@eide/foir-cli 0.13.0 → 0.14.0

package/dist/cli.js

@@ -472,6 +472,7 @@ import { HooksService as HooksService2 } from "@eide/foir-proto-ts/hooks/v1/hook
 import { NotificationsService as NotificationsService2 } from "@eide/foir-proto-ts/notifications/v1/notifications_pb";
 import { SchedulesService as SchedulesService2 } from "@eide/foir-proto-ts/schedules/v1/schedules_pb";
 import { AppsService as AppsService2 } from "@eide/foir-proto-ts/apps/v1/apps_service_pb";
+import { SecretsService as SecretsService2 } from "@eide/foir-proto-ts/secrets/v1/secrets_pb";
 
 // src/lib/rpc/identity.ts
 import { create } from "@bufbuild/protobuf";
@@ -1447,21 +1448,12 @@ import {
   ListScheduledPublishesRequestSchema,
   ListDraftVersionsRequestSchema,
   BatchPublishVersionsRequestSchema,
-  CreatePublishBatchRequestSchema,
-  UpdatePublishBatchRequestSchema,
-  CancelPublishBatchRequestSchema,
-  RollbackPublishBatchRequestSchema,
-  RetryFailedBatchItemsRequestSchema,
-  AddItemsToPublishBatchRequestSchema,
-  RemoveItemsFromPublishBatchRequestSchema,
-  ListPublishBatchesRequestSchema,
-  GetPublishBatchRequestSchema,
   GlobalSearchRequestSchema,
   GetEmbeddingStatsRequestSchema,
   GetRecordEmbeddingsRequestSchema,
   FindSimilarRecordsRequestSchema
 } from "@eide/foir-proto-ts/records/v1/records_pb";
-import { RecordType, BatchStatus } from "@eide/foir-proto-ts/records/v1/records_pb";
+import { RecordType } from "@eide/foir-proto-ts/records/v1/records_pb";
 function sanitizeData(obj) {
   const result = {};
   for (const [key, value] of Object.entries(obj)) {
@@ -1770,103 +1762,6 @@ function createRecordsMethods(client) {
         publishedCount: resp.publishedCount
       };
     },
-    // ── Publish Batches ───────────────────────────────────────
-    async createPublishBatch(params) {
-      const resp = await client.createPublishBatch(
-        create4(CreatePublishBatchRequestSchema, {
-          name: params.name,
-          versionIds: params.versionIds,
-          scheduledAt: params.scheduledAt ? {
-            seconds: BigInt(
-              Math.floor(params.scheduledAt.getTime() / 1e3)
-            ),
-            nanos: 0
-          } : void 0
-        })
-      );
-      return resp.batch ?? null;
-    },
-    async updatePublishBatch(params) {
-      const resp = await client.updatePublishBatch(
-        create4(UpdatePublishBatchRequestSchema, {
-          batchId: params.batchId,
-          name: params.name,
-          scheduledAt: params.scheduledAt ? {
-            seconds: BigInt(
-              Math.floor(params.scheduledAt.getTime() / 1e3)
-            ),
-            nanos: 0
-          } : void 0
-        })
-      );
-      return resp.batch ?? null;
-    },
-    async cancelPublishBatch(batchId) {
-      const resp = await client.cancelPublishBatch(
-        create4(CancelPublishBatchRequestSchema, { batchId })
-      );
-      return resp.batch ?? null;
-    },
-    async rollbackPublishBatch(batchId) {
-      const resp = await client.rollbackPublishBatch(
-        create4(RollbackPublishBatchRequestSchema, { batchId })
-      );
-      return resp.batch ?? null;
-    },
-    async retryFailedBatchItems(batchId) {
-      const resp = await client.retryFailedBatchItems(
-        create4(RetryFailedBatchItemsRequestSchema, { batchId })
-      );
-      return {
-        batch: resp.batch ?? null,
-        retriedCount: resp.retriedCount
-      };
-    },
-    async addItemsToPublishBatch(batchId, versionIds) {
-      const resp = await client.addItemsToPublishBatch(
-        create4(AddItemsToPublishBatchRequestSchema, { batchId, versionIds })
-      );
-      return resp.batch ?? null;
-    },
-    async removeItemsFromPublishBatch(batchId, versionIds) {
-      const resp = await client.removeItemsFromPublishBatch(
-        create4(RemoveItemsFromPublishBatchRequestSchema, {
-          batchId,
-          versionIds
-        })
-      );
-      return resp.batch ?? null;
-    },
-    async listPublishBatches(params) {
-      const resp = await client.listPublishBatches(
-        create4(ListPublishBatchesRequestSchema, {
-          status: params?.status,
-          from: params?.from ? {
-            seconds: BigInt(Math.floor(params.from.getTime() / 1e3)),
-            nanos: 0
-          } : void 0,
-          to: params?.to ? {
-            seconds: BigInt(Math.floor(params.to.getTime() / 1e3)),
-            nanos: 0
-          } : void 0,
-          limit: params?.limit ?? 50,
-          offset: params?.offset ?? 0
-        })
-      );
-      return {
-        items: resp.batches ?? [],
-        total: resp.total
-      };
-    },
-    async getPublishBatch(batchId) {
-      const resp = await client.getPublishBatch(
-        create4(GetPublishBatchRequestSchema, { batchId })
-      );
-      return {
-        batch: resp.batch ?? null,
-        versions: resp.versions ?? []
-      };
-    },
     // ── Search & Embeddings ──────────────────────────────────
     async globalSearch(params) {
       const resp = await client.globalSearch(
@@ -3241,6 +3136,74 @@ function createCronSchedulesMethods(client) {
   };
 }
 
+// src/lib/rpc/secrets.ts
+import { create as create14 } from "@bufbuild/protobuf";
+import {
+  PutSecretRequestSchema,
+  GetSecretRequestSchema,
+  ListSecretsRequestSchema,
+  RotateSecretRequestSchema,
+  DeleteSecretRequestSchema,
+  RestoreSecretRequestSchema,
+  PurgeSoftDeletedRequestSchema,
+  OwnerKind
+} from "@eide/foir-proto-ts/secrets/v1/secrets_pb";
+function createSecretsMethods(client) {
+  return {
+    async put(args) {
+      const resp = await client.putSecret(
+        create14(PutSecretRequestSchema, {
+          tenantId: args.tenantId,
+          projectId: args.projectId,
+          ownerKind: args.ownerKind,
+          ownerId: args.ownerId ?? "",
+          label: args.label ?? "",
+          plaintext: args.plaintext
+        })
+      );
+      return resp.ref;
+    },
+    async get(ref, purpose) {
+      return client.getSecret(
+        create14(GetSecretRequestSchema, { ref, purpose: purpose ?? "" })
+      );
+    },
+    async list(args) {
+      const resp = await client.listSecrets(
+        create14(ListSecretsRequestSchema, {
+          tenantId: args.tenantId,
+          projectId: args.projectId,
+          ownerKind: args.ownerKind ?? OwnerKind.UNSPECIFIED,
+          ownerId: args.ownerId ?? "",
+          includeSoftDeleted: args.includeSoftDeleted ?? false
+        })
+      );
+      return resp.secrets;
+    },
+    async rotate(ref, plaintext) {
+      const resp = await client.rotateSecret(
+        create14(RotateSecretRequestSchema, { ref, plaintext })
+      );
+      return resp.newRef;
+    },
+    async delete(ref) {
+      await client.deleteSecret(create14(DeleteSecretRequestSchema, { ref }));
+    },
+    async restore(ref) {
+      await client.restoreSecret(create14(RestoreSecretRequestSchema, { ref }));
+    },
+    async purge(args = {}) {
+      const resp = await client.purgeSoftDeleted(
+        create14(PurgeSoftDeletedRequestSchema, {
+          tenantId: args.tenantId ?? "",
+          projectId: args.projectId ?? ""
+        })
+      );
+      return resp.purgedCount;
+    }
+  };
+}
+
 // src/lib/client.ts
 async function createPlatformClient(options) {
   const apiUrl = getApiUrl(options);
@@ -3300,7 +3263,8 @@ async function createPlatformClient(options) {
     cronSchedules: createCronSchedulesMethods(
       createRpcClient(SchedulesService2, transport)
     ),
-    apps: createAppsMethods(createRpcClient(AppsService2, transport))
+    apps: createAppsMethods(createRpcClient(AppsService2, transport)),
+    secrets: createSecretsMethods(createRpcClient(SecretsService2, transport))
   };
 }
 function createPlatformClientWithHeaders(apiUrl, headers) {
@@ -3336,7 +3300,8 @@ function createPlatformClientWithHeaders(apiUrl, headers) {
     cronSchedules: createCronSchedulesMethods(
       createRpcClient(SchedulesService2, transport)
     ),
-    apps: createAppsMethods(createRpcClient(AppsService2, transport))
+    apps: createAppsMethods(createRpcClient(AppsService2, transport)),
+    secrets: createSecretsMethods(createRpcClient(SecretsService2, transport))
   };
 }
 async function getStorageAuth(options) {
@@ -3540,17 +3505,39 @@ async function provisionApiKey(client) {
 
 // src/lib/output.ts
 import chalk2 from "chalk";
+import {
+  toJson
+} from "@bufbuild/protobuf";
+function bigintReplacer(_key, value) {
+  return typeof value === "bigint" ? value.toString() : value;
+}
+function safeStringify(value, indent) {
+  return JSON.stringify(value, bigintReplacer, indent);
+}
 function formatOutput(data, options) {
   if (options?.quiet) return;
   if (options?.json) {
-    console.log(JSON.stringify(data, null, 2));
+    console.log(safeStringify(data, 2));
     return;
   }
   if (options?.jsonl) {
-    console.log(JSON.stringify(data));
+    console.log(safeStringify(data));
+    return;
+  }
+  console.log(safeStringify(data, 2));
+}
+function formatOutputProto(schema, message, options) {
+  if (message == null) {
+    formatOutput(null, options);
     return;
   }
-  console.log(JSON.stringify(data, null, 2));
+  formatOutput(toJson(schema, message), options);
+}
+function formatListProto(schema, items, options, config2) {
+  const converted = items.map(
+    (item) => toJson(schema, item)
+  );
+  formatList(converted, options, config2);
 }
 function formatList(items, options, config2) {
   if (options?.quiet) {
@@ -3560,12 +3547,12 @@ function formatList(items, options, config2) {
     return;
   }
   if (options?.json) {
-    console.log(JSON.stringify(items, null, 2));
+    console.log(safeStringify(items, 2));
     return;
   }
   if (options?.jsonl) {
     for (const item of items) {
-      console.log(JSON.stringify(item));
+      console.log(safeStringify(item));
     }
     return;
   }
@@ -3703,7 +3690,11 @@ import { basename } from "path";
 import chalk3 from "chalk";
 import { createClient } from "@connectrpc/connect";
 import { createConnectTransport as createConnectTransport2 } from "@connectrpc/connect-node";
-import { StorageService as StorageService3 } from "@eide/foir-proto-ts/storage/v1/storage_pb";
+import {
+  StorageService as StorageService3,
+  FileSchema,
+  StorageUsageSchema
+} from "@eide/foir-proto-ts/storage/v1/storage_pb";
 
 // src/lib/input.ts
 import inquirer2 from "inquirer";
@@ -3876,7 +3867,7 @@ function registerMediaCommands(program2, globalOpts) {
         }
         const file = await storage.confirmFileUpload(upload.uploadId);
         if (opts.json || opts.jsonl) {
-          formatOutput(file, opts);
+          formatOutputProto(FileSchema, file, opts);
         } else {
           success(`Uploaded ${filename}`);
           if (file?.url) {
@@ -3904,7 +3895,7 @@ function registerMediaCommands(program2, globalOpts) {
           limit: Number(flags.limit) || 50,
           offset: Number(flags.offset) || 0
         });
-        formatList(result.items, opts, {
+        formatListProto(FileSchema, result.items, opts, {
           columns: [
             { key: "id", header: "ID", width: 28 },
             { key: "filename", header: "Filename", width: 24 },
@@ -3939,7 +3930,7 @@ function registerMediaCommands(program2, globalOpts) {
       const { getToken } = await getStorageAuth(opts);
       const storage = createStorageRpcClient(getToken);
       const file = await storage.getFile(id);
-      formatOutput(file, opts);
+      formatOutputProto(FileSchema, file, opts);
     })
   );
   media.command("usage").description("Get storage usage").action(
@@ -3949,7 +3940,7 @@ function registerMediaCommands(program2, globalOpts) {
       const storage = createStorageRpcClient(getToken);
       const usage = await storage.getStorageUsage();
       if (opts.json || opts.jsonl) {
-        formatOutput(usage, opts);
+        formatOutputProto(StorageUsageSchema, usage, opts);
       } else {
         const mb = (Number(usage?.totalBytes ?? 0) / (1024 * 1024)).toFixed(
           1
@@ -3973,7 +3964,7 @@ function registerMediaCommands(program2, globalOpts) {
           tags: flags.tags?.split(",").map((t) => t.trim())
         });
         if (opts.json || opts.jsonl) {
-          formatOutput(file, opts);
+          formatOutputProto(FileSchema, file, opts);
         } else {
           success("Updated file");
         }
@@ -3994,7 +3985,7 @@ function registerMediaCommands(program2, globalOpts) {
           description: flags.description
         });
         if (opts.json || opts.jsonl) {
-          formatOutput(file, opts);
+          formatOutputProto(FileSchema, file, opts);
         } else {
           success("Updated file metadata");
         }
@@ -4032,7 +4023,7 @@ function registerMediaCommands(program2, globalOpts) {
       const storage = createStorageRpcClient(getToken);
       const file = await storage.restoreFile(id);
       if (opts.json || opts.jsonl) {
-        formatOutput(file, opts);
+        formatOutputProto(FileSchema, file, opts);
       } else {
         success("Restored file");
       }
@@ -4592,6 +4583,8 @@ function registerCreateConfigCommand(program2, globalOpts) {
 }
 
 // src/commands/search.ts
+import { toJson as toJson2 } from "@bufbuild/protobuf";
+import { SearchResultItemSchema } from "@eide/foir-proto-ts/records/v1/records_pb";
 function registerSearchCommands(program2, globalOpts) {
   program2.command("search <query>").description("Search across all records").option(
     "--models <keys>",
@@ -4609,7 +4602,15 @@ function registerSearchCommands(program2, globalOpts) {
           modelKeys
         });
         if (opts.json || opts.jsonl) {
-          formatOutput(result, opts);
+          formatOutput(
+            {
+              items: result.items.map(
+                (item) => toJson2(SearchResultItemSchema, item)
+              ),
+              total: result.total
+            },
+            opts
+          );
           return;
         }
         if (result.items.length > 0) {
@@ -6267,6 +6268,7 @@ function registerProfilesCommand(program2, globalOpts) {
 }
 
 // src/commands/context.ts
+import { TenantSchema } from "@eide/foir-proto-ts/identity/v1/identity_pb";
 function registerContextCommands(program2, globalOpts) {
   const context = program2.command("context").description("Manage project and tenant context");
   context.command("projects").description("List available projects").action(
@@ -6331,7 +6333,8 @@ function registerContextCommands(program2, globalOpts) {
       const sessionContext = await client.identity.getSessionContext();
       if (!sessionContext)
         throw new Error("Could not retrieve session context.");
-      formatList(
+      formatListProto(
+        TenantSchema,
         sessionContext.availableTenants ?? [],
         opts,
         {
@@ -6346,6 +6349,10 @@ function registerContextCommands(program2, globalOpts) {
 }
 
 // src/commands/models.ts
+import {
+  ModelSchema,
+  ModelVersionSchema
+} from "@eide/foir-proto-ts/models/v1/models_pb";
 function registerModelsCommands(program2, globalOpts) {
   const models = program2.command("models").description("Manage models");
   models.command("list").description("List all models").option("--category <cat>", "Filter by category").option("--search <term>", "Search by name").option("--limit <n>", "Max results", "50").option("--offset <n>", "Skip results", "0").action(
@@ -6358,24 +6365,20 @@ function registerModelsCommands(program2, globalOpts) {
         limit: parseInt(cmdOpts.limit ?? "50", 10),
         offset: parseInt(cmdOpts.offset ?? "0", 10)
       });
-      formatList(
-        result.items,
-        opts,
-        {
-          columns: [
-            { key: "key", header: "Key", width: 24 },
-            { key: "name", header: "Name", width: 24 },
-            { key: "category", header: "Category", width: 14 },
-            {
-              key: "updatedAt",
-              header: "Updated",
-              width: 12,
-              format: (v) => timeAgo(v)
-            }
-          ],
-          total: result.total
-        }
-      );
+      formatListProto(ModelSchema, result.items, opts, {
+        columns: [
+          { key: "key", header: "Key", width: 24 },
+          { key: "name", header: "Name", width: 24 },
+          { key: "category", header: "Category", width: 14 },
+          {
+            key: "updatedAt",
+            header: "Updated",
+            width: 12,
+            format: (v) => timeAgo(v)
+          }
+        ],
+        total: result.total
+      });
     })
   );
   models.command("get <key>").description("Get a model by key").action(
@@ -6386,7 +6389,7 @@ function registerModelsCommands(program2, globalOpts) {
       if (!model) {
         throw new Error(`Model "${key}" not found.`);
       }
-      formatOutput(model, opts);
+      formatOutputProto(ModelSchema, model, opts);
     })
   );
   models.command("create").description("Create a new model").option("-d, --data <json>", "Model data as JSON").option("-f, --file <path>", "Read data from file").action(
@@ -6395,7 +6398,7 @@ function registerModelsCommands(program2, globalOpts) {
       const client = await createPlatformClient(opts);
       const inputData = await parseInputData(cmdOpts);
       const model = await client.models.createModel(inputData);
-      formatOutput(model, opts);
+      formatOutputProto(ModelSchema, model, opts);
       if (!(opts.json || opts.jsonl || opts.quiet)) {
         success(`Created model ${model?.key}`);
       }
@@ -6416,7 +6419,7 @@ function registerModelsCommands(program2, globalOpts) {
           id: existing.id,
           ...inputData
         });
-        formatOutput(model, opts);
+        formatOutputProto(ModelSchema, model, opts);
         if (!(opts.json || opts.jsonl || opts.quiet)) {
           success(`Updated model ${key}`);
         }
@@ -6462,30 +6465,28 @@ function registerModelsCommands(program2, globalOpts) {
         const result = await client.models.listModelVersions(existing.id, {
           limit: parseInt(cmdOpts.limit ?? "20", 10)
         });
-        formatList(
-          result.items,
-          opts,
-          {
-            columns: [
-              { key: "id", header: "Version ID", width: 28 },
-              { key: "versionNumber", header: "#", width: 5 },
-              { key: "changeDescription", header: "Description", width: 32 },
-              {
-                key: "createdAt",
-                header: "Created",
-                width: 12,
-                format: (v) => timeAgo(v)
-              },
-              { key: "createdBy", header: "By", width: 18 }
-            ]
-          }
-        );
+        formatListProto(ModelVersionSchema, result.items, opts, {
+          columns: [
+            { key: "id", header: "Version ID", width: 28 },
+            { key: "versionNumber", header: "#", width: 5 },
+            { key: "changeDescription", header: "Description", width: 32 },
+            {
+              key: "createdAt",
+              header: "Created",
+              width: 12,
+              format: (v) => timeAgo(v)
+            },
+            { key: "createdBy", header: "By", width: 18 }
+          ]
+        });
       }
     )
   );
 }
 
 // src/commands/records.ts
+import { toJson as toJson3 } from "@bufbuild/protobuf";
+import { RecordSchema } from "@eide/foir-proto-ts/records/v1/records_pb";
 function registerRecordsCommands(program2, globalOpts) {
   const records = program2.command("records").description("Manage records");
   records.command("list <modelKey>").description("List records for a model").option("--filter <expr>", "Filter expression (e.g. status=active)").option("--limit <n>", "Max results", "20").option("--offset <n>", "Skip results", "0").action(
@@ -6501,24 +6502,20 @@ function registerRecordsCommands(program2, globalOpts) {
         };
         if (cmdOpts.filter) params.filters = parseFilters(cmdOpts.filter);
         const result = await client.records.listRecords(params);
-        formatList(
-          result.items,
-          opts,
-          {
-            columns: [
-              { key: "id", header: "ID", width: 28 },
-              { key: "naturalKey", header: "Key", width: 24 },
-              { key: "versionNumber", header: "Version", width: 8 },
-              {
-                key: "updatedAt",
-                header: "Updated",
-                width: 12,
-                format: (v) => timeAgo(v)
-              }
-            ],
-            total: result.total
-          }
-        );
+        formatListProto(RecordSchema, result.items, opts, {
+          columns: [
+            { key: "id", header: "ID", width: 28 },
+            { key: "naturalKey", header: "Key", width: 24 },
+            { key: "versionNumber", header: "Version", width: 8 },
+            {
+              key: "updatedAt",
+              header: "Updated",
+              width: 12,
+              format: (v) => timeAgo(v)
+            }
+          ],
+          total: result.total
+        });
       }
     )
   );
@@ -6528,23 +6525,13 @@ function registerRecordsCommands(program2, globalOpts) {
       async (modelKey, idOrKey, _cmdOpts) => {
         const opts = globalOpts();
         const client = await createPlatformClient(opts);
-        let result;
-        if (isUUID(idOrKey)) {
-          const record = await client.records.getRecord(idOrKey);
-          result = record;
-        } else {
-          const record = await client.records.getRecordByKey(
-            modelKey,
-            idOrKey
-          );
-          result = record;
-        }
-        if (!result) {
+        const record = isUUID(idOrKey) ? await client.records.getRecord(idOrKey) : await client.records.getRecordByKey(modelKey, idOrKey);
+        if (!record) {
           throw new Error(
             `Record "${idOrKey}" not found in model "${modelKey}".`
           );
         }
-        formatOutput(result, opts);
+        formatOutputProto(RecordSchema, record, opts);
       }
     )
   );
@@ -6557,7 +6544,14 @@ function registerRecordsCommands(program2, globalOpts) {
         const inputData = await parseInputData(cmdOpts);
         const input = { modelKey, ...inputData };
         const result = await client.records.createRecord(input);
-        formatOutput(result, opts);
+        formatOutput(
+          {
+            record: result.record ? toJson3(RecordSchema, result.record) : null,
+            variant: result.variant ? toJson3(RecordSchema, result.variant) : null,
+            version: result.version ? toJson3(RecordSchema, result.version) : null
+          },
+          opts
+        );
         if (!(opts.json || opts.jsonl || opts.quiet)) {
           success(`Created record ${result.record?.id}`);
         }
@@ -6573,7 +6567,7 @@ function registerRecordsCommands(program2, globalOpts) {
         const inputData = await parseInputData(cmdOpts);
         const input = { id, ...inputData };
         const record = await client.records.updateRecord(input);
-        formatOutput(record, opts);
+        formatOutputProto(RecordSchema, record, opts);
         if (!(opts.json || opts.jsonl || opts.quiet)) {
           success(`Updated record ${id}`);
         }
@@ -6634,7 +6628,7 @@ function registerRecordsCommands(program2, globalOpts) {
         const client = await createPlatformClient(opts);
         const naturalKey = cmdOpts.naturalKey ?? `${id}-copy`;
         const record = await client.records.duplicateRecord(id, naturalKey);
-        formatOutput(record, opts);
+        formatOutputProto(RecordSchema, record, opts);
         if (!(opts.json || opts.jsonl || opts.quiet)) {
           success(`Duplicated \u2192 ${record?.id}`);
         }
@@ -6650,39 +6644,11 @@ function registerRecordsCommands(program2, globalOpts) {
         const result = await client.records.listRecordVersions(parentId, {
           limit: parseInt(cmdOpts.limit ?? "20", 10)
         });
-        formatList(
-          result.items,
-          opts,
-          {
-            columns: [
-              { key: "id", header: "Version ID", width: 28 },
-              { key: "versionNumber", header: "#", width: 5 },
-              { key: "changeDescription", header: "Description", width: 30 },
-              {
-                key: "createdAt",
-                header: "Created",
-                width: 12,
-                format: (v) => timeAgo(v)
-              }
-            ]
-          }
-        );
-      }
-    )
-  );
-  records.command("variants <recordId>").description("List variants for a record").action(
-    withErrorHandler(globalOpts, async (recordId) => {
-      const opts = globalOpts();
-      const client = await createPlatformClient(opts);
-      const result = await client.records.listRecordVariants(recordId);
-      formatList(
-        result.items,
-        opts,
-        {
+        formatListProto(RecordSchema, result.items, opts, {
           columns: [
-            { key: "id", header: "Variant ID", width: 28 },
-            { key: "variantKey", header: "Key", width: 20 },
-            { key: "isDefault", header: "Default", width: 8 },
+            { key: "id", header: "Version ID", width: 28 },
+            { key: "versionNumber", header: "#", width: 5 },
+            { key: "changeDescription", header: "Description", width: 30 },
             {
               key: "createdAt",
               header: "Created",
@@ -6690,8 +6656,28 @@ function registerRecordsCommands(program2, globalOpts) {
               format: (v) => timeAgo(v)
             }
           ]
-        }
-      );
+        });
+      }
+    )
+  );
+  records.command("variants <recordId>").description("List variants for a record").action(
+    withErrorHandler(globalOpts, async (recordId) => {
+      const opts = globalOpts();
+      const client = await createPlatformClient(opts);
+      const result = await client.records.listRecordVariants(recordId);
+      formatListProto(RecordSchema, result.items, opts, {
+        columns: [
+          { key: "id", header: "Variant ID", width: 28 },
+          { key: "variantKey", header: "Key", width: 20 },
+          { key: "isDefault", header: "Default", width: 8 },
+          {
+            key: "createdAt",
+            header: "Created",
+            width: 12,
+            format: (v) => timeAgo(v)
+          }
+        ]
+      });
     })
   );
   records.command("create-version <parentId>").description(
@@ -6708,7 +6694,7 @@ function registerRecordsCommands(program2, globalOpts) {
           inputData,
           cmdOpts.message
         );
-        formatOutput(version2, opts);
+        formatOutputProto(RecordSchema, version2, opts);
         if (!(opts.json || opts.jsonl || opts.quiet)) {
           success(`Created version ${version2?.id}`);
         }
@@ -6725,7 +6711,7 @@ function registerRecordsCommands(program2, globalOpts) {
           recordId,
           cmdOpts.key
         );
-        formatOutput(variant, opts);
+        formatOutputProto(RecordSchema, variant, opts);
         if (!(opts.json || opts.jsonl || opts.quiet)) {
           success(`Created variant ${variant?.id}`);
         }
@@ -6735,6 +6721,7 @@ function registerRecordsCommands(program2, globalOpts) {
 }
 
 // src/commands/customers.ts
+import { CustomerSchema } from "@eide/foir-proto-ts/identity/v1/identity_pb";
 var statusMap = {
   ACTIVE: CustomerStatus.ACTIVE,
   PENDING: CustomerStatus.PENDING,
@@ -6755,52 +6742,47 @@ function registerCustomersCommands(program2, globalOpts) {
         limit: parseInt(cmdOpts.limit ?? "20", 10),
         offset: parseInt(cmdOpts.offset ?? "0", 10)
       });
-      formatList(
-        result.items,
-        opts,
-        {
-          columns: [
-            { key: "id", header: "ID", width: 28 },
-            { key: "email", header: "Email", width: 30 },
-            { key: "status", header: "Status", width: 12 },
-            {
-              key: "lastLoginAt",
-              header: "Last Login",
-              width: 12,
-              format: (v) => timeAgo(v)
-            },
-            {
-              key: "createdAt",
-              header: "Created",
-              width: 12,
-              format: (v) => timeAgo(v)
-            }
-          ],
-          total: result.total
-        }
-      );
+      formatListProto(CustomerSchema, result.items, opts, {
+        columns: [
+          { key: "id", header: "ID", width: 28 },
+          { key: "email", header: "Email", width: 30 },
+          { key: "status", header: "Status", width: 12 },
+          {
+            key: "lastLoginAt",
+            header: "Last Login",
+            width: 12,
+            format: (v) => timeAgo(v)
+          },
+          {
+            key: "createdAt",
+            header: "Created",
+            width: 12,
+            format: (v) => timeAgo(v)
+          }
+        ],
+        total: result.total
+      });
     })
   );
   customers.command("get <idOrEmail>").description("Get a customer by ID or email").action(
     withErrorHandler(globalOpts, async (idOrEmail) => {
       const opts = globalOpts();
       const client = await createPlatformClient(opts);
-      let result = null;
+      let customer;
       if (idOrEmail.includes("@")) {
         const list = await client.identity.listCustomers({
           search: idOrEmail,
           limit: 1
         });
-        const match = list.items[0];
-        result = match ? match : null;
+        customer = list.items[0] ?? null;
       } else {
         const resp = await client.identity.getCustomer(idOrEmail);
-        result = resp.customer;
+        customer = resp.customer ?? null;
       }
-      if (!result) {
+      if (!customer) {
         throw new Error(`Customer "${idOrEmail}" not found.`);
       }
-      formatOutput(result, opts);
+      formatOutputProto(CustomerSchema, customer, opts);
     })
   );
   customers.command("create").description("Create a new customer").option("--email <email>", "Customer email (required)").option("-d, --data <json>", "Additional data as JSON").action(
@@ -6824,11 +6806,8 @@ function registerCustomersCommands(program2, globalOpts) {
         throw new Error("--email is required.");
       }
       const resp = await client.identity.createCustomer(input);
-      const customer = resp.customer;
-      formatOutput(
-        customer,
-        opts
-      );
+      const customer = resp.customer ?? null;
+      formatOutputProto(CustomerSchema, customer, opts);
       if (!(opts.json || opts.jsonl || opts.quiet)) {
         success(`Created customer ${customer?.email}`);
       }
@@ -6860,6 +6839,7 @@ function registerCustomersCommands(program2, globalOpts) {
 }
 
 // src/commands/customer-profiles.ts
+import { CustomerProfileSchemaSchema } from "@eide/foir-proto-ts/settings/v1/settings_pb";
 function registerCustomerProfilesCommands(program2, globalOpts) {
   const cp = program2.command("customer-profiles").alias("cp").description("Manage customer profile schema and profiles");
   const schema = cp.command("schema").description("Manage the customer profile schema");
@@ -6878,7 +6858,7 @@ function registerCustomerProfilesCommands(program2, globalOpts) {
         }
         return;
       }
-      formatOutput(result, opts);
+      formatOutputProto(CustomerProfileSchemaSchema, result, opts);
     })
   );
   schema.command("update").description(
@@ -6897,7 +6877,7 @@ function registerCustomerProfilesCommands(program2, globalOpts) {
         fields: inputData.fields,
         publicFields: inputData.publicFields ?? []
       });
-      formatOutput(result, opts);
+      formatOutputProto(CustomerProfileSchemaSchema, result, opts);
       if (!(opts.json || opts.jsonl || opts.quiet)) {
         const version2 = result?.version;
         success(`Updated customer profile schema (version ${version2})`);
@@ -6938,6 +6918,11 @@ function registerCustomerProfilesCommands(program2, globalOpts) {
 }
 
 // src/commands/operations.ts
+import {
+  OperationSchema,
+  OperationExecutionSchema,
+  DeadLetterEntrySchema
+} from "@eide/foir-proto-ts/operations/v1/operations_pb";
 function registerOperationsCommands(program2, globalOpts) {
   const operations = program2.command("operations").description("Manage operations");
   operations.command("list").description("List operations").option("--category <cat>", "Filter by category").option("--active", "Only active operations").option("--limit <n>", "Max results", "50").action(
@@ -6949,7 +6934,7 @@ function registerOperationsCommands(program2, globalOpts) {
         isActive: cmdOpts.active ? true : void 0,
         limit: parseInt(String(cmdOpts.limit ?? "50"), 10)
       });
-      formatList(data.operations, opts, {
+      formatListProto(OperationSchema, data.operations, opts, {
         columns: [
           { key: "key", header: "Key", width: 24 },
           { key: "name", header: "Name", width: 24 },
@@ -6976,7 +6961,7 @@ function registerOperationsCommands(program2, globalOpts) {
       const client = await createPlatformClient(opts);
       const result = await client.operations.getOperation({ key });
       if (!result) throw new Error(`Operation "${key}" not found.`);
-      formatOutput(result, opts);
+      formatOutputProto(OperationSchema, result, opts);
     })
   );
   operations.command("execute <key>").description("Execute an operation").option("-d, --data <json>", "Input data as JSON").option("-f, --file <path>", "Read input from file").option("--async", "Execute asynchronously").action(
@@ -6993,7 +6978,17 @@ function registerOperationsCommands(program2, globalOpts) {
           operationKey: key,
           input: inputData
         });
-        formatOutput(result.execution ?? result, opts);
+        if (result.execution) {
+          formatOutputProto(OperationExecutionSchema, result.execution, opts);
+        } else {
+          formatOutput(
+            {
+              completed: result.completed,
+              errorMessage: result.errorMessage ?? null
+            },
+            opts
+          );
+        }
         if (!(opts.json || opts.jsonl || opts.quiet)) {
           if (result.completed) {
             success(`Operation completed in ${result.execution?.durationMs ?? 0}ms`);
@@ -7012,7 +7007,7 @@ function registerOperationsCommands(program2, globalOpts) {
         operationKey: cmdOpts.operation,
         limit: parseInt(cmdOpts.limit ?? "20", 10)
       });
-      formatList(data.entries, opts, {
+      formatListProto(DeadLetterEntrySchema, data.entries, opts, {
         columns: [
           { key: "id", header: "ID", width: 28 },
           { key: "operationKey", header: "Operation", width: 20 },
@@ -7059,6 +7054,11 @@ function registerOperationsCommands(program2, globalOpts) {
 }
 
 // src/commands/segments.ts
+import {
+  SegmentSchema,
+  SegmentPreviewSchema,
+  SegmentEvaluationResultSchema
+} from "@eide/foir-proto-ts/segments/v1/segments_pb";
 function registerSegmentsCommands(program2, globalOpts) {
   const segments = program2.command("segments").description("Manage segments");
   segments.command("list").description("List segments").option("--active", "Only active segments").option("--limit <n>", "Max results", "50").option("--offset <n>", "Skip results", "0").action(
@@ -7070,7 +7070,7 @@ function registerSegmentsCommands(program2, globalOpts) {
         limit: parseInt(String(cmdOpts.limit ?? "50"), 10),
         offset: parseInt(String(cmdOpts.offset ?? "0"), 10)
       });
-      formatList(data.segments, opts, {
+      formatListProto(SegmentSchema, data.segments, opts, {
         columns: [
           { key: "id", header: "ID", width: 28 },
           { key: "key", header: "Key", width: 20 },
@@ -7103,7 +7103,7 @@ function registerSegmentsCommands(program2, globalOpts) {
         result = await client.segments.getSegmentByKey(idOrKey);
       }
       if (!result) throw new Error(`Segment "${idOrKey}" not found.`);
-      formatOutput(result, opts);
+      formatOutputProto(SegmentSchema, result, opts);
     })
   );
   segments.command("create").description("Create a new segment").option("-d, --data <json>", "Segment data as JSON").option("-f, --file <path>", "Read data from file").action(
@@ -7114,7 +7114,7 @@ function registerSegmentsCommands(program2, globalOpts) {
       const result = await client.segments.createSegment(
         input
       );
-      formatOutput(result, opts);
+      formatOutputProto(SegmentSchema, result, opts);
       if (!(opts.json || opts.jsonl || opts.quiet))
         success(`Created segment ${result?.key}`);
     })
@@ -7130,7 +7130,7 @@ function registerSegmentsCommands(program2, globalOpts) {
           id,
           ...input
         });
-        formatOutput(result, opts);
+        formatOutputProto(SegmentSchema, result, opts);
         if (!(opts.json || opts.jsonl || opts.quiet))
           success(`Updated segment ${id}`);
       }
@@ -7166,7 +7166,7 @@ function registerSegmentsCommands(program2, globalOpts) {
         rules,
         parseInt(cmdOpts.sampleSize ?? "100", 10)
       );
-      formatOutput(result, opts);
+      formatOutputProto(SegmentPreviewSchema, result, opts);
     })
   );
   segments.command("test <segmentId> <customerId>").description("Test whether a customer matches a segment").action(
@@ -7179,13 +7179,17 @@ function registerSegmentsCommands(program2, globalOpts) {
           segmentId,
           customerId
         );
-        formatOutput(result, opts);
+        formatOutputProto(SegmentEvaluationResultSchema, result, opts);
       }
     )
   );
 }
 
 // src/commands/experiments.ts
+import {
+  ExperimentSchema,
+  ExperimentStatsSchema
+} from "@eide/foir-proto-ts/experiments/v1/experiments_pb";
 function registerExperimentsCommands(program2, globalOpts) {
   const experiments = program2.command("experiments").description("Manage experiments");
   experiments.command("list").description("List experiments").option("--status <status>", "Filter by status").option("--active", "Only active experiments").option("--limit <n>", "Max results", "50").option("--offset <n>", "Skip results", "0").action(
@@ -7198,7 +7202,7 @@ function registerExperimentsCommands(program2, globalOpts) {
         limit: parseInt(String(cmdOpts.limit ?? "50"), 10),
         offset: parseInt(String(cmdOpts.offset ?? "0"), 10)
       });
-      formatList(data.experiments, opts, {
+      formatListProto(ExperimentSchema, data.experiments, opts, {
         columns: [
           { key: "id", header: "ID", width: 28 },
           { key: "key", header: "Key", width: 20 },
@@ -7231,7 +7235,7 @@ function registerExperimentsCommands(program2, globalOpts) {
         result = await client.experiments.getExperimentByKey(idOrKey);
       }
       if (!result) throw new Error(`Experiment "${idOrKey}" not found.`);
-      formatOutput(result, opts);
+      formatOutputProto(ExperimentSchema, result, opts);
     })
   );
   experiments.command("create").description("Create a new experiment").option("-d, --data <json>", "Experiment data as JSON").option("-f, --file <path>", "Read data from file").action(
@@ -7242,7 +7246,7 @@ function registerExperimentsCommands(program2, globalOpts) {
       const result = await client.experiments.createExperiment(
         input
       );
-      formatOutput(result, opts);
+      formatOutputProto(ExperimentSchema, result, opts);
       if (!(opts.json || opts.jsonl || opts.quiet))
         success(`Created experiment ${result?.key}`);
     })
@@ -7258,7 +7262,7 @@ function registerExperimentsCommands(program2, globalOpts) {
           id,
           ...input
         });
-        formatOutput(result, opts);
+        formatOutputProto(ExperimentSchema, result, opts);
         if (!(opts.json || opts.jsonl || opts.quiet))
           success(`Updated experiment ${id}`);
       }
@@ -7289,7 +7293,7 @@ function registerExperimentsCommands(program2, globalOpts) {
       const opts = globalOpts();
       const client = await createPlatformClient(opts);
       const result = await client.experiments.startExperiment(id);
-      formatOutput(result, opts);
+      formatOutputProto(ExperimentSchema, result, opts);
       if (!(opts.json || opts.jsonl || opts.quiet))
         success("Experiment started");
     })
@@ -7299,7 +7303,7 @@ function registerExperimentsCommands(program2, globalOpts) {
       const opts = globalOpts();
       const client = await createPlatformClient(opts);
       const result = await client.experiments.pauseExperiment(id);
-      formatOutput(result, opts);
+      formatOutputProto(ExperimentSchema, result, opts);
       if (!(opts.json || opts.jsonl || opts.quiet))
         success("Experiment paused");
     })
@@ -7309,7 +7313,7 @@ function registerExperimentsCommands(program2, globalOpts) {
       const opts = globalOpts();
       const client = await createPlatformClient(opts);
       const result = await client.experiments.resumeExperiment(id);
-      formatOutput(result, opts);
+      formatOutputProto(ExperimentSchema, result, opts);
       if (!(opts.json || opts.jsonl || opts.quiet))
         success("Experiment resumed");
     })
@@ -7319,7 +7323,7 @@ function registerExperimentsCommands(program2, globalOpts) {
       const opts = globalOpts();
       const client = await createPlatformClient(opts);
       const result = await client.experiments.endExperiment(id);
-      formatOutput(result, opts);
+      formatOutputProto(ExperimentSchema, result, opts);
       if (!(opts.json || opts.jsonl || opts.quiet))
         success("Experiment ended");
     })
@@ -7329,12 +7333,13 @@ function registerExperimentsCommands(program2, globalOpts) {
       const opts = globalOpts();
       const client = await createPlatformClient(opts);
       const result = await client.experiments.getExperimentStats(id);
-      formatOutput(result, opts);
+      formatOutputProto(ExperimentStatsSchema, result, opts);
     })
   );
 }
 
 // src/commands/schedules.ts
+import { CronScheduleSchema } from "@eide/foir-proto-ts/schedules/v1/schedules_pb";
 function registerSchedulesCommands(program2, globalOpts) {
   const schedules = program2.command("schedules").description("Manage schedules");
   schedules.command("list").description("List schedules").option("--active", "Only active schedules").option("--limit <n>", "Max results", "50").action(
@@ -7345,7 +7350,7 @@ function registerSchedulesCommands(program2, globalOpts) {
         isActive: cmdOpts.active ? true : void 0,
         limit: parseInt(String(cmdOpts.limit ?? "50"), 10)
       });
-      formatList(data.schedules, opts, {
+      formatListProto(CronScheduleSchema, data.schedules, opts, {
         columns: [
           { key: "key", header: "Key", width: 20 },
           { key: "name", header: "Name", width: 24 },
@@ -7374,7 +7379,7 @@ function registerSchedulesCommands(program2, globalOpts) {
       const client = await createPlatformClient(opts);
       const result = await client.cronSchedules.getCronScheduleByKey(key);
       if (!result) throw new Error(`Schedule "${key}" not found.`);
-      formatOutput(result, opts);
+      formatOutputProto(CronScheduleSchema, result, opts);
     })
   );
   schedules.command("create").description("Create a new schedule").option("-d, --data <json>", "Schedule data as JSON").option("-f, --file <path>", "Read data from file").action(
@@ -7385,7 +7390,7 @@ function registerSchedulesCommands(program2, globalOpts) {
       const result = await client.cronSchedules.createCronSchedule(
         input
       );
-      formatOutput(result, opts);
+      formatOutputProto(CronScheduleSchema, result, opts);
       if (!(opts.json || opts.jsonl || opts.quiet))
         success(`Created schedule ${result?.key}`);
     })
@@ -7403,7 +7408,7 @@ function registerSchedulesCommands(program2, globalOpts) {
           id: existing.id,
           ...input
         });
-        formatOutput(result, opts);
+        formatOutputProto(CronScheduleSchema, result, opts);
         if (!(opts.json || opts.jsonl || opts.quiet))
           success(`Updated schedule "${key}"`);
       }
@@ -7419,7 +7424,11 @@ function registerSchedulesCommands(program2, globalOpts) {
         id: existing.id
       });
       if (opts.json || opts.jsonl) {
-        formatOutput(result ?? { triggered: true }, opts);
+        if (result) {
+          formatOutputProto(CronScheduleSchema, result, opts);
+        } else {
+          formatOutput({ triggered: true }, opts);
+        }
       } else {
         success(`Triggered schedule "${key}"`);
       }
@@ -7434,7 +7443,7 @@ function registerSchedulesCommands(program2, globalOpts) {
       const result = await client.cronSchedules.pauseCronSchedule({
         id: existing.id
       });
-      formatOutput(result, opts);
+      formatOutputProto(CronScheduleSchema, result, opts);
       if (!(opts.json || opts.jsonl || opts.quiet))
         success(`Paused schedule "${key}"`);
     })
@@ -7448,7 +7457,7 @@ function registerSchedulesCommands(program2, globalOpts) {
       const result = await client.cronSchedules.resumeCronSchedule({
         id: existing.id
       });
-      formatOutput(result, opts);
+      formatOutputProto(CronScheduleSchema, result, opts);
       if (!(opts.json || opts.jsonl || opts.quiet))
         success(`Resumed schedule "${key}"`);
     })
@@ -7481,6 +7490,8 @@ function registerSchedulesCommands(program2, globalOpts) {
 
 // src/commands/api-keys.ts
 import chalk10 from "chalk";
+import { toJson as toJson4 } from "@bufbuild/protobuf";
+import { ApiKeySchema } from "@eide/foir-proto-ts/identity/v1/identity_pb";
 function registerApiKeysCommands(program2, globalOpts) {
   const apiKeys = program2.command("api-keys").description("Manage API keys");
   apiKeys.command("list").description("List API keys").option("--include-inactive", "Include revoked/inactive keys").option("--search <term>", "Search by name").option("--limit <n>", "Max results", "50").action(
@@ -7490,7 +7501,7 @@ function registerApiKeysCommands(program2, globalOpts) {
       const result = await client.identity.listApiKeys({
         limit: parseInt(String(cmdOpts.limit ?? "50"), 10)
       });
-      formatList(result.items, opts, {
+      formatListProto(ApiKeySchema, result.items, opts, {
         columns: [
           { key: "id", header: "ID", width: 28 },
           { key: "name", header: "Name", width: 24 },
@@ -7529,7 +7540,12 @@ function registerApiKeysCommands(program2, globalOpts) {
         name: cmdOpts.name
       });
       if (opts.json || opts.jsonl) {
-        formatOutput(result, opts);
+        formatOutput(
+          {
+            apiKey: result.apiKey ? toJson4(ApiKeySchema, result.apiKey) : null
+          },
+          opts
+        );
       } else {
         success(`Created API key: ${result.apiKey?.name}`);
         console.log("");
@@ -7556,7 +7572,12 @@ function registerApiKeysCommands(program2, globalOpts) {
         const client = await createPlatformClient(opts);
         const result = await client.identity.rotateApiKey(id);
         if (opts.json || opts.jsonl) {
-          formatOutput(result, opts);
+          formatOutput(
+            {
+              apiKey: result.apiKey ? toJson4(ApiKeySchema, result.apiKey) : null
+            },
+            opts
+          );
         } else {
           success(`Rotated API key: ${result.apiKey?.name}`);
           console.log("");
@@ -7597,6 +7618,7 @@ function registerApiKeysCommands(program2, globalOpts) {
 
 // src/commands/auth-providers.ts
 import chalk11 from "chalk";
+import { AuthProviderSchema } from "@eide/foir-proto-ts/identity/v1/identity_pb";
 var VALID_TYPES = [
   "OAUTH2",
   "TOKEN_SSO",
@@ -7614,7 +7636,7 @@ function registerAuthProvidersCommands(program2, globalOpts) {
       const result = await client.identity.listAuthProviders({
         enabled: cmdOpts.enabledOnly ? true : void 0
       });
-      formatList(result.items, opts, {
+      formatListProto(AuthProviderSchema, result.items, opts, {
         columns: [
           { key: "id", header: "ID", width: 28 },
           { key: "key", header: "Key", width: 20 },
@@ -7646,7 +7668,7 @@ function registerAuthProvidersCommands(program2, globalOpts) {
         throw new Error(`Auth provider not found: ${id}`);
       }
       if (opts.json || opts.jsonl) {
-        formatOutput(provider, opts);
+        formatOutputProto(AuthProviderSchema, provider, opts);
       } else {
         const p = provider;
         console.log(chalk11.bold(`${p.name}`) + chalk11.gray(` (${p.key})`));
@@ -7707,7 +7729,7 @@ function registerAuthProvidersCommands(program2, globalOpts) {
         input
       );
       if (opts.json || opts.jsonl) {
-        formatOutput(provider, opts);
+        formatOutputProto(AuthProviderSchema, provider, opts);
       } else {
         success(
           `Created auth provider: ${provider?.name} (${provider?.key})`
@@ -7745,7 +7767,7 @@ function registerAuthProvidersCommands(program2, globalOpts) {
           input
         );
         if (opts.json || opts.jsonl) {
-          formatOutput(provider, opts);
+          formatOutputProto(AuthProviderSchema, provider, opts);
         } else {
           success(
             `Updated auth provider: ${provider?.name} (${provider?.key})`
@@ -7780,6 +7802,7 @@ function registerAuthProvidersCommands(program2, globalOpts) {
 }
 
 // src/commands/locales.ts
+import { LocaleSchema } from "@eide/foir-proto-ts/settings/v1/settings_pb";
 function registerLocalesCommands(program2, globalOpts) {
   const locales = program2.command("locales").description("Manage locales");
   locales.command("list").description("List locales").option("--include-inactive", "Include inactive locales").option("--limit <n>", "Max results", "50").action(
@@ -7790,7 +7813,7 @@ function registerLocalesCommands(program2, globalOpts) {
         includeInactive: !!cmdOpts.includeInactive,
         limit: parseInt(String(cmdOpts.limit ?? "50"), 10)
       });
-      formatList(result.locales, opts, {
+      formatListProto(LocaleSchema, result.locales, opts, {
         columns: [
           { key: "code", header: "Code", width: 8 },
           { key: "name", header: "Name", width: 20 },
@@ -7823,7 +7846,7 @@ function registerLocalesCommands(program2, globalOpts) {
         result = await client.settings.getLocaleByCode(idOrCode);
       }
       if (!result) throw new Error(`Locale "${idOrCode}" not found.`);
-      formatOutput(result, opts);
+      formatOutputProto(LocaleSchema, result, opts);
     })
   );
   locales.command("default").description("Get the default locale").action(
@@ -7832,7 +7855,7 @@ function registerLocalesCommands(program2, globalOpts) {
       const client = await createPlatformClient(opts);
       const result = await client.settings.getDefaultLocale();
       if (!result) throw new Error("No default locale configured.");
-      formatOutput(result, opts);
+      formatOutputProto(LocaleSchema, result, opts);
     })
   );
   locales.command("create").description("Create a new locale").option("-d, --data <json>", "Locale data as JSON").option("-f, --file <path>", "Read data from file").action(
@@ -7843,9 +7866,9 @@ function registerLocalesCommands(program2, globalOpts) {
       const result = await client.settings.createLocale(
         input
       );
-      formatOutput(result, opts);
+      formatOutputProto(LocaleSchema, result, opts);
       if (!(opts.json || opts.jsonl || opts.quiet))
-        success(`Created locale ${result?.locale ?? result?.code}`);
+        success(`Created locale ${result?.locale}`);
     })
   );
   locales.command("update <id>").description("Update a locale").option("-d, --data <json>", "Locale data as JSON").option("-f, --file <path>", "Read data from file").action(
@@ -7859,9 +7882,9 @@ function registerLocalesCommands(program2, globalOpts) {
           id,
           ...input
         });
-        formatOutput(result, opts);
+        formatOutputProto(LocaleSchema, result, opts);
         if (!(opts.json || opts.jsonl || opts.quiet))
-          success(`Updated locale ${result?.locale ?? result?.code}`);
+          success(`Updated locale ${result?.locale}`);
       }
     )
   );
@@ -7888,6 +7911,7 @@ function registerLocalesCommands(program2, globalOpts) {
 }
 
 // src/commands/settings.ts
+import { SettingSchema } from "@eide/foir-proto-ts/settings/v1/settings_pb";
 function inferDataType(value) {
   if (value === "true" || value === "false")
     return { dataType: "BOOLEAN", parsed: value === "true" };
@@ -7909,7 +7933,7 @@ function registerSettingsCommands(program2, globalOpts) {
       const items = await client.settings.getSettings({
         category: cmdOpts.category
       });
-      formatList(items, opts, {
+      formatListProto(SettingSchema, items, opts, {
         columns: [
           { key: "key", header: "Key", width: 28 },
           {
@@ -7937,7 +7961,7 @@ function registerSettingsCommands(program2, globalOpts) {
       const items = await client.settings.getSettings({ key });
       const setting = items[0] ?? null;
       if (!setting) throw new Error(`Setting "${key}" not found.`);
-      formatOutput(setting, opts);
+      formatOutputProto(SettingSchema, setting, opts);
     })
   );
   settings.command("set <key> <value>").description("Set a setting value").option("--category <cat>", "Category (required for new settings)").option("--data-type <type>", "Data type (STRING, NUMBER, BOOLEAN, JSON)").action(
@@ -7961,7 +7985,7 @@ function registerSettingsCommands(program2, globalOpts) {
             dataType
           }
         });
-        formatOutput(result, opts);
+        formatOutputProto(SettingSchema, result, opts);
         if (!(opts.json || opts.jsonl || opts.quiet))
           success(`Set ${key} = ${value}`);
       }
@@ -7979,6 +8003,7 @@ function registerSettingsCommands(program2, globalOpts) {
 }
 
 // src/commands/variant-catalog.ts
+import { VariantCatalogEntrySchema } from "@eide/foir-proto-ts/settings/v1/settings_pb";
 function registerVariantCatalogCommands(program2, globalOpts) {
   const catalog = program2.command("variant-catalog").description("Manage variant catalog entries (markets, devices, locales)");
   catalog.command("list").description("List variant catalog entries").option("--active", "Only active entries").option("--limit <n>", "Max results", "50").action(
@@ -7989,7 +8014,7 @@ function registerVariantCatalogCommands(program2, globalOpts) {
         isActive: cmdOpts.active ? true : void 0,
         limit: parseInt(String(cmdOpts.limit ?? "50"), 10)
       });
-      formatList(result.entries, opts, {
+      formatListProto(VariantCatalogEntrySchema, result.entries, opts, {
         columns: [
           { key: "key", header: "Key", width: 20 },
           { key: "name", header: "Name", width: 24 },
@@ -8024,7 +8049,7 @@ function registerVariantCatalogCommands(program2, globalOpts) {
       }
       if (!result)
         throw new Error(`Variant catalog entry "${idOrKey}" not found.`);
-      formatOutput(result, opts);
+      formatOutputProto(VariantCatalogEntrySchema, result, opts);
     })
   );
   catalog.command("create").description("Create a variant catalog entry").option("-d, --data <json>", "Entry data as JSON").option("-f, --file <path>", "Read data from file").action(
@@ -8035,11 +8060,9 @@ function registerVariantCatalogCommands(program2, globalOpts) {
       const result = await client.settings.createVariantCatalogEntry(
         input
       );
-      formatOutput(result, opts);
+      formatOutputProto(VariantCatalogEntrySchema, result, opts);
       if (!(opts.json || opts.jsonl || opts.quiet))
-        success(
-          `Created variant catalog entry ${result?.key}`
-        );
+        success(`Created variant catalog entry ${result?.key}`);
     })
   );
   catalog.command("update <id>").description("Update a variant catalog entry").option("-d, --data <json>", "Entry data as JSON").option("-f, --file <path>", "Read data from file").action(
@@ -8053,11 +8076,9 @@ function registerVariantCatalogCommands(program2, globalOpts) {
           id,
           ...input
         });
-        formatOutput(result, opts);
+        formatOutputProto(VariantCatalogEntrySchema, result, opts);
         if (!(opts.json || opts.jsonl || opts.quiet))
-          success(
-            `Updated variant catalog entry ${result?.key}`
-          );
+          success(`Updated variant catalog entry ${result?.key}`);
       }
     )
   );
@@ -8085,6 +8106,10 @@ function registerVariantCatalogCommands(program2, globalOpts) {
 }
 
 // src/commands/files.ts
+import {
+  FileSchema as FileSchema2,
+  StorageUsageSchema as StorageUsageSchema2
+} from "@eide/foir-proto-ts/storage/v1/storage_pb";
 function registerFilesCommands(program2, globalOpts) {
   const files = program2.command("files").description("Manage files (for upload, use `foir media upload`)");
   files.command("list").description("List files").option("--folder <folder>", "Filter by folder").option("--mime-type <type>", "Filter by MIME type").option("--search <term>", "Search by filename").option("--limit <n>", "Max results", "50").option("--offset <n>", "Skip results", "0").action(
@@ -8098,7 +8123,7 @@ function registerFilesCommands(program2, globalOpts) {
         limit: parseInt(cmdOpts.limit ?? "50", 10),
         offset: parseInt(cmdOpts.offset ?? "0", 10)
       });
-      formatList(data.items, opts, {
+      formatListProto(FileSchema2, data.items, opts, {
         columns: [
           { key: "id", header: "ID", width: 28 },
           { key: "filename", header: "Filename", width: 30 },
@@ -8127,7 +8152,7 @@ function registerFilesCommands(program2, globalOpts) {
       const client = await createPlatformClient(opts);
       const file = await client.storage.getFile(id);
       if (!file) throw new Error(`File "${id}" not found.`);
-      formatOutput(file, opts);
+      formatOutputProto(FileSchema2, file, opts);
     })
   );
   files.command("usage").description("Get storage usage statistics").action(
@@ -8135,7 +8160,7 @@ function registerFilesCommands(program2, globalOpts) {
       const opts = globalOpts();
       const client = await createPlatformClient(opts);
       const usage = await client.storage.getStorageUsage();
-      formatOutput(usage, opts);
+      formatOutputProto(StorageUsageSchema2, usage, opts);
     })
   );
   files.command("update <id>").description("Update file properties").option("--filename <name>", "New filename").option("--folder <folder>", "Move to folder").option("--tags <tags>", "Comma-separated tags").action(
@@ -8150,7 +8175,7 @@ function registerFilesCommands(program2, globalOpts) {
         if (cmdOpts.tags)
           params.tags = cmdOpts.tags.split(",").map((t) => t.trim());
         const file = await client.storage.updateFile(params);
-        formatOutput(file, opts);
+        formatOutputProto(FileSchema2, file, opts);
         if (!(opts.json || opts.jsonl || opts.quiet))
           success(`Updated file ${id}`);
       }
@@ -8168,7 +8193,7 @@ function registerFilesCommands(program2, globalOpts) {
           caption: cmdOpts.caption,
           description: cmdOpts.description
         });
-        formatOutput(file, opts);
+        formatOutputProto(FileSchema2, file, opts);
         if (!(opts.json || opts.jsonl || opts.quiet))
           success(`Updated metadata for file ${id}`);
       }
@@ -8206,6 +8231,7 @@ function formatBytes(bytes) {
 }
 
 // src/commands/notes.ts
+import { NoteSchema } from "@eide/foir-proto-ts/settings/v1/settings_pb";
 function registerNotesCommands(program2, globalOpts) {
   const notes = program2.command("notes").description("Manage notes and comments");
   notes.command("list").description("List notes for an entity").requiredOption("--entity-type <type>", "Entity type (e.g. record, model)").requiredOption("--entity-id <id>", "Entity ID").option("--include-resolved", "Include resolved notes").option("--limit <n>", "Max results", "20").action(
@@ -8217,7 +8243,7 @@ function registerNotesCommands(program2, globalOpts) {
         entityId: cmdOpts.entityId,
         limit: parseInt(String(cmdOpts.limit ?? "20"), 10)
       });
-      formatList(data.notes, opts, {
+      formatListProto(NoteSchema, data.notes, opts, {
         columns: [
           { key: "id", header: "ID", width: 28 },
           { key: "content", header: "Content", width: 40 },
@@ -8245,7 +8271,7 @@ function registerNotesCommands(program2, globalOpts) {
       const client = await createPlatformClient(opts);
       const note = await client.settings.getNote(id);
       if (!note) throw new Error(`Note "${id}" not found.`);
-      formatOutput(note, opts);
+      formatOutputProto(NoteSchema, note, opts);
     })
   );
   notes.command("create").description("Create a note").requiredOption("--entity-type <type>", "Entity type").requiredOption("--entity-id <id>", "Entity ID").requiredOption("--body <text>", "Note body text").option("--parent-note-id <id>", "Reply to a note").action(
@@ -8261,7 +8287,7 @@ function registerNotesCommands(program2, globalOpts) {
       };
       if (cmdOpts.parentNoteId) params.parentNoteId = cmdOpts.parentNoteId;
       const note = await client.settings.createNote(params);
-      formatOutput(note, opts);
+      formatOutputProto(NoteSchema, note, opts);
       if (!(opts.json || opts.jsonl || opts.quiet)) success("Note created");
     })
   );
@@ -8275,7 +8301,7 @@ function registerNotesCommands(program2, globalOpts) {
           id,
           isResolved: true
         });
-        formatOutput(note, opts);
+        formatOutputProto(NoteSchema, note, opts);
         if (!(opts.json || opts.jsonl || opts.quiet))
           success(`Resolved note ${id}`);
       }
@@ -8304,6 +8330,7 @@ function registerNotesCommands(program2, globalOpts) {
 }
 
 // src/commands/notifications.ts
+import { NotificationSchema } from "@eide/foir-proto-ts/notifications/v1/notifications_pb";
 function registerNotificationsCommands(program2, globalOpts) {
   const notifications = program2.command("notifications").description("Manage notifications");
   notifications.command("list").description("List notifications").option("--unread", "Only unread notifications").option("--limit <n>", "Max results", "20").action(
@@ -8318,7 +8345,7 @@ function registerNotificationsCommands(program2, globalOpts) {
         console.log(`Unread: ${data.unreadCount}
 `);
       }
-      formatList(data.notifications, opts, {
+      formatListProto(NotificationSchema, data.notifications, opts, {
         columns: [
           { key: "id", header: "ID", width: 28 },
           { key: "type", header: "Type", width: 16 },
@@ -8367,6 +8394,7 @@ function registerNotificationsCommands(program2, globalOpts) {
 }
 
 // src/commands/configs.ts
+import { ConfigSchema } from "@eide/foir-proto-ts/configs/v1/configs_pb";
 function registerConfigsCommands(program2, globalOpts) {
   const configs = program2.command("configs").description("Manage configs (apps, webhooks)");
   configs.command("list").description("List configs").option("--type <type>", "Filter by config type").option("--enabled", "Only enabled configs").option("--limit <n>", "Max results", "50").action(
@@ -8378,7 +8406,7 @@ function registerConfigsCommands(program2, globalOpts) {
         enabled: cmdOpts.enabled ? true : void 0,
         limit: parseInt(String(cmdOpts.limit ?? "50"), 10)
       });
-      formatList(data.configs, opts, {
+      formatListProto(ConfigSchema, data.configs, opts, {
         columns: [
           { key: "id", header: "ID", width: 28 },
           { key: "key", header: "Key", width: 20 },
@@ -8406,7 +8434,7 @@ function registerConfigsCommands(program2, globalOpts) {
         result = await client.configs.getConfigByKey(idOrKey);
       }
       if (!result) throw new Error(`Config "${idOrKey}" not found.`);
-      formatOutput(result, opts);
+      formatOutputProto(ConfigSchema, result, opts);
     })
   );
   configs.command("create").description("Create a new config").option("-d, --data <json>", "Config data as JSON").option("-f, --file <path>", "Read data from file").action(
@@ -8415,7 +8443,7 @@ function registerConfigsCommands(program2, globalOpts) {
       const client = await createPlatformClient(opts);
       const input = await parseInputData(cmdOpts);
       const config2 = await client.configs.createConfig(input);
-      formatOutput(config2, opts);
+      formatOutputProto(ConfigSchema, config2, opts);
       if (!(opts.json || opts.jsonl || opts.quiet))
         success(`Created config ${config2?.key}`);
     })
@@ -8437,6 +8465,10 @@ function registerConfigsCommands(program2, globalOpts) {
 }
 
 // src/commands/apps.ts
+import {
+  AppSchema,
+  ValidateManifestResponseSchema
+} from "@eide/foir-proto-ts/apps/v1/apps_service_pb";
 function registerAppsCommands(program2, globalOpts) {
   const apps = program2.command("apps").description("Install and manage apps");
   apps.command("list").description("List installed apps").action(
@@ -8448,7 +8480,7 @@ function registerAppsCommands(program2, globalOpts) {
         resolved.project.tenantId,
         resolved.project.id
       );
-      formatList(apps2, opts, {
+      formatListProto(AppSchema, apps2, opts, {
         columns: [
           { key: "name", header: "Name", width: 24 },
           {
@@ -8463,9 +8495,10 @@ function registerAppsCommands(program2, globalOpts) {
             header: "Installed",
             width: 12,
             format: (v) => {
-              const ts = v;
-              if (!ts?.seconds) return "";
-              return new Date(Number(ts.seconds) * 1e3).toLocaleDateString();
+              if (!v) return "";
+              const date = new Date(v);
+              if (Number.isNaN(date.getTime())) return "";
+              return date.toLocaleDateString();
             }
           }
         ]
@@ -8483,7 +8516,7 @@ function registerAppsCommands(program2, globalOpts) {
         name
       );
       if (!app) throw new Error(`App "${name}" not installed.`);
-      formatOutput(app, opts);
+      formatOutputProto(AppSchema, app, opts);
     })
   );
   apps.command("install <manifestUrl>").description("Install an app from a manifest URL").option(
@@ -8544,7 +8577,7 @@ function registerAppsCommands(program2, globalOpts) {
           placementFieldChoices
         });
         if (opts.json) {
-          formatOutput(app, opts);
+          formatOutputProto(AppSchema, app, opts);
         } else {
           success(`Installed ${app?.name ?? ""}`);
         }
@@ -8587,7 +8620,7 @@ function registerAppsCommands(program2, globalOpts) {
           updateResp.newManifestHash
         );
         if (opts.json) {
-          formatOutput(app, opts);
+          formatOutputProto(AppSchema, app, opts);
         } else {
           success(`Updated ${name}`);
         }
@@ -8645,7 +8678,7 @@ function registerAppsCommands(program2, globalOpts) {
       const client = await createPlatformClient(opts);
       const resp = await client.apps.validateManifestUrl(manifestUrl);
       if (opts.json) {
-        formatOutput(resp, opts);
+        formatOutputProto(ValidateManifestResponseSchema, resp, opts);
         return;
       }
       if (resp.ok) {
@@ -8690,6 +8723,188 @@ function classToLabel(n) {
   }
 }
 
+// src/commands/secrets.ts
+import { promises as fs5 } from "fs";
+function registerSecretsCommands(program2, globalOpts) {
+  const secrets = program2.command("secrets").description("Manage vault secrets");
+  secrets.command("put").description("Store a new secret and print its ref").option("--label <label>", "Optional human-readable label").option("--app <name>", "Owner: app name (defaults to project-owned)").option("--file <path>", "Read plaintext from file (binary-safe)").option("--value <plaintext>", "Plaintext value (string only; prefer --file for binary)").action(
+    withErrorHandler(globalOpts, async (cmdOpts) => {
+      const opts = globalOpts();
+      const resolved = await requireProject2(opts);
+      const plaintext = await readPlaintext(cmdOpts);
+      const client = await createPlatformClient(opts);
+      const ownerKind = cmdOpts.app ? OwnerKind.APP : OwnerKind.PROJECT;
+      const ref = await client.secrets.put({
+        tenantId: resolved.project.tenantId,
+        projectId: resolved.project.id,
+        ownerKind,
+        ownerId: cmdOpts.app,
+        label: cmdOpts.label,
+        plaintext
+      });
+      if (opts.json || opts.jsonl) {
+        formatOutput({ ref }, opts);
+      } else if (opts.quiet) {
+        console.log(ref);
+      } else {
+        success(`Stored secret`);
+        console.log(`  ref:   ${ref}`);
+        if (cmdOpts.label) console.log(`  label: ${cmdOpts.label}`);
+        if (cmdOpts.app) console.log(`  app:   ${cmdOpts.app}`);
+      }
+    })
+  );
+  secrets.command("list").description("List secrets metadata (no plaintext)").option("--app <name>", "List app-owned secrets for this app").option("--include-soft-deleted", "Include soft-deleted entries").action(
+    withErrorHandler(globalOpts, async (cmdOpts) => {
+      const opts = globalOpts();
+      const resolved = await requireProject2(opts);
+      const client = await createPlatformClient(opts);
+      const ownerKind = cmdOpts.app ? OwnerKind.APP : OwnerKind.PROJECT;
+      const items = await client.secrets.list({
+        tenantId: resolved.project.tenantId,
+        projectId: resolved.project.id,
+        ownerKind,
+        ownerId: typeof cmdOpts.app === "string" ? cmdOpts.app : "",
+        includeSoftDeleted: !!cmdOpts.includeSoftDeleted
+      });
+      if (opts.json || opts.jsonl) {
+        formatOutput(
+          items.map((s) => ({
+            ref: s.ref,
+            label: s.label,
+            ownerKind: ownerKindToString(s.ownerKind),
+            ownerId: s.ownerId,
+            createdAt: tsToString(s.createdAt),
+            lastReadAt: tsToString(s.lastReadAt),
+            softDeletedAt: tsToString(s.softDeletedAt)
+          })),
+          opts
+        );
+        return;
+      }
+      if (items.length === 0) {
+        warn("No secrets found.");
+        return;
+      }
+      for (const s of items) {
+        const owner = s.ownerKind === OwnerKind.APP ? `app:${s.ownerId}` : "project";
+        const deleted = s.softDeletedAt ? "  [soft-deleted]" : "";
+        console.log(`${s.ref}  ${owner.padEnd(24)}  ${s.label ?? ""}${deleted}`);
+      }
+    })
+  );
+  secrets.command("rotate <ref>").description("Replace plaintext for an existing ref; returns new ref").option("--file <path>", "Read plaintext from file (binary-safe)").option("--value <plaintext>", "Plaintext value (string only; prefer --file for binary)").option("--confirm", "Skip confirmation prompt").action(
+    withErrorHandler(globalOpts, async (ref, cmdOpts) => {
+      const opts = globalOpts();
+      const confirmed = await confirmAction(
+        `Rotate secret ${ref}? Every record pointing at it will be updated to the new ref.`,
+        { confirm: !!cmdOpts.confirm }
+      );
+      if (!confirmed) {
+        console.log("Aborted.");
+        return;
+      }
+      const plaintext = await readPlaintext(cmdOpts);
+      const client = await createPlatformClient(opts);
+      const newRef = await client.secrets.rotate(ref, plaintext);
+      if (opts.json || opts.jsonl) {
+        formatOutput({ oldRef: ref, newRef }, opts);
+      } else if (opts.quiet) {
+        console.log(newRef);
+      } else {
+        success(`Rotated`);
+        console.log(`  old: ${ref}`);
+        console.log(`  new: ${newRef}`);
+      }
+    })
+  );
+  secrets.command("delete <ref>").description("Soft-delete a secret (recoverable until purged)").option("--confirm", "Skip confirmation prompt").action(
+    withErrorHandler(globalOpts, async (ref, cmdOpts) => {
+      const opts = globalOpts();
+      const confirmed = await confirmAction(
+        `Soft-delete secret ${ref}? Refuses if the secret is still referenced.`,
+        { confirm: !!cmdOpts.confirm }
+      );
+      if (!confirmed) {
+        console.log("Aborted.");
+        return;
+      }
+      const client = await createPlatformClient(opts);
+      await client.secrets.delete(ref);
+      success(`Deleted ${ref}`);
+    })
+  );
+  secrets.command("restore <ref>").description("Undo a soft-delete (only valid before purge_after passes)").action(
+    withErrorHandler(globalOpts, async (ref) => {
+      const opts = globalOpts();
+      const client = await createPlatformClient(opts);
+      await client.secrets.restore(ref);
+      success(`Restored ${ref}`);
+    })
+  );
+  secrets.command("purge").description("Drop every soft-deleted secret past its TTL (admin-only)").option("--confirm", "Skip confirmation prompt").action(
+    withErrorHandler(globalOpts, async (cmdOpts) => {
+      const opts = globalOpts();
+      const confirmed = await confirmAction(
+        `Purge soft-deleted secrets? Cannot be undone.`,
+        { confirm: !!cmdOpts.confirm }
+      );
+      if (!confirmed) {
+        console.log("Aborted.");
+        return;
+      }
+      const resolved = await requireProject2(opts);
+      const client = await createPlatformClient(opts);
+      const count = await client.secrets.purge({
+        tenantId: resolved.project.tenantId,
+        projectId: resolved.project.id
+      });
+      success(`Purged ${count} secret(s)`);
+    })
+  );
+}
+async function requireProject2(opts) {
+  const resolved = await resolveProjectContext(opts);
+  if (!resolved) {
+    throw new Error(
+      "No project selected. Run `foir select-project` or set FOIR_PROJECT."
+    );
+  }
+  return resolved;
+}
+async function readPlaintext(cmdOpts) {
+  const file = typeof cmdOpts.file === "string" ? cmdOpts.file : "";
+  const value = typeof cmdOpts.value === "string" ? cmdOpts.value : "";
+  if (file && value) {
+    throw new Error("Pass either --file or --value, not both.");
+  }
+  if (!file && !value) {
+    throw new Error("One of --file or --value is required.");
+  }
+  if (file) {
+    return fs5.readFile(file);
+  }
+  return new TextEncoder().encode(value);
+}
+function ownerKindToString(k) {
+  switch (k) {
+    case OwnerKind.PROJECT:
+      return "project";
+    case OwnerKind.APP:
+      return "app";
+    case OwnerKind.CUSTOMER:
+      return "customer";
+    default:
+      return "";
+  }
+}
+function tsToString(t) {
+  if (!t || t.seconds === void 0 && t.nanos === void 0) return "";
+  const seconds = Number(t.seconds ?? 0n);
+  const nanos = t.nanos ?? 0;
+  return new Date(seconds * 1e3 + Math.floor(nanos / 1e6)).toISOString();
+}
+
 // src/cli.ts
 var __filename = fileURLToPath(import.meta.url);
 var __dirname = dirname4(__filename);
@@ -8739,4 +8954,5 @@ registerNotesCommands(program, getGlobalOpts);
 registerNotificationsCommands(program, getGlobalOpts);
 registerConfigsCommands(program, getGlobalOpts);
 registerAppsCommands(program, getGlobalOpts);
+registerSecretsCommands(program, getGlobalOpts);
 program.parse();