@eide/foir-cli 0.22.0 → 0.24.0

package/dist/cli.js

@@ -469,7 +469,7 @@ import { StorageService as StorageService2 } from "@eide/foir-proto-ts/storage/v
 import { OperationsService as OperationsService2 } from "@eide/foir-proto-ts/operations/v1/operations_pb";
 import { HooksService as HooksService2 } from "@eide/foir-proto-ts/hooks/v1/hooks_pb";
 import { NotificationsService as NotificationsService2 } from "@eide/foir-proto-ts/notifications/v1/notifications_pb";
-import { SchedulesService as SchedulesService2 } from "@eide/foir-proto-ts/schedules/v1/schedules_pb";
+import { SchedulesService as SchedulesService3 } from "@eide/foir-proto-ts/schedules/v1/schedules_pb";
 import { AppsService as AppsService2 } from "@eide/foir-proto-ts/apps/v1/apps_service_pb";
 import { SecretsService as SecretsService2 } from "@eide/foir-proto-ts/secrets/v1/secrets_pb";
 
@@ -1464,7 +1464,10 @@ import {
   GlobalSearchRequestSchema,
   GetEmbeddingStatsRequestSchema,
   GetRecordEmbeddingsRequestSchema,
-  FindSimilarRecordsRequestSchema
+  FindSimilarRecordsRequestSchema,
+  WriteEmbeddingsRequestSchema,
+  DeleteEmbeddingsRequestSchema,
+  SearchEmbeddingsRequestSchema
 } from "@eide/foir-proto-ts/records/v1/records_pb";
 import { RecordType } from "@eide/foir-proto-ts/records/v1/records_pb";
 function sanitizeData(obj) {
@@ -1812,6 +1815,34 @@ function createRecordsMethods(client) {
         })
       );
       return resp.records ?? [];
+    },
+    async writeEmbeddings(params) {
+      const resp = await client.writeEmbeddings(
+        create4(WriteEmbeddingsRequestSchema, {
+          recordId: params.recordId,
+          vector: params.vector,
+          dimensions: params.dimensions,
+          provider: params.provider,
+          modelName: params.modelName
+        })
+      );
+      return resp.success;
+    },
+    async deleteEmbeddings(recordId) {
+      const resp = await client.deleteEmbeddings(
+        create4(DeleteEmbeddingsRequestSchema, { recordId })
+      );
+      return resp.success;
+    },
+    async searchEmbeddings(params) {
+      const resp = await client.searchEmbeddings(
+        create4(SearchEmbeddingsRequestSchema, {
+          queryVector: params.queryVector,
+          modelKey: params.modelKey,
+          limit: params.limit ?? 10
+        })
+      );
+      return resp.results ?? [];
     }
   };
 }
@@ -3032,8 +3063,144 @@ function createCronSchedulesMethods(client) {
   };
 }
 
-// src/lib/rpc/secrets.ts
+// src/lib/rpc/publish-batches.ts
 import { create as create13 } from "@bufbuild/protobuf";
+import { timestampFromDate } from "@bufbuild/protobuf/wkt";
+import {
+  ListPublishBatchesRequestSchema,
+  GetPublishBatchRequestSchema,
+  CreatePublishBatchRequestSchema,
+  UpdatePublishBatchRequestSchema,
+  DeletePublishBatchRequestSchema,
+  TriggerPublishBatchRequestSchema,
+  PausePublishBatchRequestSchema,
+  ResumePublishBatchRequestSchema,
+  PreviewRollbackBatchRequestSchema,
+  RollbackPublishBatchRequestSchema,
+  RetryFailedBatchItemsRequestSchema,
+  AddItemsToPublishBatchRequestSchema,
+  RemoveItemsFromPublishBatchRequestSchema
+} from "@eide/foir-proto-ts/schedules/v1/schedules_pb";
+function createPublishBatchesMethods(client) {
+  return {
+    async listPublishBatches(params = {}) {
+      const resp = await client.listPublishBatches(
+        create13(ListPublishBatchesRequestSchema, {
+          status: params.status,
+          limit: params.limit ?? 50,
+          offset: params.offset ?? 0
+        })
+      );
+      return { batches: resp.batches ?? [], total: resp.total };
+    },
+    async getPublishBatch(id) {
+      const resp = await client.getPublishBatch(
+        create13(GetPublishBatchRequestSchema, { id })
+      );
+      return { batch: resp.batch ?? null, items: resp.items ?? [] };
+    },
+    async createPublishBatch(input) {
+      const resp = await client.createPublishBatch(
+        create13(CreatePublishBatchRequestSchema, {
+          name: input.name,
+          description: input.description,
+          scheduledAt: timestampFromDate(input.scheduledAt),
+          versionIds: input.versionIds ?? [],
+          modelIds: input.modelIds ?? [],
+          operationIds: input.operationIds ?? [],
+          contextDimensionIds: input.contextDimensionIds ?? [],
+          authProviderIds: input.authProviderIds ?? [],
+          includeProfileSchema: input.includeProfileSchema ?? false
+        })
+      );
+      return resp.batch ?? null;
+    },
+    async updatePublishBatch(input) {
+      const resp = await client.updatePublishBatch(
+        create13(UpdatePublishBatchRequestSchema, {
+          id: input.id,
+          name: input.name,
+          description: input.description,
+          scheduledAt: input.scheduledAt ? timestampFromDate(input.scheduledAt) : void 0
+        })
+      );
+      return resp.batch ?? null;
+    },
+    async deletePublishBatch(id) {
+      const resp = await client.deletePublishBatch(
+        create13(DeletePublishBatchRequestSchema, { id })
+      );
+      return resp.success;
+    },
+    async triggerPublishBatch(id) {
+      const resp = await client.triggerPublishBatch(
+        create13(TriggerPublishBatchRequestSchema, { id })
+      );
+      return resp.batch ?? null;
+    },
+    async pausePublishBatch(id) {
+      const resp = await client.pausePublishBatch(
+        create13(PausePublishBatchRequestSchema, { id })
+      );
+      return resp.batch ?? null;
+    },
+    async resumePublishBatch(id) {
+      const resp = await client.resumePublishBatch(
+        create13(ResumePublishBatchRequestSchema, { id })
+      );
+      return resp.batch ?? null;
+    },
+    async previewRollback(batchId) {
+      const resp = await client.previewRollbackBatch(
+        create13(PreviewRollbackBatchRequestSchema, { batchId })
+      );
+      return resp;
+    },
+    async rollbackPublishBatch(batchId) {
+      const resp = await client.rollbackPublishBatch(
+        create13(RollbackPublishBatchRequestSchema, { batchId })
+      );
+      return resp.batch ?? null;
+    },
+    async retryFailedItems(batchId) {
+      const resp = await client.retryFailedBatchItems(
+        create13(RetryFailedBatchItemsRequestSchema, { batchId })
+      );
+      return resp.batch ?? null;
+    },
+    async addItems(input) {
+      const resp = await client.addItemsToPublishBatch(
+        create13(AddItemsToPublishBatchRequestSchema, {
+          batchId: input.batchId,
+          versionIds: input.versionIds ?? [],
+          modelIds: input.modelIds ?? [],
+          operationIds: input.operationIds ?? [],
+          contextDimensionIds: input.contextDimensionIds ?? [],
+          authProviderIds: input.authProviderIds ?? [],
+          includeProfileSchema: input.includeProfileSchema ?? false
+        })
+      );
+      return resp.batch ?? null;
+    },
+    async removeItems(input) {
+      const resp = await client.removeItemsFromPublishBatch(
+        create13(RemoveItemsFromPublishBatchRequestSchema, {
+          batchId: input.batchId,
+          versionIds: input.versionIds ?? [],
+          modelIds: input.modelIds ?? [],
+          operationIds: input.operationIds ?? [],
+          contextDimensionIds: input.contextDimensionIds ?? [],
+          authProviderIds: input.authProviderIds ?? [],
+          excludeProfileSchema: input.excludeProfileSchema ?? false
+        })
+      );
+      return resp.batch ?? null;
+    }
+  };
+}
+
+// src/lib/rpc/secrets.ts
+import { create as create14 } from "@bufbuild/protobuf";
 import {
   PutSecretRequestSchema,
   GetSecretRequestSchema,
@@ -3048,7 +3215,7 @@ function createSecretsMethods(client) {
   return {
     async put(args) {
       const resp = await client.putSecret(
-        create13(PutSecretRequestSchema, {
+        create14(PutSecretRequestSchema, {
           tenantId: args.tenantId,
           projectId: args.projectId,
           ownerKind: args.ownerKind,
@@ -3061,12 +3228,12 @@ function createSecretsMethods(client) {
     },
     async get(ref, purpose) {
       return client.getSecret(
-        create13(GetSecretRequestSchema, { ref, purpose: purpose ?? "" })
+        create14(GetSecretRequestSchema, { ref, purpose: purpose ?? "" })
       );
     },
     async list(args) {
       const resp = await client.listSecrets(
-        create13(ListSecretsRequestSchema, {
+        create14(ListSecretsRequestSchema, {
           tenantId: args.tenantId,
           projectId: args.projectId,
           ownerKind: args.ownerKind ?? OwnerKind.UNSPECIFIED,
@@ -3078,19 +3245,19 @@ function createSecretsMethods(client) {
     },
     async rotate(ref, plaintext) {
       const resp = await client.rotateSecret(
-        create13(RotateSecretRequestSchema, { ref, plaintext })
+        create14(RotateSecretRequestSchema, { ref, plaintext })
       );
       return resp.newRef;
     },
     async delete(ref) {
-      await client.deleteSecret(create13(DeleteSecretRequestSchema, { ref }));
+      await client.deleteSecret(create14(DeleteSecretRequestSchema, { ref }));
     },
     async restore(ref) {
-      await client.restoreSecret(create13(RestoreSecretRequestSchema, { ref }));
+      await client.restoreSecret(create14(RestoreSecretRequestSchema, { ref }));
     },
     async purge(args = {}) {
       const resp = await client.purgeSoftDeleted(
-        create13(PurgeSoftDeletedRequestSchema, {
+        create14(PurgeSoftDeletedRequestSchema, {
           tenantId: args.tenantId ?? "",
           projectId: args.projectId ?? ""
         })
@@ -3154,7 +3321,10 @@ async function createPlatformClient(options) {
       createRpcClient(NotificationsService2, transport)
     ),
     cronSchedules: createCronSchedulesMethods(
-      createRpcClient(SchedulesService2, transport)
+      createRpcClient(SchedulesService3, transport)
+    ),
+    publishBatches: createPublishBatchesMethods(
+      createRpcClient(SchedulesService3, transport)
     ),
     apps: createAppsMethods(createRpcClient(AppsService2, transport)),
     secrets: createSecretsMethods(createRpcClient(SecretsService2, transport))
@@ -3188,7 +3358,10 @@ function createPlatformClientWithHeaders(apiUrl, headers) {
       createRpcClient(NotificationsService2, transport)
     ),
     cronSchedules: createCronSchedulesMethods(
-      createRpcClient(SchedulesService2, transport)
+      createRpcClient(SchedulesService3, transport)
+    ),
+    publishBatches: createPublishBatchesMethods(
+      createRpcClient(SchedulesService3, transport)
     ),
     apps: createAppsMethods(createRpcClient(AppsService2, transport)),
     secrets: createSecretsMethods(createRpcClient(SecretsService2, transport))
@@ -5627,11 +5800,7 @@ function registerPushCommand(program2, globalOpts) {
     false
   ).option(
     "--publish",
-    "Promote updated models, operations, auth providers, and profile schema to the published channel after the push. New resources auto-publish; this flag covers updates, which are otherwise left as drafts.",
-    false
-  ).option(
-    "--publish-tokens",
-    "Promote applied design tokens to the published channel after the push. Without this flag, tokens land on the draft channel and the storefront keeps serving the last published snapshot.",
+    "Promote updated models, operations, auth providers, profile schema, and design tokens to the published channel after the push. New resources auto-publish; this flag covers updates, which are otherwise left as drafts.",
     false
   ).option("--env <path>", "Path to .env file (default: .env)").action(
     withErrorHandler(
@@ -5693,7 +5862,7 @@ function registerPushCommand(program2, globalOpts) {
             tenantId: resolved?.project.tenantId,
             projectId: resolved?.project.id,
             force: opts.force ?? false,
-            publishDesignTokens: opts.publishTokens ?? false
+            publishDesignTokens: opts.publish ?? false
           });
         } catch (e) {
           if (e instanceof PushConflictError) {
@@ -5756,6 +5925,7 @@ function registerPushCommand(program2, globalOpts) {
           if (publishCounts.authProviders)
             lines.push(`${publishCounts.authProviders} auth providers`);
           if (publishCounts.profileSchema) lines.push("profile schema");
+          if (summary.designTokensPublished) lines.push("design tokens");
           console.log();
           if (lines.length > 0) {
             console.log(
@@ -5766,7 +5936,7 @@ function registerPushCommand(program2, globalOpts) {
               chalk6.dim("  Nothing to publish (no resources were updated).")
             );
           }
-        } else if (summary.updatedModelIds.length + summary.updatedOperationIds.length + summary.updatedAuthProviderIds.length > 0 || summary.profileSchemaUpdated) {
+        } else if (summary.updatedModelIds.length + summary.updatedOperationIds.length + summary.updatedAuthProviderIds.length > 0 || summary.profileSchemaUpdated || summary.designTokensUpdated) {
           console.log();
           console.log(
             chalk6.dim(
@@ -7504,8 +7674,61 @@ function registerApiKeysCommands(program2, globalOpts) {
   );
 }
 
-// src/commands/auth-providers.ts
+// src/commands/auth.ts
 import chalk11 from "chalk";
+import { CustomerAuthConfigSchema } from "@eide/foir-proto-ts/identity/v1/identity_pb";
+import { timestampDate } from "@bufbuild/protobuf/wkt";
+function registerAuthCommands(program2, globalOpts) {
+  const auth = program2.command("auth").description("Inspect customer auth configuration and verify customer tokens");
+  auth.command("config").description("Print the project's customer-auth configuration").action(
+    withErrorHandler(globalOpts, async () => {
+      const opts = globalOpts();
+      const client = await createPlatformClient(opts);
+      const config2 = await client.identity.getCustomerAuthConfig();
+      if (!config2) {
+        throw new Error("No customer auth configuration found for this project.");
+      }
+      formatOutputProto(CustomerAuthConfigSchema, config2, opts);
+    })
+  );
+  auth.command("verify-token <token>").description("Verify a customer JWT and print its claims").action(
+    withErrorHandler(globalOpts, async (token) => {
+      const opts = globalOpts();
+      const client = await createPlatformClient(opts);
+      const resp = await client.identity.verifyCustomerToken(token);
+      const expiresAtIso = resp.expiresAt ? timestampDate(resp.expiresAt).toISOString() : null;
+      if (opts.json || opts.jsonl) {
+        formatOutput(
+          {
+            valid: resp.valid,
+            customerId: resp.customerId ?? null,
+            email: resp.email ?? null,
+            roles: resp.roles ?? [],
+            expiresAt: expiresAtIso,
+            error: resp.error ?? null
+          },
+          opts
+        );
+        return;
+      }
+      if (!resp.valid) {
+        throw new Error(
+          `Token invalid: ${resp.error ?? "no further detail"}`
+        );
+      }
+      console.log(chalk11.green("\u25CF Valid"));
+      if (resp.customerId)
+        console.log(`  Customer: ${chalk11.cyan(resp.customerId)}`);
+      if (resp.email) console.log(`  Email:    ${resp.email}`);
+      if (resp.roles && resp.roles.length > 0)
+        console.log(`  Roles:    ${resp.roles.join(", ")}`);
+      if (expiresAtIso) console.log(`  Expires:  ${expiresAtIso}`);
+    })
+  );
+}
+
+// src/commands/auth-providers.ts
+import chalk12 from "chalk";
 import { AuthProviderSchema } from "@eide/foir-proto-ts/identity/v1/identity_pb";
 var VALID_TYPES = [
   "OAUTH2",
@@ -7559,7 +7782,7 @@ function registerAuthProvidersCommands(program2, globalOpts) {
         formatOutputProto(AuthProviderSchema, provider, opts);
       } else {
         const p = provider;
-        console.log(chalk11.bold(`${p.name}`) + chalk11.gray(` (${p.key})`));
+        console.log(chalk12.bold(`${p.name}`) + chalk12.gray(` (${p.key})`));
         console.log(`  Type:     ${p.type}`);
         console.log(`  Enabled:  ${p.enabled ? "yes" : "no"}`);
         console.log(`  Default:  ${p.isDefault ? "yes" : "no"}`);
@@ -7573,13 +7796,13 @@ function registerAuthProvidersCommands(program2, globalOpts) {
         if (p.configDisplay) {
           console.log(`  Config:`);
           console.log(
-            chalk11.gray(
+            chalk12.gray(
               JSON.stringify(p.configDisplay, null, 2).replace(/^/gm, "    ")
             )
           );
         }
-        console.log(chalk11.gray(`  Created: ${p.createdAt}`));
-        console.log(chalk11.gray(`  Updated: ${p.updatedAt}`));
+        console.log(chalk12.gray(`  Created: ${p.createdAt}`));
+        console.log(chalk12.gray(`  Updated: ${p.updatedAt}`));
       }
     })
   );
@@ -7689,6 +7912,637 @@ function registerAuthProvidersCommands(program2, globalOpts) {
   );
 }
 
+// src/commands/embeddings.ts
+import chalk13 from "chalk";
+function registerEmbeddingsCommands(program2, globalOpts) {
+  const embeddings = program2.command("embeddings").description("Manage vector embeddings for semantic search");
+  embeddings.command("write").description("Write an embedding vector for a record").option("-d, --data <json>", "Embedding input as JSON string").option("--file <path>", "Embedding input from JSON file").action(
+    withErrorHandler(globalOpts, async (cmdOpts) => {
+      const opts = globalOpts();
+      const input = await parseInputData({
+        data: cmdOpts.data,
+        file: cmdOpts.file
+      });
+      if (!input?.recordId) {
+        throw new Error("Embedding input missing required field: recordId");
+      }
+      if (!Array.isArray(input.vector) || input.vector.length === 0) {
+        throw new Error(
+          "Embedding input missing required field: vector (non-empty number[])"
+        );
+      }
+      const dimensions = input.dimensions ?? input.vector.length;
+      const client = await createPlatformClient(opts);
+      const ok = await client.records.writeEmbeddings({
+        recordId: input.recordId,
+        vector: input.vector,
+        dimensions,
+        provider: input.provider,
+        modelName: input.modelName
+      });
+      if (opts.json || opts.jsonl) {
+        formatOutput({ written: ok, recordId: input.recordId, dimensions }, opts);
+      } else if (ok) {
+        success(
+          `Wrote ${dimensions}-dim embedding for ${input.recordId}`
+        );
+      } else {
+        throw new Error(`Write failed for ${input.recordId}`);
+      }
+    })
+  );
+  embeddings.command("delete <recordId>").description("Delete the embedding for a record").option("--confirm", "Skip confirmation prompt").action(
+    withErrorHandler(
+      globalOpts,
+      async (recordId, cmdOpts) => {
+        const opts = globalOpts();
+        const confirmed = await confirmAction(
+          `Delete embedding for ${recordId}?`,
+          { confirm: !!cmdOpts.confirm }
+        );
+        if (!confirmed) {
+          console.log("Aborted.");
+          return;
+        }
+        const client = await createPlatformClient(opts);
+        const ok = await client.records.deleteEmbeddings(recordId);
+        if (opts.json || opts.jsonl) {
+          formatOutput({ deleted: ok, recordId }, opts);
+        } else {
+          success(`Deleted embedding for ${recordId}`);
+        }
+      }
+    )
+  );
+  embeddings.command("search").description("Search by vector similarity").requiredOption(
+    "-d, --data <json>",
+    'Search input as JSON: {"queryVector":[\u2026],"modelKey":"\u2026","limit":10}'
+  ).action(
+    withErrorHandler(globalOpts, async (cmdOpts) => {
+      const opts = globalOpts();
+      const input = await parseInputData({
+        data: cmdOpts.data
+      });
+      if (!Array.isArray(input.queryVector) || input.queryVector.length === 0) {
+        throw new Error(
+          "Search input missing required field: queryVector (non-empty number[])"
+        );
+      }
+      const client = await createPlatformClient(opts);
+      const results = await client.records.searchEmbeddings({
+        queryVector: input.queryVector,
+        modelKey: input.modelKey,
+        limit: input.limit
+      });
+      if (opts.json || opts.jsonl) {
+        formatOutput(results, opts);
+        return;
+      }
+      if (results.length === 0) {
+        console.log(chalk13.dim("No matches."));
+        return;
+      }
+      for (const r of results) {
+        const score = typeof r.similarity === "number" ? r.similarity.toFixed(4) : "\u2014";
+        console.log(
+          `  ${chalk13.cyan(r.id)}  ${chalk13.dim(r.modelKey ?? "")}  ${chalk13.gray(`sim=${score}`)}`
+        );
+      }
+    })
+  );
+  embeddings.command("list <recordId>").description("List embeddings stored for a record").action(
+    withErrorHandler(globalOpts, async (recordId) => {
+      const opts = globalOpts();
+      const client = await createPlatformClient(opts);
+      const items = await client.records.getRecordEmbeddings(recordId);
+      formatOutput(items, opts);
+    })
+  );
+  embeddings.command("stats [modelKey]").description("Embedding statistics, optionally scoped to a model").action(
+    withErrorHandler(globalOpts, async (modelKey) => {
+      const opts = globalOpts();
+      const client = await createPlatformClient(opts);
+      const stats = await client.records.getEmbeddingStats(modelKey);
+      if (opts.json || opts.jsonl) {
+        formatOutput(stats, opts);
+        return;
+      }
+      if (stats.length === 0) {
+        console.log(chalk13.dim("No embeddings yet."));
+        return;
+      }
+      for (const s of stats) {
+        console.log(
+          `  ${chalk13.cyan(s.modelKey)}  ${chalk13.dim(`embedded=${s.embeddedRecords}/${s.totalRecords} pending=${s.pendingRecords}`)}`
+        );
+      }
+    })
+  );
+  embeddings.command("similar <recordId>").description("Find records similar to the given record").option("--model-key <key>", "Limit matches to a specific model").option("--limit <n>", "Maximum results (default: 10)").action(
+    withErrorHandler(
+      globalOpts,
+      async (recordId, cmdOpts) => {
+        const opts = globalOpts();
+        const client = await createPlatformClient(opts);
+        const results = await client.records.findSimilarRecords({
+          recordId,
+          modelKey: cmdOpts.modelKey,
+          limit: cmdOpts.limit ? parseInt(String(cmdOpts.limit), 10) : void 0
+        });
+        if (opts.json || opts.jsonl) {
+          formatOutput(results, opts);
+          return;
+        }
+        if (results.length === 0) {
+          console.log(chalk13.dim("No similar records."));
+          return;
+        }
+        for (const r of results) {
+          const score = typeof r.similarity === "number" ? r.similarity.toFixed(4) : "\u2014";
+          console.log(
+            `  ${chalk13.cyan(r.id)}  ${chalk13.dim(r.modelKey ?? "")}  ${chalk13.gray(`sim=${score}`)}`
+          );
+        }
+      }
+    )
+  );
+}
+
+// src/commands/hooks.ts
+import {
+  HookSchema,
+  HookDeliverySchema
+} from "@eide/foir-proto-ts/hooks/v1/hooks_pb";
+function registerHooksCommands(program2, globalOpts) {
+  const hooks = program2.command("hooks").description("Manage lifecycle hooks (event-driven webhooks)");
+  hooks.command("list").description("List hooks").option("--event <event>", "Filter by event name").option("--active", "Show only active hooks").option("--inactive", "Show only inactive hooks").option("--limit <n>", "Maximum results (default: 50)").option("--offset <n>", "Pagination offset").action(
+    withErrorHandler(globalOpts, async (cmdOpts) => {
+      const opts = globalOpts();
+      const client = await createPlatformClient(opts);
+      let isActive;
+      if (cmdOpts.active) isActive = true;
+      else if (cmdOpts.inactive) isActive = false;
+      const resp = await client.hooks.listHooks({
+        event: cmdOpts.event,
+        isActive,
+        limit: cmdOpts.limit ? parseInt(String(cmdOpts.limit), 10) : void 0,
+        offset: cmdOpts.offset ? parseInt(String(cmdOpts.offset), 10) : void 0
+      });
+      formatListProto(HookSchema, resp.hooks ?? [], opts, {
+        columns: [
+          { key: "id", header: "ID", width: 28 },
+          { key: "key", header: "Key", width: 24 },
+          { key: "name", header: "Name", width: 24 },
+          { key: "event", header: "Event", width: 22 },
+          { key: "targetType", header: "Target", width: 14 },
+          {
+            key: "isActive",
+            header: "Active",
+            width: 7,
+            format: (v) => v ? "yes" : "no"
+          }
+        ]
+      });
+    })
+  );
+  hooks.command("get <keyOrId>").description("Get a hook by key or ID").action(
+    withErrorHandler(globalOpts, async (keyOrId) => {
+      const opts = globalOpts();
+      const client = await createPlatformClient(opts);
+      const hook = keyOrId.includes("-") || keyOrId.length > 20 ? await client.hooks.getHook(keyOrId) : await client.hooks.getHookByKey(keyOrId);
+      if (!hook) {
+        throw new Error(`Hook not found: ${keyOrId}`);
+      }
+      formatOutputProto(HookSchema, hook, opts);
+    })
+  );
+  hooks.command("create").description("Create a hook").option("-d, --data <json>", "Hook definition as JSON string").option("--file <path>", "Hook definition from JSON file").action(
+    withErrorHandler(globalOpts, async (cmdOpts) => {
+      const opts = globalOpts();
+      const input = await parseInputData({
+        data: cmdOpts.data,
+        file: cmdOpts.file
+      });
+      for (const required of ["key", "name", "event", "targetType"]) {
+        if (!input[required]) {
+          throw new Error(`Hook input missing required field: ${required}`);
+        }
+      }
+      const client = await createPlatformClient(opts);
+      const hook = await client.hooks.createHook({
+        key: input.key,
+        name: input.name,
+        event: input.event,
+        targetType: input.targetType,
+        description: input.description,
+        operationKey: input.operationKey,
+        notificationConfig: input.notificationConfig,
+        filter: input.filter,
+        configId: input.configId
+      });
+      if (opts.json || opts.jsonl) {
+        formatOutputProto(HookSchema, hook, opts);
+      } else {
+        success(`Created hook ${hook?.key} (${hook?.id})`);
+      }
+    })
+  );
+  hooks.command("update <id>").description("Update a hook").option("-d, --data <json>", "Patch fields as JSON string").option("--file <path>", "Patch fields from JSON file").option("--active", "Activate the hook").option("--no-active", "Deactivate the hook").action(
+    withErrorHandler(
+      globalOpts,
+      async (id, cmdOpts) => {
+        const opts = globalOpts();
+        const patch = cmdOpts.data || cmdOpts.file ? await parseInputData({
+          data: cmdOpts.data,
+          file: cmdOpts.file
+        }) : {};
+        const update = {
+          id,
+          name: patch.name,
+          description: patch.description,
+          operationKey: patch.operationKey,
+          notificationConfig: patch.notificationConfig,
+          filter: patch.filter
+        };
+        if (cmdOpts.active !== void 0) {
+          update.isActive = !!cmdOpts.active;
+        }
+        const client = await createPlatformClient(opts);
+        const hook = await client.hooks.updateHook(update);
+        if (opts.json || opts.jsonl) {
+          formatOutputProto(HookSchema, hook, opts);
+        } else {
+          success(`Updated hook ${hook?.key} (${hook?.id})`);
+        }
+      }
+    )
+  );
+  hooks.command("delete <id>").description("Delete a hook").option("--confirm", "Skip confirmation prompt").action(
+    withErrorHandler(
+      globalOpts,
+      async (id, cmdOpts) => {
+        const opts = globalOpts();
+        const confirmed = await confirmAction(
+          `Delete hook ${id}? This also removes its delivery history.`,
+          { confirm: !!cmdOpts.confirm }
+        );
+        if (!confirmed) {
+          console.log("Aborted.");
+          return;
+        }
+        const client = await createPlatformClient(opts);
+        const deleted = await client.hooks.deleteHook(id);
+        if (opts.json || opts.jsonl) {
+          formatOutput({ deleted, id }, opts);
+        } else {
+          success(`Deleted hook ${id}`);
+        }
+      }
+    )
+  );
+  hooks.command("deliveries <hookId>").description("List recent deliveries for a hook").option("--status <status>", "Filter by status (success / failed / pending)").option("--limit <n>", "Maximum results (default: 50)").option("--offset <n>", "Pagination offset").action(
+    withErrorHandler(
+      globalOpts,
+      async (hookId, cmdOpts) => {
+        const opts = globalOpts();
+        const client = await createPlatformClient(opts);
+        const resp = await client.hooks.listHookDeliveries({
+          hookId,
+          status: cmdOpts.status,
+          limit: cmdOpts.limit ? parseInt(String(cmdOpts.limit), 10) : void 0,
+          offset: cmdOpts.offset ? parseInt(String(cmdOpts.offset), 10) : void 0
+        });
+        formatListProto(HookDeliverySchema, resp.deliveries ?? [], opts, {
+          columns: [
+            { key: "id", header: "ID", width: 28 },
+            { key: "event", header: "Event", width: 22 },
+            { key: "status", header: "Status", width: 10 },
+            { key: "attempts", header: "Tries", width: 6 },
+            {
+              key: "durationMs",
+              header: "Duration",
+              width: 10,
+              format: (v) => typeof v === "number" ? `${v}ms` : "\u2014"
+            },
+            { key: "deliveredAt", header: "Delivered", width: 24 }
+          ]
+        });
+      }
+    )
+  );
+  hooks.command("retry-delivery <deliveryId>").description("Retry a failed delivery").action(
+    withErrorHandler(globalOpts, async (deliveryId) => {
+      const opts = globalOpts();
+      const client = await createPlatformClient(opts);
+      const ok = await client.hooks.retryHookDelivery(deliveryId);
+      if (opts.json || opts.jsonl) {
+        formatOutput({ retried: ok, deliveryId }, opts);
+      } else if (ok) {
+        success(`Re-queued delivery ${deliveryId}`);
+      } else {
+        throw new Error(`Retry failed for delivery ${deliveryId}`);
+      }
+    })
+  );
+  hooks.command("test <hookId>").description("Send a test delivery against the hook").option("-d, --data <json>", "Test payload as JSON string").option("--file <path>", "Test payload from JSON file").action(
+    withErrorHandler(
+      globalOpts,
+      async (hookId, cmdOpts) => {
+        const opts = globalOpts();
+        const testPayload = cmdOpts.data || cmdOpts.file ? await parseInputData({
+          data: cmdOpts.data,
+          file: cmdOpts.file
+        }) : void 0;
+        const client = await createPlatformClient(opts);
+        const result = await client.hooks.testHook({ hookId, testPayload });
+        if (opts.json || opts.jsonl) {
+          formatOutput(result, opts);
+        } else if (result.success) {
+          success(`Test delivery succeeded for hook ${hookId}`);
+        } else {
+          throw new Error(
+            `Test delivery failed: ${result.error ?? "unknown error"}`
+          );
+        }
+      }
+    )
+  );
+}
+
+// src/commands/rollouts.ts
+import chalk14 from "chalk";
+import { PublishBatchSchema } from "@eide/foir-proto-ts/schedules/v1/schedules_pb";
+function parseScheduledAt(value) {
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime())) {
+    throw new Error(
+      `Invalid scheduledAt "${value}". Expected an ISO-8601 timestamp.`
+    );
+  }
+  return date;
+}
+function registerRolloutsCommands(program2, globalOpts) {
+  const rollouts = program2.command("rollouts").description("Manage bulk scheduled publishing rollouts");
+  rollouts.command("list").description("List rollouts").option("--status <status>", "Filter by status").option("--limit <n>", "Maximum results (default: 50)").option("--offset <n>", "Pagination offset").action(
+    withErrorHandler(globalOpts, async (cmdOpts) => {
+      const opts = globalOpts();
+      const client = await createPlatformClient(opts);
+      const { batches } = await client.publishBatches.listPublishBatches({
+        status: cmdOpts.status,
+        limit: cmdOpts.limit ? parseInt(String(cmdOpts.limit), 10) : void 0,
+        offset: cmdOpts.offset ? parseInt(String(cmdOpts.offset), 10) : void 0
+      });
+      formatListProto(PublishBatchSchema, batches, opts, {
+        columns: [
+          { key: "id", header: "ID", width: 28 },
+          { key: "name", header: "Name", width: 28 },
+          { key: "status", header: "Status", width: 12 },
+          { key: "itemCount", header: "Items", width: 6 },
+          { key: "completedCount", header: "Done", width: 6 },
+          { key: "failedCount", header: "Failed", width: 7 },
+          { key: "scheduledAt", header: "Scheduled", width: 24 }
+        ]
+      });
+    })
+  );
+  rollouts.command("get <id>").description("Get a rollout (with its items)").action(
+    withErrorHandler(globalOpts, async (id) => {
+      const opts = globalOpts();
+      const client = await createPlatformClient(opts);
+      const { batch, items } = await client.publishBatches.getPublishBatch(id);
+      if (!batch) throw new Error(`Rollout not found: ${id}`);
+      if (opts.json || opts.jsonl) {
+        formatOutput({ rollout: batch, items }, opts);
+        return;
+      }
+      formatOutputProto(PublishBatchSchema, batch, opts);
+      if (items.length > 0) {
+        console.log();
+        console.log(chalk14.bold(`Items (${items.length}):`));
+        for (const it of items) {
+          console.log(
+            `  ${chalk14.cyan(it.id)}  ${chalk14.dim(it.targetKind)}  ${chalk14.gray(it.status ?? "")}`
+          );
+        }
+      }
+    })
+  );
+  rollouts.command("create").description("Create a rollout").option("-d, --data <json>", "Rollout definition as JSON string").option("--file <path>", "Rollout definition from JSON file").action(
+    withErrorHandler(globalOpts, async (cmdOpts) => {
+      const opts = globalOpts();
+      const input = await parseInputData({
+        data: cmdOpts.data,
+        file: cmdOpts.file
+      });
+      if (!input?.name) {
+        throw new Error("Rollout input missing required field: name");
+      }
+      if (!input.scheduledAt) {
+        throw new Error("Rollout input missing required field: scheduledAt");
+      }
+      const scheduledAt = parseScheduledAt(input.scheduledAt);
+      const client = await createPlatformClient(opts);
+      const batch = await client.publishBatches.createPublishBatch({
+        name: input.name,
+        description: input.description,
+        scheduledAt,
+        versionIds: input.versionIds,
+        modelIds: input.modelIds,
+        operationIds: input.operationIds,
+        contextDimensionIds: input.contextDimensionIds,
+        authProviderIds: input.authProviderIds,
+        includeProfileSchema: input.includeProfileSchema
+      });
+      if (opts.json || opts.jsonl) {
+        formatOutputProto(PublishBatchSchema, batch, opts);
+      } else {
+        success(`Created rollout ${batch?.name} (${batch?.id})`);
+      }
+    })
+  );
+  rollouts.command("update <id>").description("Update a rollout (name, description, scheduledAt)").option("-d, --data <json>", "Patch fields as JSON string").option("--file <path>", "Patch fields from JSON file").action(
+    withErrorHandler(
+      globalOpts,
+      async (id, cmdOpts) => {
+        const opts = globalOpts();
+        const patch = await parseInputData({
+          data: cmdOpts.data,
+          file: cmdOpts.file
+        });
+        const client = await createPlatformClient(opts);
+        const batch = await client.publishBatches.updatePublishBatch({
+          id,
+          name: patch.name,
+          description: patch.description,
+          scheduledAt: patch.scheduledAt ? parseScheduledAt(patch.scheduledAt) : void 0
+        });
+        if (opts.json || opts.jsonl) {
+          formatOutputProto(PublishBatchSchema, batch, opts);
+        } else {
+          success(`Updated rollout ${batch?.name} (${batch?.id})`);
+        }
+      }
+    )
+  );
+  rollouts.command("delete <id>").description("Delete a rollout before it runs").option("--confirm", "Skip confirmation prompt").action(
+    withErrorHandler(
+      globalOpts,
+      async (id, cmdOpts) => {
+        const opts = globalOpts();
+        const confirmed = await confirmAction(
+          `Delete rollout ${id}? This cannot be undone.`,
+          { confirm: !!cmdOpts.confirm }
+        );
+        if (!confirmed) {
+          console.log("Aborted.");
+          return;
+        }
+        const client = await createPlatformClient(opts);
+        const ok = await client.publishBatches.deletePublishBatch(id);
+        if (opts.json || opts.jsonl) {
+          formatOutput({ deleted: ok, id }, opts);
+        } else {
+          success(`Deleted rollout ${id}`);
+        }
+      }
+    )
+  );
+  rollouts.command("trigger <id>").description("Trigger a rollout immediately (ignore its scheduled time)").action(
+    withErrorHandler(globalOpts, async (id) => {
+      const opts = globalOpts();
+      const client = await createPlatformClient(opts);
+      const batch = await client.publishBatches.triggerPublishBatch(id);
+      if (opts.json || opts.jsonl) {
+        formatOutputProto(PublishBatchSchema, batch, opts);
+      } else {
+        success(`Triggered rollout ${batch?.name} (${batch?.id})`);
+      }
+    })
+  );
+  rollouts.command("pause <id>").description("Pause an in-flight rollout").action(
+    withErrorHandler(globalOpts, async (id) => {
+      const opts = globalOpts();
+      const client = await createPlatformClient(opts);
+      const batch = await client.publishBatches.pausePublishBatch(id);
+      if (opts.json || opts.jsonl) {
+        formatOutputProto(PublishBatchSchema, batch, opts);
+      } else {
+        success(`Paused rollout ${batch?.id}`);
+      }
+    })
+  );
+  rollouts.command("resume <id>").description("Resume a paused rollout").action(
+    withErrorHandler(globalOpts, async (id) => {
+      const opts = globalOpts();
+      const client = await createPlatformClient(opts);
+      const batch = await client.publishBatches.resumePublishBatch(id);
+      if (opts.json || opts.jsonl) {
+        formatOutputProto(PublishBatchSchema, batch, opts);
+      } else {
+        success(`Resumed rollout ${batch?.id}`);
+      }
+    })
+  );
+  rollouts.command("retry <id>").description("Retry failed items in a rollout").action(
+    withErrorHandler(globalOpts, async (id) => {
+      const opts = globalOpts();
+      const client = await createPlatformClient(opts);
+      const batch = await client.publishBatches.retryFailedItems(id);
+      if (opts.json || opts.jsonl) {
+        formatOutputProto(PublishBatchSchema, batch, opts);
+      } else {
+        success(`Re-queued failed items for rollout ${batch?.id}`);
+      }
+    })
+  );
+  rollouts.command("rollback <id>").description(
+    "Roll back a completed rollout (use --preview to dry-run first)"
+  ).option("--preview", "Preview the rollback without executing").option("--confirm", "Skip confirmation prompt").action(
+    withErrorHandler(
+      globalOpts,
+      async (id, cmdOpts) => {
+        const opts = globalOpts();
+        const client = await createPlatformClient(opts);
+        if (cmdOpts.preview) {
+          const preview = await client.publishBatches.previewRollback(id);
+          formatOutput(preview, opts);
+          return;
+        }
+        const confirmed = await confirmAction(
+          `Roll back rollout ${id}? This creates a new inverse rollout that reverts published changes.`,
+          { confirm: !!cmdOpts.confirm }
+        );
+        if (!confirmed) {
+          console.log("Aborted.");
+          return;
+        }
+        const rollback = await client.publishBatches.rollbackPublishBatch(id);
+        if (opts.json || opts.jsonl) {
+          formatOutputProto(PublishBatchSchema, rollback, opts);
+        } else {
+          success(
+            `Rollback rollout ${rollback?.id} created for ${id}`
+          );
+        }
+      }
+    )
+  );
+  rollouts.command("add-items <id>").description("Add items (records / models / operations / etc.) to a rollout").option("-d, --data <json>", "Items as JSON string").option("--file <path>", "Items from JSON file").action(
+    withErrorHandler(
+      globalOpts,
+      async (id, cmdOpts) => {
+        const opts = globalOpts();
+        const items = await parseInputData({
+          data: cmdOpts.data,
+          file: cmdOpts.file
+        });
+        const client = await createPlatformClient(opts);
+        const batch = await client.publishBatches.addItems({
+          batchId: id,
+          versionIds: items.versionIds,
+          modelIds: items.modelIds,
+          operationIds: items.operationIds,
+          contextDimensionIds: items.contextDimensionIds,
+          authProviderIds: items.authProviderIds,
+          includeProfileSchema: items.includeProfileSchema
+        });
+        if (opts.json || opts.jsonl) {
+          formatOutputProto(PublishBatchSchema, batch, opts);
+        } else {
+          success(`Added items to rollout ${batch?.id}`);
+        }
+      }
+    )
+  );
+  rollouts.command("remove-items <id>").description("Remove items from a rollout").option("-d, --data <json>", "Items to remove as JSON string").option("--file <path>", "Items to remove from JSON file").action(
+    withErrorHandler(
+      globalOpts,
+      async (id, cmdOpts) => {
+        const opts = globalOpts();
+        const items = await parseInputData({
+          data: cmdOpts.data,
+          file: cmdOpts.file
+        });
+        const client = await createPlatformClient(opts);
+        const batch = await client.publishBatches.removeItems({
+          batchId: id,
+          versionIds: items.versionIds,
+          modelIds: items.modelIds,
+          operationIds: items.operationIds,
+          contextDimensionIds: items.contextDimensionIds,
+          authProviderIds: items.authProviderIds,
+          excludeProfileSchema: items.excludeProfileSchema
+        });
+        if (opts.json || opts.jsonl) {
+          formatOutputProto(PublishBatchSchema, batch, opts);
+        } else {
+          success(`Removed items from rollout ${batch?.id}`);
+        }
+      }
+    )
+  );
+}
+
 // src/commands/locales.ts
 import { LocaleSchema } from "@eide/foir-proto-ts/settings/v1/settings_pb";
 function registerLocalesCommands(program2, globalOpts) {
@@ -7893,7 +8747,7 @@ function registerSettingsCommands(program2, globalOpts) {
 // src/commands/design-tokens.ts
 import { existsSync as existsSync6, readFileSync as readFileSync2 } from "fs";
 import { resolve as resolve6 } from "path";
-import chalk12 from "chalk";
+import chalk15 from "chalk";
 function registerDesignTokensCommands(program2, globalOpts) {
   const tokens = program2.command("design-tokens").description("Manage project design tokens (W3C-formatted)");
   tokens.command("get").description("Print the current design tokens document").option("--channel <channel>", "draft | published", "draft").option(
@@ -7941,7 +8795,7 @@ function registerDesignTokensCommands(program2, globalOpts) {
           const resp = await client.settings.publishDesignTokens();
           success("Design tokens published");
           if (resp.breakingChanges && resp.breakingChanges.length > 0) {
-            console.log(chalk12.yellow("\nBreaking changes:"));
+            console.log(chalk15.yellow("\nBreaking changes:"));
             for (const c of resp.breakingChanges) {
               console.log(`  ${c.severity} ${c.path}: ${c.description}`);
             }
@@ -7957,7 +8811,7 @@ function registerDesignTokensCommands(program2, globalOpts) {
       const resp = await client.settings.publishDesignTokens();
       success("Design tokens published");
       if (resp.breakingChanges && resp.breakingChanges.length > 0) {
-        console.log(chalk12.yellow("\nBreaking changes:"));
+        console.log(chalk15.yellow("\nBreaking changes:"));
         for (const c of resp.breakingChanges) {
           console.log(`  ${c.severity} ${c.path}: ${c.description}`);
         }
@@ -7982,12 +8836,12 @@ function registerDesignTokensCommands(program2, globalOpts) {
         return;
       }
       if (status.hasPendingChanges) {
-        console.log(chalk12.yellow("\u25CF Pending changes"));
+        console.log(chalk15.yellow("\u25CF Pending changes"));
       } else {
-        console.log(chalk12.green("\u25CF Up to date"));
+        console.log(chalk15.green("\u25CF Up to date"));
       }
       if (status.breakingChanges && status.breakingChanges.length > 0) {
-        console.log(chalk12.yellow("\nPending changes:"));
+        console.log(chalk15.yellow("\nPending changes:"));
         for (const c of status.breakingChanges) {
           console.log(`  ${c.severity} ${c.path}: ${c.description}`);
         }
@@ -9159,7 +10013,11 @@ registerOperationsCommands(program, getGlobalOpts);
 registerSegmentsCommands(program, getGlobalOpts);
 registerSchedulesCommands(program, getGlobalOpts);
 registerApiKeysCommands(program, getGlobalOpts);
+registerAuthCommands(program, getGlobalOpts);
 registerAuthProvidersCommands(program, getGlobalOpts);
+registerEmbeddingsCommands(program, getGlobalOpts);
+registerHooksCommands(program, getGlobalOpts);
+registerRolloutsCommands(program, getGlobalOpts);
 registerLocalesCommands(program, getGlobalOpts);
 registerSettingsCommands(program, getGlobalOpts);
 registerDesignTokensCommands(program, getGlobalOpts);

package/dist/lib/config-helpers.d.ts

@@ -385,7 +385,7 @@ interface ApplyConfigInput {
     /**
      * W3C-formatted design tokens document for this project. Reconciled by
      * `foir push` — the document is applied verbatim to the draft channel.
-     * Add `--publish-tokens` to promote draft → published in the same push.
+     * Add `--publish` to promote draft → published in the same push.
      */
     designTokens?: ApplyConfigDesignTokensInput;
     [key: string]: unknown;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eide/foir-cli",
-  "version": "0.22.0",
+  "version": "0.24.0",
   "description": "Universal platform CLI for Foir platform",
   "type": "module",
   "publishConfig": {