,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAuC;IACjE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,YAAY,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,QAAkB,EAClB,MAAc,EACd,MAAqB,EACrB,MAAc;IAEd,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACnC,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,MAAM,gBAAgB,GAAa,EAAE,CAAC;IAEtC,gEAAgE;IAChE,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;QAC5C,CAAC;aAAM,CAAC;YACP,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3B,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;QACrC,CAAC;IACF,CAAC;IAED,iDAAiD;IACjD,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC5C,CAAC;IAED,MAAM,CAAC,KAAK,CACX,6CAA6C,EAC7C,gBAAgB,CAAC,MAAM,EACvB,QAAQ,CAAC,MAAM,GAAG,gBAAgB,CAAC,MAAM,CACzC,CAAC;IAEF,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,GAAG,UAAU,oCAAoC,CAAC;IAE9D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QACjC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACR,cAAc,EAAE,kBAAkB;YAClC,YAAY,EAAE,YAAY,CAAC,MAAM,CAAC;SAClC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;QACpD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;KAC/C,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,qBAAqB,CAAC;YAC/B,OAAO,EAAE,6CAA6C,QAAQ,CAAC,MAAM,EAAE;YACvE,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,IAAI,EAAE,IAAI;SACV,CAAC,CAAC;IACJ,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACJ,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,0BAA0B,CAAC;YACpC,OAAO,EAAE,8BAA8B;YACvC,UAAU,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SAC5D,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,qCAAqC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAErE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,0BAA0B,CAAC;YACpC,OAAO,EAAE,gCAAgC;YACzC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;SAChC,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;IAE3B,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,qCAAqC;SAChE,CAAC,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACrC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IACzC,CAAC;IAED,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,KAAK,CACX,0DAA0D,EAC1D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EACxB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAC1B,CAAC;IAEF,mCAAmC;IACnC,OAAO;QACN,KAAK,EAAE,CAAC,GAAG,WAAW,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QAC7C,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO;KAC5B,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@agentuity/cli",
-	"version": "0.1.9",
+	"version": "0.1.10",
 	"license": "Apache-2.0",
 	"author": "Agentuity employees and contributors",
 	"type": "module",
@@ -40,9 +40,9 @@
 		"prepublishOnly": "bun run clean && bun run build"
 	},
 	"dependencies": {
-		"@agentuity/auth": "0.1.9",
-		"@agentuity/core": "0.1.9",
-		"@agentuity/server": "0.1.9",
+		"@agentuity/auth": "0.1.10",
+		"@agentuity/core": "0.1.10",
+		"@agentuity/server": "0.1.10",
 		"@datasert/cronjs-parser": "^1.4.0",
 		"@terascope/fetch-github-release": "^2.2.1",
 		"@vitejs/plugin-react": "^5.1.2",
@@ -60,10 +60,10 @@
 		"typescript": "^5.9.0",
 		"vite": "^7.2.7",
 		"zod": "^4.3.5",
-		"@agentuity/frontend": "0.1.9"
+		"@agentuity/frontend": "0.1.10"
 	},
 	"devDependencies": {
-		"@agentuity/test-utils": "0.1.9",
+		"@agentuity/test-utils": "0.1.10",
 		"@types/adm-zip": "^0.5.7",
 		"@types/bun": "latest",
 		"@types/tar-fs": "^2.0.4",

package/src/cache/index.ts

@@ -0,0 +1,11 @@
+export {
+	getResourceInfo,
+	getResourceRegion,
+	setResourceInfo,
+	setResourceRegion,
+	deleteResourceRegion,
+	clearProfileCache,
+	closeDatabase,
+	type ResourceType,
+	type ResourceInfo,
+} from './resource-region';

package/src/cache/resource-region.ts

@@ -0,0 +1,183 @@
+import { Database } from 'bun:sqlite';
+import { join } from 'node:path';
+import { mkdir } from 'node:fs/promises';
+import { getDefaultConfigDir } from '../config';
+
+const TTL_DAYS = 7;
+const TTL_MS = TTL_DAYS * 24 * 60 * 60 * 1000;
+
+let db: Database | null = null;
+
+async function getDatabase(): Promise<Database> {
+	if (db) {
+		return db;
+	}
+
+	const configDir = getDefaultConfigDir();
+	await mkdir(configDir, { recursive: true });
+
+	const dbPath = join(configDir, 'resource.db');
+	db = new Database(dbPath);
+
+	db.run(`
+		CREATE TABLE IF NOT EXISTS resource_region_cache (
+			resource_type TEXT NOT NULL,
+			profile TEXT NOT NULL,
+			id TEXT NOT NULL,
+			region TEXT NOT NULL,
+			org_id TEXT,
+			last_updated INTEGER NOT NULL,
+			PRIMARY KEY (resource_type, profile, id)
+		)
+	`);
+
+	db.run(`
+		CREATE INDEX IF NOT EXISTS idx_last_updated 
+		ON resource_region_cache(last_updated)
+	`);
+
+	return db;
+}
+
+function pruneOldEntries(database: Database): void {
+	const cutoff = Date.now() - TTL_MS;
+	database.run('DELETE FROM resource_region_cache WHERE last_updated < ?', [cutoff]);
+}
+
+export type ResourceType = 'sandbox' | 'bucket' | 'db' | 'project' | 'deployment';
+
+/**
+ * Resource info returned from cache lookup
+ */
+export interface ResourceInfo {
+	region: string;
+	orgId?: string;
+}
+
+/**
+ * Get the cached info (region and orgId) for a resource.
+ * Returns null if not found or expired.
+ */
+export async function getResourceInfo(
+	type: ResourceType,
+	profile: string,
+	id: string
+): Promise<ResourceInfo | null> {
+	const database = await getDatabase();
+	const cutoff = Date.now() - TTL_MS;
+
+	const row = database
+		.query<
+			{ region: string; org_id: string | null; last_updated: number },
+			[string, string, string]
+		>('SELECT region, org_id, last_updated FROM resource_region_cache WHERE resource_type = ? AND profile = ? AND id = ?')
+		.get(type, profile, id);
+
+	if (!row) {
+		return null;
+	}
+
+	// Check if entry is expired
+	if (row.last_updated < cutoff) {
+		// Remove stale entry
+		database.run(
+			'DELETE FROM resource_region_cache WHERE resource_type = ? AND profile = ? AND id = ?',
+			[type, profile, id]
+		);
+		return null;
+	}
+
+	return {
+		region: row.region,
+		orgId: row.org_id ?? undefined,
+	};
+}
+
+/**
+ * Get the cached region for a resource.
+ * Returns null if not found or expired.
+ * @deprecated Use getResourceInfo() to get both region and orgId
+ */
+export async function getResourceRegion(
+	type: ResourceType,
+	profile: string,
+	id: string
+): Promise<string | null> {
+	const info = await getResourceInfo(type, profile, id);
+	return info?.region ?? null;
+}
+
+/**
+ * Set the cached info for a resource.
+ * Uses INSERT OR REPLACE to upsert.
+ */
+export async function setResourceInfo(
+	type: ResourceType,
+	profile: string,
+	id: string,
+	region: string,
+	orgId?: string
+): Promise<void> {
+	const database = await getDatabase();
+
+	pruneOldEntries(database);
+
+	database.run(
+		`INSERT OR REPLACE INTO resource_region_cache 
+		 (resource_type, profile, id, region, org_id, last_updated)
+		 VALUES (?, ?, ?, ?, ?, ?)`,
+		[type, profile, id, region, orgId ?? null, Date.now()]
+	);
+}
+
+/**
+ * Set the cached region for a resource.
+ * Uses INSERT OR REPLACE to upsert.
+ * @deprecated Use setResourceInfo() to set both region and orgId
+ */
+export async function setResourceRegion(
+	type: ResourceType,
+	profile: string,
+	id: string,
+	region: string
+): Promise<void> {
+	await setResourceInfo(type, profile, id, region);
+}
+
+/**
+ * Delete the cached info for a resource.
+ * Called when a resource is deleted.
+ */
+export async function deleteResourceRegion(
+	type: ResourceType,
+	profile: string,
+	id: string
+): Promise<void> {
+	const database = await getDatabase();
+
+	database.run(
+		'DELETE FROM resource_region_cache WHERE resource_type = ? AND profile = ? AND id = ?',
+		[type, profile, id]
+	);
+}
+
+/**
+ * Clear all cached entries for a specific profile.
+ * Useful when switching profiles or logging out.
+ */
+export async function clearProfileCache(profile: string): Promise<void> {
+	const database = await getDatabase();
+
+	database.run('DELETE FROM resource_region_cache WHERE profile = ?', [profile]);
+}
+
+/**
+ * Close the database connection.
+ * Should be called on CLI exit for clean shutdown.
+ */
+export function closeDatabase(): void {
+	if (db) {
+		db.close();
+		db = null;
+	}
+}

package/src/cli.ts

@@ -1,4 +1,4 @@
-import { mkdir } from 'node:fs/promises';
+import { mkdir, unlink } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { resolve, join } from 'node:path';
 import { Command } from 'commander';
@@ -369,7 +369,7 @@ function handleProjectConfigError(
 		error &&
 		typeof error === 'object' &&
 		'name' in error &&
-		error.name === 'ProjectConfigNotFoundExpection'
+		error.name === 'ProjectConfigNotFoundException'
 	) {
 		exitWithError(
 			createError(ErrorCode.PROJECT_NOT_FOUND, 'Invalid project folder', undefined, [
@@ -685,91 +685,100 @@ async function getRegion(regions: RegionList): Promise<string> {
 interface ResolveRegionOptions {
 	options: Record<string, unknown>;
 	apiClient: APIClientType;
-	apiUrl: string;
+	profileName: string;
 	logger: Logger;
 	required: boolean;
 	region?: string;
 }
 
-const REGIONS_CACHE_FILE = 'regions.json';
 const REGIONS_CACHE_MAX_AGE_MS = 5 * 24 * 60 * 60 * 1000; // 5 days
+const LEGACY_REGIONS_CACHE_FILE = 'regions.json';
+
+function getRegionsCacheFile(profileName: string): string {
+	return `regions-${profileName}.json`;
+}
+
+async function removeLegacyRegionsCache(logger: Logger): Promise<void> {
+	try {
+		const legacyPath = join(getDefaultConfigDir(), LEGACY_REGIONS_CACHE_FILE);
+		const file = Bun.file(legacyPath);
+		if (await file.exists()) {
+			await unlink(legacyPath);
+			logger.trace('removed legacy regions cache file');
+		}
+	} catch {
+		// Ignore errors when removing legacy file
+	}
+}
 
 interface RegionsCacheData {
 	timestamp: number;
 	regions: RegionList;
-	apiUrl?: string; // Added to make cache profile-aware
 }
 
-async function getCachedRegions(apiUrl: string, logger: Logger): Promise<RegionList | null> {
+async function getCachedRegions(profileName: string, logger: Logger): Promise<RegionList | null> {
 	try {
-		const cachePath = join(getDefaultConfigDir(), REGIONS_CACHE_FILE);
+		// Clean up legacy single-file cache from older versions
+		await removeLegacyRegionsCache(logger);
+
+		const cachePath = join(getDefaultConfigDir(), getRegionsCacheFile(profileName));
 		const file = Bun.file(cachePath);
 		if (!(await file.exists())) {
 			return null;
 		}
 		const data: RegionsCacheData = await file.json();
-		// Check if cache is for the same API URL (profile-aware)
-		if (data.apiUrl && data.apiUrl !== apiUrl) {
-			logger.trace(
-				'regions cache is for different API URL (cached: %s, current: %s)',
-				data.apiUrl,
-				apiUrl
-			);
-			return null;
-		}
 		const age = Date.now() - data.timestamp;
 		if (age > REGIONS_CACHE_MAX_AGE_MS) {
-			logger.trace('regions cache expired (age: %dms)', age);
+			logger.trace('regions cache expired for profile %s (age: %dms)', profileName, age);
 			return null;
 		}
-		logger.trace('using cached regions (age: %dms)', age);
+		logger.trace('using cached regions for profile %s (age: %dms)', profileName, age);
 		return data.regions;
 	} catch (error) {
-		logger.trace('failed to read regions cache: %s', error);
+		logger.trace('failed to read regions cache for profile %s: %s', profileName, error);
 		return null;
 	}
 }
 
 async function saveRegionsCache(
-	apiUrl: string,
+	profileName: string,
 	regions: RegionList,
 	logger: Logger
 ): Promise<void> {
 	try {
 		const cacheDir = getDefaultConfigDir();
 		await mkdir(cacheDir, { recursive: true });
-		const cachePath = join(cacheDir, REGIONS_CACHE_FILE);
+		const cachePath = join(cacheDir, getRegionsCacheFile(profileName));
 		const data: RegionsCacheData = {
 			timestamp: Date.now(),
 			regions,
-			apiUrl,
 		};
 		await Bun.write(cachePath, JSON.stringify(data));
-		logger.trace('saved regions cache for %s', apiUrl);
+		logger.trace('saved regions cache for profile %s', profileName);
 	} catch (error) {
-		logger.trace('failed to save regions cache: %s', error);
+		logger.trace('failed to save regions cache for profile %s: %s', profileName, error);
 	}
 }
 
 async function fetchRegionsWithCache(
-	apiUrl: string,
+	profileName: string,
 	apiClient: APIClientType,
 	logger: Logger
 ): Promise<RegionList> {
-	const cached = await getCachedRegions(apiUrl, logger);
+	const cached = await getCachedRegions(profileName, logger);
 	if (cached) {
 		return cached;
 	}
 	const regions = await listRegions(apiClient);
-	await saveRegionsCache(apiUrl, regions, logger);
+	await saveRegionsCache(profileName, regions, logger);
 	return regions;
 }
 
 async function resolveRegion(opts: ResolveRegionOptions): Promise<string | undefined> {
-	const { options, apiClient, apiUrl, logger, required } = opts;
+	const { options, apiClient, profileName, logger, required } = opts;
 
 	// Fetch regions (with caching)
-	const regions = await fetchRegionsWithCache(apiUrl, apiClient, logger);
+	const regions = await fetchRegionsWithCache(profileName, apiClient, logger);
 
 	// No regions available
 	if (regions.length === 0) {
@@ -1129,7 +1138,7 @@ async function registerSubcommand(
 							error &&
 							typeof error === 'object' &&
 							'name' in error &&
-							error.name === 'ProjectConfigNotFoundExpection'
+							error.name === 'ProjectConfigNotFoundException'
 						) {
 							// If TTY is available, prompt user to select a project
 							const hasTTY = process.stdin.isTTY && process.stdout.isTTY;
@@ -1237,7 +1246,7 @@ async function registerSubcommand(
 								return resolveRegion({
 									options: options as Record<string, unknown>,
 									apiClient,
-									apiUrl: getAPIBaseURL(baseCtx.config),
+									profileName: baseCtx.config?.name ?? defaultProfileName,
 									logger: baseCtx.logger,
 									required: !!normalized.requiresRegion,
 									region: project?.region,
@@ -1306,7 +1315,7 @@ async function registerSubcommand(
 						return resolveRegion({
 							options: options as Record<string, unknown>,
 							apiClient,
-							apiUrl: getAPIBaseURL(baseCtx.config),
+							profileName: baseCtx.config?.name ?? defaultProfileName,
 							logger: baseCtx.logger,
 							required: !!normalized.requiresRegion,
 							region: project?.region,
@@ -1420,7 +1429,7 @@ async function registerSubcommand(
 						const region = await resolveRegion({
 							options: options as Record<string, unknown>,
 							apiClient,
-							apiUrl: getAPIBaseURL(baseCtx.config),
+							profileName: baseCtx.config?.name ?? defaultProfileName,
 							logger: baseCtx.logger,
 							required: !!normalized.requiresRegion,
 							region: project?.region,
@@ -1485,7 +1494,7 @@ async function registerSubcommand(
 					const region = await resolveRegion({
 						options: options as Record<string, unknown>,
 						apiClient,
-						apiUrl: getAPIBaseURL(baseCtx.config),
+						profileName: baseCtx.config?.name ?? defaultProfileName,
 						logger: baseCtx.logger,
 						required: !!normalized.requiresRegion,
 					});
@@ -1597,7 +1606,7 @@ async function registerSubcommand(
 					const region = await resolveRegion({
 						options: options as Record<string, unknown>,
 						apiClient,
-						apiUrl: getAPIBaseURL(baseCtx.config),
+						profileName: baseCtx.config?.name ?? defaultProfileName,
 						logger: baseCtx.logger,
 						required: !!normalized.requiresRegion,
 						region: project?.region,
@@ -1726,7 +1735,7 @@ export async function registerCommands(
 							const region = await resolveRegion({
 								options: baseCtx.options as unknown as Record<string, unknown>,
 								apiClient,
-								apiUrl: getAPIBaseURL(baseCtx.config),
+								profileName: baseCtx.config?.name ?? defaultProfileName,
 								logger: baseCtx.logger,
 								required: !!normalized.requiresRegion,
 							});
@@ -1784,7 +1793,7 @@ export async function registerCommands(
 							const region = await resolveRegion({
 								options: baseCtx.options as unknown as Record<string, unknown>,
 								apiClient,
-								apiUrl: getAPIBaseURL(baseCtx.config),
+								profileName: baseCtx.config?.name ?? defaultProfileName,
 								logger: baseCtx.logger,
 								required: !!normalized.requiresRegion,
 							});
@@ -1805,7 +1814,7 @@ export async function registerCommands(
 							const region = await resolveRegion({
 								options: baseCtx.options as unknown as Record<string, unknown>,
 								apiClient,
-								apiUrl: getAPIBaseURL(baseCtx.config),
+								profileName: baseCtx.config?.name ?? defaultProfileName,
 								logger: baseCtx.logger,
 								required: !!normalized.requiresRegion,
 							});

package/src/cmd/ai/capabilities/show.ts

@@ -112,19 +112,11 @@ export const showSubcommand = createSubcommand({
 					requiresAuth: true,
 					requiresProject: true,
 				},
-				{
-					id: 'secrets',
-					name: 'Secrets Management',
-					description: 'Store and retrieve secrets securely',
-					commands: ['secret list', 'secret set', 'secret get', 'secret delete'],
-					requiresAuth: true,
-					requiresProject: true,
-				},
 				{
 					id: 'env',
-					name: 'Environment Variables',
-					description: 'Manage environment variables',
-					commands: ['env list', 'env set', 'env get', 'env delete'],
+					name: 'Environment Variables & Secrets',
+					description: 'Manage environment variables and secrets',
+					commands: ['env list', 'env set', 'env set --secret', 'env get', 'env delete'],
 					requiresAuth: true,
 					requiresProject: true,
 				},
@@ -189,7 +181,7 @@ export const showSubcommand = createSubcommand({
 						'auth signup',
 						'auth login',
 						'project create',
-						'secret set API_KEY <value>',
+						'env set API_KEY <value> --secret',
 						'dev',
 					],
 				},
@@ -199,9 +191,14 @@ export const showSubcommand = createSubcommand({
 					steps: ['bundle', 'cloud deploy', 'cloud deployment logs', 'cloud deployment show'],
 				},
 				{
-					name: 'Manage Secrets',
-					description: 'Configure application secrets',
-					steps: ['secret list', 'secret set <key> <value>', 'secret get <key>'],
+					name: 'Manage Environment Variables',
+					description: 'Configure environment variables and secrets',
+					steps: [
+						'env list',
+						'env set <key> <value>',
+						'env set <key> <value> --secret',
+						'env get <key>',
+					],
 				},
 				{
 					name: 'SSH Key Setup',