@kora-platform/cli 0.7.0-rc1 → 0.8.0-rc1

package/dist/commands.js

@@ -1,19 +1,17 @@
-import { mkdir, writeFile } from "node:fs/promises";
-import { dirname, resolve } from "node:path";
 import { renderCompletionScript, resolveCompletionCandidates } from "./completion.js";
-import { executeAuthLogin, executeAuthLogout, executeAuthWhoami } from "./auth-commands.js";
+import { executeAuthLogin, executeAuthLogout, executeAuthSignup, executeAuthWhoami } from "./auth-commands.js";
 import { getCliSchema, listCliSchemas } from "./schema-registry.js";
 import { createPlatformApiClient } from "./api-client.js";
 import { authProblem, genericProblem, notFoundProblem, usageProblem } from "./cli-errors.js";
 import { readOptionalNumberFlag, readOptionalStringFlag, readRequiredStringFlag } from "./command-flags.js";
-import { executeArtifactDownload, executeArtifactList, executeArtifactRead, executeArtifactUpload } from "./artifact-commands.js";
-import { readImportEntries, readJsonInputSpecifier, readTextInputSpecifier, parseEnvFile } from "./files.js";
+import { executeArtifactDownload, executeArtifactArchive, executeArtifactInspect, executeArtifactInventory, executeArtifactList, executeArtifactPurge, executeArtifactRead, executeArtifactRestore, executeArtifactUpload } from "./artifact-commands.js";
+import { executeAudit } from "./audit-commands.js";
+import { isZipArchivePath, readArchiveBytes, readImportEntries, readJsonInputSpecifier, readWorkspaceTestEntries, readTextInputSpecifier, parseEnvFile, writeReleaseSourceFiles } from "./files.js";
 import { renderDiffSummary, renderKeyValue, renderPrettyJson, renderSuccess, renderTable } from "./format.js";
 import { buildTaskDetailPresentation } from "./task-detail.js";
 import { confirmDestructive } from "./interaction.js";
-import { executeIntegrations } from "./integration-commands.js";
-import { openBrowser, shouldAutoOpenBrowser } from "./browser.js";
-import { isInteractive } from "./prompts.js";
+import { executeExtensions } from "./extension-commands.js";
+import { readCliEnvironmentFlag, readRequiredCliEnvironmentFlag, resolveCliEnvironment } from "./environment-context.js";
 export async function executeParsedCommand(parsed, context) {
     const api = createPlatformApiClient({
         sessionStore: context.sessionStore
@@ -21,6 +19,8 @@ export async function executeParsedCommand(parsed, context) {
     switch (parsed.definition.id) {
         case "auth.login":
             return executeAuthLogin(parsed, context, api);
+        case "auth.signup":
+            return executeAuthSignup(parsed, context, api);
         case "auth.logout":
             return executeAuthLogout(context, api);
         case "auth.whoami":
@@ -41,10 +41,6 @@ export async function executeParsedCommand(parsed, context) {
             return executeOrgSelect(parsed, context, api);
         case "org.settings.get":
             return executeOrgSettingsGet(parsed, context, api);
-        case "org.import":
-            return executeOrgImport(parsed, context, api);
-        case "org.bundle.show":
-            return executeOrgBundleShow(parsed, context, api);
         case "org.reset":
             return executeOrgReset(parsed, context, api);
         case "status":
@@ -65,24 +61,29 @@ export async function executeParsedCommand(parsed, context) {
             return executeWorkflowContext(parsed, context, api);
         case "workflow.start":
             return executeWorkflowStart(parsed, context, api);
+        case "test.node":
+            return executeWorkflowNodeTest(parsed, context, api);
         case "release.list":
             return executeReleaseList(parsed, context, api);
         case "release.get":
             return executeReleaseGet(parsed, context, api);
-        case "release.changes":
-            return executeReleaseChanges(parsed, context, api);
-        case "release.deployment.get":
-            return executeReleaseDeploymentGet(parsed, context, api);
-        case "release.publish":
-            return executeReleasePublish(parsed, context, api);
-        case "release.retry":
-            return executeReleaseRetry(parsed, context, api);
-        case "release.discard":
-            return executeReleaseDiscard(parsed, context, api);
-        case "release.restore":
-            return executeReleaseRestore(parsed, context, api);
-        case "release.deactivate":
-            return executeReleaseDeactivate(parsed, context, api);
+        case "release.create":
+            return executeReleaseCreate(parsed, context, api);
+        case "release.validate":
+            return executeReleaseValidate(parsed, context, api);
+        case "release.source":
+            return executeReleaseSource(parsed, context, api);
+        case "environment.list":
+        case "environment.get":
+        case "environment.create":
+        case "environment.rename":
+        case "environment.archive":
+        case "environment.deploy":
+        case "environment.undeploy":
+            return executeEnvironment(parsed, context, api);
+        case "deployment.list":
+        case "deployment.get":
+            return executeDeployment(parsed, context, api);
         case "run.list":
             return executeRunList(parsed, context, api);
         case "run.get":
@@ -93,14 +94,27 @@ export async function executeParsedCommand(parsed, context) {
             return executeRunSteps(parsed, context, api);
         case "run.abort":
             return executeRunAbort(parsed, context, api);
+        case "audit.list":
+        case "audit.get":
+            return executeAudit(parsed, context, api, resolveOrgScope);
         case "artifact.upload":
             return executeArtifactUpload(parsed, context, api, resolveOrgScope);
         case "artifact.list":
             return executeArtifactList(parsed, context, api, resolveOrgScope);
+        case "artifact.inventory":
+            return executeArtifactInventory(parsed, context, api, resolveOrgScope);
+        case "artifact.inspect":
+            return executeArtifactInspect(parsed, context, api, resolveOrgScope);
         case "artifact.download":
             return executeArtifactDownload(parsed, context, api, resolveOrgScope);
         case "artifact.read":
             return executeArtifactRead(parsed, context, api, resolveOrgScope);
+        case "artifact.archive":
+            return executeArtifactArchive(parsed, context, api, resolveOrgScope);
+        case "artifact.restore":
+            return executeArtifactRestore(parsed, context, api, resolveOrgScope);
+        case "artifact.purge":
+            return executeArtifactPurge(parsed, context, api, resolveOrgScope);
         case "task.list":
             return executeTaskList(parsed, context, api);
         case "task.get":
@@ -119,10 +133,6 @@ export async function executeParsedCommand(parsed, context) {
         case "org-model.capabilities.get":
         case "org-model.operations.list":
         case "org-model.operations.get":
-        case "org-model.connectors.list":
-        case "org-model.connectors.get":
-        case "org-model.mcp-servers.list":
-        case "org-model.mcp-servers.get":
             return executeOrgModel(parsed, context, api);
         case "access.members.list":
         case "access.members.get":
@@ -137,32 +147,21 @@ export async function executeParsedCommand(parsed, context) {
         case "access.api-keys.create":
         case "access.api-keys.revoke":
             return executeAccess(parsed, context, api);
-        case "integrations.list":
-        case "integrations.diagnostics":
-        case "integrations.get":
-        case "integrations.connections":
-        case "integrations.actions":
-        case "integrations.action":
-            return executeIntegrations(parsed, context, api, resolveOrgScope);
-        case "mcp.list":
-        case "mcp.get":
-        case "mcp.create":
-        case "mcp.update":
-        case "mcp.delete":
-        case "mcp.test":
-        case "mcp.discover-tools":
-        case "mcp.connect":
-        case "mcp.oauth-status":
-        case "mcp.disconnect":
-            return executeMcp(parsed, context, api);
-        case "skills.list":
-        case "skills.get":
-        case "skills.create":
-        case "skills.upload":
-        case "skills.download":
-        case "skills.update":
-        case "skills.delete":
-            return executeSkills(parsed, context, api);
+        case "extensions.export":
+        case "extensions.validate":
+        case "extensions.publish":
+        case "extensions.install":
+        case "extensions.grant":
+        case "extensions.update":
+        case "extensions.built-ins.list":
+        case "extensions.built-ins.install":
+        case "extensions.list":
+        case "extensions.inspect":
+        case "extensions.detail":
+        case "extensions.disable":
+        case "extensions.enable":
+        case "extensions.delete":
+            return executeExtensions(parsed, context, api, resolveOrgScope);
         case "env.list":
         case "env.get":
         case "env.replace":
@@ -176,12 +175,6 @@ export async function executeParsedCommand(parsed, context) {
         case "chat.sessions.list":
         case "chat.sessions.get":
         case "chat.sessions.delete":
-        case "chat.changes":
-        case "chat.validation":
-        case "chat.draft.get":
-        case "chat.draft.apply":
-        case "chat.draft.refresh":
-        case "chat.workspace-state":
             return executeChat(parsed, context, api);
         case "completion.bash":
         case "completion.zsh":
@@ -191,6 +184,10 @@ export async function executeParsedCommand(parsed, context) {
             return executeSchemaList();
         case "schema.get":
             return executeSchemaGet(parsed);
+        case "admin.usage.summary":
+        case "admin.usage.workflows":
+        case "admin.usage.tools":
+        case "admin.usage.events":
         case "admin.org.deleted.list":
         case "admin.org.deleted.get":
         case "admin.org.deleted.restore":
@@ -360,35 +357,13 @@ async function executeOrgSettingsGet(parsed, context, api) {
         meta: { command: "org settings get", orgId: org.id }
     };
 }
-async function executeOrgImport(parsed, context, api) {
-    const { org, session } = await resolveOrgScope(parsed, context, api);
-    const files = await readImportEntries(readRequiredArg(parsed, "path"));
-    const data = await api.importProject(session, org.id, { files });
-    return {
-        data,
-        human: renderSuccess(`Imported ${files.length} files into ${org.slug}.`),
-        kind: "authoring_import_apply",
-        meta: { command: "org import", orgId: org.id }
-    };
-}
-async function executeOrgBundleShow(parsed, context, api) {
-    const { org, session } = await resolveOrgScope(parsed, context, api);
-    const releaseId = readOptionalStringFlag(parsed, "release");
-    const data = await api.getProjectWorkspace(session, org.id, releaseId);
-    return {
-        data,
-        human: renderPrettyJson(data.project),
-        kind: "authoring_bundle_show",
-        meta: { command: "org bundle show", orgId: org.id }
-    };
-}
 async function executeOrgReset(parsed, context, api) {
     const { org, session } = await resolveOrgScope(parsed, context, api);
-    await confirmDestructive(parsed, context, `Reset the draft project for ${org.slug}?`);
+    await confirmDestructive(parsed, context, `Reset release, runtime, project, and chat state for ${org.slug}?`);
     await api.resetOrganizationProject(session, org.id);
     return {
         data: { reset: true },
-        human: renderSuccess(`Reset the draft project for ${org.slug}.`),
+        human: renderSuccess(`Reset project state for ${org.slug}.`),
         kind: "authoring_project_reset",
         meta: { command: "org reset", orgId: org.id }
     };
@@ -399,8 +374,6 @@ async function executeStatus(parsed, context, api) {
     return {
         data,
         human: renderKeyValue([
-            { label: "Draft changes", value: data.overview.draftChangeCount },
-            { label: "Draft has changes", value: data.overview.draftHasChanges },
             { label: "Pending tasks", value: data.overview.pendingTaskCount },
             { label: "Runs in flight", value: data.overview.runsInFlight },
             { label: "Workflow count", value: data.overview.workflowCount }
@@ -411,12 +384,14 @@ async function executeStatus(parsed, context, api) {
 }
 async function executeActivityList(parsed, context, api) {
     const { org, session } = await resolveOrgScope(parsed, context, api);
+    const { environment } = resolveCliEnvironment(parsed, session);
     const focusType = readOptionalStringFlag(parsed, "focus-type");
     const focusValue = readOptionalStringFlag(parsed, "focus-value");
     if ((focusType && !focusValue) || (!focusType && focusValue)) {
         throw usageProblem("Use --focus-type and --focus-value together.", "activity list");
     }
     const data = await api.getActivity(session, org.id, {
+        environment,
         ...(focusType ? { focusType: focusType } : {}),
         ...(focusValue ? { focusValue } : {}),
         ...optionalNumberValue("limit", readOptionalNumberFlag(parsed, "limit")),
@@ -429,11 +404,12 @@ async function executeActivityList(parsed, context, api) {
             { key: "occurredAt", label: "Occurred" },
             { key: "kind", label: "Kind" },
             { key: "status", label: "Status" },
+            { key: "environmentKey", label: "Environment" },
             { key: "processName", label: "Workflow" },
             { key: "summary", label: "Summary" }
         ]),
         kind: "runtime_activity_list",
-        meta: { command: "activity list", orgId: org.id }
+        meta: { command: "activity list", environment, orgId: org.id }
     };
 }
 async function executeActivityOptions(parsed, context, api) {
@@ -454,7 +430,7 @@ async function executeWorkflowList(parsed, context, api) {
         human: renderTable(data.processes, [
             { key: "name", label: "Name" },
             { key: "latestVersion", label: "Latest" },
-            { key: "liveVersion", label: "Live" }
+            { key: "deployedVersion", label: "Deployed" }
         ]),
         kind: "authoring_workflow_list",
         meta: { command: "workflow list", orgId: org.id }
@@ -511,7 +487,10 @@ async function executeWorkflowStart(parsed, context, api) {
         ? await readJsonInputSpecifier(inputSpecifier, context.stdin, "workflow start")
         : undefined;
     const workflowName = readRequiredArg(parsed, "name");
+    const resolvedEnvironment = resolveCliEnvironment(parsed, session);
+    announceResolvedEnvironment(parsed, context, resolvedEnvironment.environment);
     const data = await api.startWorkflow(session, org.id, workflowName, {
+        environment: resolvedEnvironment.environment,
         ...(inputData ? { inputData } : {}),
         startEvent: {
             ...(readOptionalStringFlag(parsed, "start-event-name")
@@ -522,24 +501,69 @@ async function executeWorkflowStart(parsed, context, api) {
     });
     return {
         data,
-        human: renderSuccess(`Started workflow ${workflowName} as ${data.started.workflowId}.`),
+        human: renderSuccess(`Started workflow ${workflowName} in ${data.started.environmentKey ?? resolvedEnvironment.environment} as ${data.started.workflowId}.`),
         kind: "runtime_workflow_start",
-        meta: { command: "workflow start", orgId: org.id }
+        meta: { command: "workflow start", environment: data.started.environmentKey ?? resolvedEnvironment.environment, orgId: org.id }
     };
 }
-async function executeReleaseList(parsed, context, api) {
+async function executeWorkflowNodeTest(parsed, context, api) {
     const { org, session } = await resolveOrgScope(parsed, context, api);
-    const data = await api.listReleases(session, org.id, {
-        ...(parsed.flags["include-draft"] === true ? { includeDraft: true } : {}),
-        ...optionalNumberValue("limit", readOptionalNumberFlag(parsed, "limit"))
+    const workflowName = readRequiredArg(parsed, "workflow-name");
+    const nodeId = readRequiredArg(parsed, "node-id");
+    const workspacePath = readOptionalStringFlag(parsed, "workspace") ?? context.cwd;
+    const environment = readOptionalStringFlag(parsed, "environment");
+    const inputSpecifier = readOptionalStringFlag(parsed, "input");
+    const inputData = inputSpecifier
+        ? await readJsonInputSpecifier(inputSpecifier, context.stdin, "test node")
+        : undefined;
+    const data = await api.testWorkflowNode(session, org.id, workflowName, nodeId, {
+        ...(environment ? { environment } : {}),
+        files: await readWorkspaceTestEntries(workspacePath),
+        ...(inputData ? { input: inputData } : {})
     });
+    const test = data.test;
     return {
         data,
-        human: renderTable(data.releases, [
+        exitCode: test.status === "passed" ? 0 : 1,
+        human: renderWorkflowNodeTestHuman(test),
+        kind: "workflow_node_test",
+        meta: withCliSummary({
+            command: "test node",
+            nodeId,
+            orgId: org.id,
+            workflowName
+        }, summarizeWorkflowNodeTest(test))
+    };
+}
+async function executeReleaseList(parsed, context, api) {
+    const { org, session } = await resolveOrgScope(parsed, context, api);
+    const [data, deploymentData] = await Promise.all([
+        api.listReleases(session, org.id, {
+            ...optionalNumberValue("limit", readOptionalNumberFlag(parsed, "limit"))
+        }),
+        api.listEnvironmentDeployments(session, org.id, { limit: 100 })
+    ]);
+    return {
+        data: { ...data, deployments: deploymentData.deployments },
+        human: renderTable(data.releases.map((release) => {
+            const deploymentsForRelease = deploymentData.deployments.filter((deployment) => deployment.releaseId === release.id);
+            const latestDeployment = deploymentsForRelease[0] ?? null;
+            return {
+                createdAt: release.createdAt,
+                id: release.id,
+                state: typeof release.state === "string" ? release.state : "",
+                latestDeployment: latestDeployment ? `${latestDeployment.environmentKey}:${latestDeployment.status}` : "",
+                liveEnvironments: deploymentsForRelease
+                    .filter((deployment) => deployment.isLive)
+                    .map((deployment) => deployment.environmentKey)
+                    .join(", ")
+            };
+        }), [
             { key: "id", label: "Release" },
-            { key: "effectiveState", label: "State" },
-            { key: "deploymentId", label: "Deployment" },
-            { key: "publishedAt", label: "Published" }
+            { key: "state", label: "Artifact state" },
+            { key: "liveEnvironments", label: "Live environments" },
+            { key: "latestDeployment", label: "Latest deployment" },
+            { key: "createdAt", label: "Created" }
         ]),
         kind: "releases_release_list",
         meta: { command: "release list", orgId: org.id }
@@ -555,88 +579,269 @@ async function executeReleaseGet(parsed, context, api) {
         meta: { command: "release get", orgId: org.id }
     };
 }
-async function executeReleaseChanges(parsed, context, api) {
+async function executeReleaseValidate(parsed, context, api) {
     const { org, session } = await resolveOrgScope(parsed, context, api);
-    const data = await api.getDraftChanges(session, org.id);
-    return {
-        data,
-        human: renderTable(data.changes, [
-            { key: "changedAt", label: "Changed" },
-            { key: "action", label: "Action" },
-            { key: "entityType", label: "Entity" },
-            { key: "entityKey", label: "Key" }
-        ]),
-        kind: "releases_release_changes",
-        meta: { command: "release changes", orgId: org.id }
-    };
-}
-async function executeReleaseDeploymentGet(parsed, context, api) {
-    const { org, session } = await resolveOrgScope(parsed, context, api);
-    const data = await api.getDeployment(session, org.id, readRequiredArg(parsed, "deployment-id"));
+    const releaseId = readRequiredArg(parsed, "release-id");
+    const environment = readOptionalStringFlag(parsed, "environment");
+    const data = await api.validateRelease(session, org.id, {
+        ...(environment ? { environment } : {}),
+        releaseId
+    });
+    const validation = data.validation;
+    const human = validation.releaseReady
+        ? renderSuccess(`Release ${validation.releaseId} passed release validation${environment ? ` for ${environment}` : ""}.`)
+        : [
+            `Release ${validation.releaseId} did not pass release validation${environment ? ` for ${environment}` : ""}.`,
+            renderTable(validation.diagnostics, [
+                { key: "gate", label: "Gate" },
+                { key: "severity", label: "Severity" },
+                { key: "code", label: "Code" },
+                { key: "path", label: "Path" },
+                { key: "message", label: "Message" }
+            ])
+        ].join("\n");
     return {
         data,
-        human: renderPrettyJson(data.deployment),
-        kind: "runtime_deployment_get",
-        meta: { command: "release deployment get", orgId: org.id }
+        ...(validation.releaseReady ? {} : { exitCode: 1 }),
+        human,
+        kind: "releases_release_validate",
+        meta: withCliSummary({ command: "release validate", ...(environment ? { environment } : {}), orgId: org.id }, summarizeReleaseValidation(validation))
     };
 }
-async function executeReleasePublish(parsed, context, api) {
+async function executeReleaseSource(parsed, context, api) {
     const { org, session } = await resolveOrgScope(parsed, context, api);
-    const data = await api.publishRelease(session, org.id, readOptionalStringFlag(parsed, "reason"));
+    const releaseId = readRequiredArg(parsed, "release-id");
+    const outPath = readRequiredStringFlag(parsed, "out");
+    const data = await api.getReleaseSource(session, org.id, releaseId);
+    const files = [
+        ...data.source.files.map((file) => ({
+            content: file.content,
+            path: file.path
+        })),
+        ...data.source.assets.map((asset) => ({
+            content: asset.content,
+            path: asset.path
+        }))
+    ];
+    await writeReleaseSourceFiles(outPath, {
+        files,
+        metadata: {
+            fileCount: files.length,
+            releaseId,
+            source: "release"
+        }
+    });
+    const summary = `Release ${releaseId} source written to ${outPath}.`;
     return {
-        data,
-        human: renderSuccess(`Published release ${data.published.release.id}.`),
-        kind: "releases_release_publish",
-        meta: { command: "release publish", orgId: org.id }
+        data: {
+            fileCount: files.length,
+            releaseId,
+            out: outPath
+        },
+        human: renderSuccess(summary),
+        kind: "releases_release_source",
+        meta: withCliSummary({ command: "release source", orgId: org.id, releaseId }, summary)
     };
 }
-async function executeReleaseRetry(parsed, context, api) {
+async function executeReleaseCreate(parsed, context, api) {
     const { org, session } = await resolveOrgScope(parsed, context, api);
-    const data = await api.retryReleasePublication(session, org.id, readRequiredArg(parsed, "release-id"));
+    const workspacePath = readRequiredArg(parsed, "workspace");
+    const label = readOptionalStringFlag(parsed, "label");
+    if (isZipArchivePath(workspacePath)) {
+        const data = await api.createReleaseArchive(session, org.id, await readArchiveBytes(workspacePath, "release create"), {
+            ...(label ? { label } : {})
+        });
+        const summary = summarizeReleaseCreation(data.created.release.id);
+        return {
+            data,
+            human: renderSuccess(`${summary} Source: ${workspacePath}.`),
+            kind: "releases_release_create",
+            meta: withCliSummary({ command: "release create", orgId: org.id, releaseId: data.created.release.id }, summary)
+        };
+    }
+    const files = await readImportEntries(workspacePath);
+    const data = await api.createRelease(session, org.id, {
+        files,
+        ...(label ? { label } : {})
+    });
+    const summary = summarizeReleaseCreation(data.created.release.id);
     return {
         data,
-        human: renderSuccess(`Retried release ${parsed.args["release-id"]}.`),
-        kind: "releases_release_retry",
-        meta: { command: "release retry", orgId: org.id }
+        human: renderSuccess(`${summary} Source: ${workspacePath}.`),
+        kind: "releases_release_create",
+        meta: withCliSummary({ command: "release create", orgId: org.id, releaseId: data.created.release.id }, summary)
     };
 }
-async function executeReleaseDiscard(parsed, context, api) {
+async function executeEnvironment(parsed, context, api) {
     const { org, session } = await resolveOrgScope(parsed, context, api);
-    await confirmDestructive(parsed, context, `Discard the draft release for ${org.slug}?`);
-    const data = await api.discardDraft(session, org.id);
-    return {
-        data,
-        human: renderSuccess(`Discarded draft release ${data.draft.id}.`),
-        kind: "releases_release_discard",
-        meta: { command: "release discard", orgId: org.id }
-    };
+    switch (parsed.definition.id) {
+        case "environment.list": {
+            const data = await api.listEnvironments(session, org.id);
+            return {
+                data,
+                human: renderTable(data.environments.map((entry) => ({
+                    currentDeploymentId: entry.environment.currentDeploymentId,
+                    isProductionTarget: entry.environment.isProductionTarget,
+                    key: entry.environment.key,
+                    latestStatus: entry.latestDeployment?.status ?? "",
+                    liveDeploymentId: entry.liveDeployment?.id ?? "",
+                    name: entry.environment.name,
+                    status: entry.environment.status
+                })), [
+                    { key: "key", label: "Environment" },
+                    { key: "name", label: "Name" },
+                    { key: "status", label: "Status" },
+                    { key: "isProductionTarget", label: "Production" },
+                    { key: "liveDeploymentId", label: "Live deployment" },
+                    { key: "latestStatus", label: "Latest" }
+                ]),
+                kind: "environment_list",
+                meta: { command: "environment list", orgId: org.id }
+            };
+        }
+        case "environment.get": {
+            const data = await api.getEnvironment(session, org.id, readRequiredArg(parsed, "environment"));
+            return {
+                data,
+                human: renderPrettyJson(data.environment),
+                kind: "environment_get",
+                meta: { command: "environment get", orgId: org.id }
+            };
+        }
+        case "environment.create": {
+            const key = readRequiredArg(parsed, "environment");
+            const copyFrom = readOptionalStringFlag(parsed, "copy-from");
+            const copyFromEnvironmentId = copyFrom
+                ? await resolveEnvironmentIdForCli(session, org.id, copyFrom, api)
+                : undefined;
+            const data = await api.createEnvironment(session, org.id, {
+                ...(copyFromEnvironmentId ? { copyFromEnvironmentId } : {}),
+                key,
+                ...(readOptionalStringFlag(parsed, "name") ? { name: readOptionalStringFlag(parsed, "name") } : {})
+            });
+            return {
+                data,
+                human: renderSuccess(`Created environment ${data.environment.key}${copyFrom ? ` from ${copyFrom}` : ""}.`),
+                kind: "environment_create",
+                meta: {
+                    command: "environment create",
+                    ...(copyFrom ? { copyFrom } : {}),
+                    environment: data.environment.key,
+                    orgId: org.id
+                }
+            };
+        }
+        case "environment.rename": {
+            const data = await api.renameEnvironment(session, org.id, readRequiredArg(parsed, "environment"), {
+                name: readRequiredArg(parsed, "name")
+            });
+            return {
+                data,
+                human: renderSuccess(`Renamed environment ${data.environment.key}.`),
+                kind: "environment_rename",
+                meta: { command: "environment rename", environment: data.environment.key, orgId: org.id }
+            };
+        }
+        case "environment.archive": {
+            const environment = readRequiredArg(parsed, "environment");
+            await confirmDestructive(parsed, context, `Archive environment ${environment}?`);
+            const data = await api.archiveEnvironment(session, org.id, environment);
+            return {
+                data,
+                human: renderSuccess(`Archived environment ${data.environment.key}.`),
+                kind: "environment_archive",
+                meta: { command: "environment archive", environment: data.environment.key, orgId: org.id }
+            };
+        }
+        case "environment.deploy": {
+            const environment = readRequiredArg(parsed, "environment");
+            const releaseId = readRequiredArg(parsed, "release");
+            const policy = readOptionalStringFlag(parsed, "policy");
+            const data = await api.deployEnvironment(session, org.id, environment, {
+                ...(policy ? { policy } : {}),
+                releaseId
+            });
+            return {
+                data,
+                human: renderSuccess(`Deployed release ${releaseId} to ${environment} as ${data.deployment.id}.`),
+                kind: "environment_deploy",
+                meta: { command: "environment deploy", deploymentId: data.deployment.id, environment, orgId: org.id, releaseId }
+            };
+        }
+        case "environment.undeploy": {
+            const environment = readRequiredArg(parsed, "environment");
+            await confirmDestructive(parsed, context, `Undeploy the live deployment from ${environment}?`);
+            const policy = readOptionalStringFlag(parsed, "policy");
+            const data = await api.undeployEnvironment(session, org.id, environment, {
+                ...(policy ? { policy } : {})
+            });
+            return {
+                data,
+                human: renderSuccess(`Undeployed environment ${environment}.`),
+                kind: "environment_undeploy",
+                meta: { command: "environment undeploy", deploymentId: data.deployment.id, environment, orgId: org.id }
+            };
+        }
+        default:
+            throw genericProblem(`Unhandled environment command ${parsed.definition.id}.`, parsed.definition.id);
+    }
 }
-async function executeReleaseRestore(parsed, context, api) {
+async function executeDeployment(parsed, context, api) {
     const { org, session } = await resolveOrgScope(parsed, context, api);
-    await confirmDestructive(parsed, context, `Restore release ${parsed.args["release-id"]} into draft?`);
-    const data = await api.restoreRelease(session, org.id, readRequiredArg(parsed, "release-id"));
-    return {
-        data,
-        human: renderSuccess(`Restored release ${parsed.args["release-id"]} into draft.`),
-        kind: "releases_release_restore",
-        meta: { command: "release restore", orgId: org.id }
-    };
+    switch (parsed.definition.id) {
+        case "deployment.list": {
+            const { environment } = resolveCliEnvironment(parsed, session);
+            const data = await api.listEnvironmentDeployments(session, org.id, {
+                environment,
+                ...optionalNumberValue("limit", readOptionalNumberFlag(parsed, "limit"))
+            });
+            return {
+                data,
+                human: renderTable(data.deployments.map((deployment) => ({
+                    ...deployment,
+                    live: deployment.isLive ? "yes" : ""
+                })), [
+                    { key: "id", label: "Deployment" },
+                    { key: "environmentKey", label: "Environment" },
+                    { key: "live", label: "Live" },
+                    { key: "releaseId", label: "Release" },
+                    { key: "status", label: "Status" },
+                    { key: "coreDeploymentId", label: "Core deployment" },
+                    { key: "updatedAt", label: "Updated" }
+                ]),
+                kind: "deployment_list",
+                meta: { command: "deployment list", environment, orgId: org.id }
+            };
+        }
+        case "deployment.get": {
+            const environment = readOptionalStringFlag(parsed, "environment");
+            const data = await api.getEnvironmentDeployment(session, org.id, readRequiredArg(parsed, "deployment"), {
+                ...(environment ? { environment } : {})
+            });
+            return {
+                data,
+                human: renderPrettyJson(data.deployment),
+                kind: "deployment_get",
+                meta: { command: "deployment get", deploymentId: data.deployment.id, ...(environment ? { environment } : {}), orgId: org.id }
+            };
+        }
+        default:
+            throw genericProblem(`Unhandled deployment command ${parsed.definition.id}.`, parsed.definition.id);
+    }
 }
-async function executeReleaseDeactivate(parsed, context, api) {
-    const { org, session } = await resolveOrgScope(parsed, context, api);
-    await confirmDestructive(parsed, context, `Deactivate release ${parsed.args["release-id"]}?`);
-    const policy = readOptionalStringFlag(parsed, "policy");
-    const data = await api.deactivateRelease(session, org.id, readRequiredArg(parsed, "release-id"), policy);
-    return {
-        data,
-        human: renderSuccess(`Deactivated release ${parsed.args["release-id"]}.`),
-        kind: "releases_release_deactivate",
-        meta: { command: "release deactivate", orgId: org.id }
-    };
+async function resolveEnvironmentIdForCli(session, orgId, environment, api) {
+    const data = await api.listEnvironments(session, orgId);
+    const match = data.environments.find((entry) => entry.environment.id === environment || entry.environment.key === environment);
+    if (!match) {
+        throw notFoundProblem(`Environment '${environment}' was not found.`, "environment create");
+    }
+    return match.environment.id;
 }
 async function executeRunList(parsed, context, api) {
     const { org, session } = await resolveOrgScope(parsed, context, api);
+    const resolvedEnvironment = resolveCliEnvironment(parsed, session);
     const data = await api.listRuns(session, org.id, {
+        environment: resolvedEnvironment.environment,
         ...optionalNumberValue("limit", readOptionalNumberFlag(parsed, "limit")),
         ...(readOptionalStringFlag(parsed, "status") ? { status: readOptionalStringFlag(parsed, "status") } : {})
     });
@@ -645,11 +850,12 @@ async function executeRunList(parsed, context, api) {
         human: renderTable(data.runs, [
             { key: "workflowId", label: "Workflow ID" },
             { key: "status", label: "Status" },
+            { key: "environmentKey", label: "Environment" },
             { key: "releaseId", label: "Release" },
             { key: "startTime", label: "Started" }
         ]),
         kind: "runtime_run_list",
-        meta: { command: "run list", orgId: org.id }
+        meta: { command: "run list", environment: resolvedEnvironment.environment, orgId: org.id }
     };
 }
 async function executeRunGet(parsed, context, api) {
@@ -764,43 +970,7 @@ async function executeOrgModel(parsed, context, api) {
                 ? renderPrettyJson(record)
                 : renderTable(editor.operations, [
                     { key: "name", label: "Name" },
-                    { key: "connector", label: "Connector" },
-                    { key: "action", label: "Action" }
-                ]),
-            kind: `authoring_${sanitizeKind(section)}_${verb}`,
-            meta: { command: parsed.definition.path.join(" "), orgId: org.id }
-        };
-    }
-    if (section === "connectors") {
-        const editor = (await api.getConnectorsEditor(session, org.id)).editor;
-        const record = verb === "get"
-            ? requireFound(editor.connectors.find((entry) => entry.name === parsed.args.name), `Connector '${parsed.args.name}' was not found.`, parsed.definition.id)
-            : undefined;
-        return {
-            data: verb === "get" ? { connector: record } : { connectors: editor.connectors },
-            human: verb === "get"
-                ? renderPrettyJson(record)
-                : renderTable(editor.connectors, [
-                    { key: "name", label: "Name" },
-                    { key: "type", label: "Type" }
-                ]),
-            kind: `authoring_${sanitizeKind(section)}_${verb}`,
-            meta: { command: parsed.definition.path.join(" "), orgId: org.id }
-        };
-    }
-    if (section === "mcp-servers") {
-        const editor = (await api.getMcpServersEditor(session, org.id)).editor;
-        const record = verb === "get"
-            ? requireFound(editor.servers.find((entry) => entry.name === parsed.args.name), `MCP server '${parsed.args.name}' was not found.`, parsed.definition.id)
-            : undefined;
-        return {
-            data: verb === "get" ? { server: record } : { servers: editor.servers },
-            human: verb === "get"
-                ? renderPrettyJson(record)
-                : renderTable(editor.servers, [
-                    { key: "name", label: "Name" },
-                    { key: "transport", label: "Transport" },
-                    { key: "url", label: "URL" }
+                    { key: "command", label: "Command" }
                 ]),
             kind: `authoring_${sanitizeKind(section)}_${verb}`,
             meta: { command: parsed.definition.path.join(" "), orgId: org.id }
@@ -985,353 +1155,41 @@ async function executeAccess(parsed, context, api) {
             throw genericProblem(`Unhandled access command ${parsed.definition.id}.`, parsed.definition.id);
     }
 }
-async function executeMcp(parsed, context, api) {
-    const { org, session } = await resolveOrgScope(parsed, context, api);
-    switch (parsed.definition.id) {
-        case "mcp.list": {
-            const data = await api.listOrgMcpServers(session, org.id);
-            return {
-                data,
-                human: renderTable(data.servers, [
-                    { key: "slug", label: "Slug" },
-                    { key: "displayName", label: "Name" },
-                    { key: "status", label: "Status" },
-                    { key: "authMode", label: "Auth" },
-                    { key: "url", label: "URL" }
-                ]),
-                kind: "mcp_servers_list",
-                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
-            };
-        }
-        case "mcp.get": {
-            const data = await api.getOrgMcpServer(session, org.id, readRequiredArg(parsed, "server"));
-            return {
-                data,
-                human: renderPrettyJson(data),
-                kind: "mcp_servers_get",
-                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
-            };
-        }
-        case "mcp.create": {
-            const authMode = readOptionalMcpAuthMode(parsed);
-            const timeoutMs = readOptionalNumberFlag(parsed, "timeout-ms");
-            const input = {
-                displayName: readRequiredStringFlag(parsed, "name"),
-                slug: readRequiredStringFlag(parsed, "slug"),
-                url: readRequiredStringFlag(parsed, "url"),
-                ...(authMode !== undefined ? { authMode } : {}),
-                ...(timeoutMs !== undefined ? { timeoutMs } : {})
-            };
-            const data = await api.createOrgMcpServer(session, org.id, input);
-            return {
-                data,
-                human: renderSuccess(`Created MCP server ${data.server.slug}.`),
-                kind: "mcp_servers_create",
-                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
-            };
-        }
-        case "mcp.update": {
-            const authMode = readOptionalMcpAuthMode(parsed);
-            const displayName = readOptionalStringFlag(parsed, "name");
-            const timeoutMs = readOptionalNumberFlag(parsed, "timeout-ms");
-            const url = readOptionalStringFlag(parsed, "url");
-            const disable = parsed.flags.disable === true;
-            const enable = parsed.flags.enable === true;
-            if (disable && enable) {
-                throw usageProblem("Use either --disable or --enable, not both.", parsed.definition.id);
-            }
-            const input = {
-                ...(displayName !== undefined ? { displayName } : {}),
-                ...(url !== undefined ? { url } : {}),
-                ...(authMode !== undefined ? { authMode } : {}),
-                ...(disable || enable ? { disabled: disable } : {}),
-                ...(timeoutMs !== undefined ? { timeoutMs } : {})
-            };
-            if (Object.keys(input).length === 0) {
-                throw usageProblem("Provide at least one MCP server field to update.", parsed.definition.id);
-            }
-            const data = await api.updateOrgMcpServer(session, org.id, readRequiredArg(parsed, "server"), input);
-            return {
-                data,
-                human: renderSuccess(`Updated MCP server ${data.server.slug}.`),
-                kind: "mcp_servers_update",
-                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
-            };
-        }
-        case "mcp.delete": {
-            const serverRef = readRequiredArg(parsed, "server");
-            await confirmDestructive(parsed, context, `Delete MCP server ${serverRef}?`);
-            await api.deleteOrgMcpServer(session, org.id, serverRef);
-            return {
-                data: {},
-                human: renderSuccess(`Deleted MCP server ${serverRef}.`),
-                kind: "mcp_servers_delete",
-                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
-            };
-        }
-        case "mcp.test": {
-            const data = await api.testOrgMcpServer(session, org.id, readRequiredArg(parsed, "server"));
-            if (!data.ok) {
-                throw genericProblem(data.server.lastErrorMessage ?? `MCP server ${data.server.slug} test failed.`, parsed.definition.id);
-            }
-            return {
-                data,
-                human: renderSuccess(`MCP server ${data.server.slug} is reachable.`),
-                kind: "mcp_servers_test",
-                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
-            };
-        }
-        case "mcp.discover-tools": {
-            const data = await api.discoverOrgMcpServerTools(session, org.id, readRequiredArg(parsed, "server"));
-            return {
-                data,
-                human: data.tools.length === 0
-                    ? renderSuccess(`Discovered no tools for ${data.server.slug}.`)
-                    : renderTable(data.tools, [
-                        { key: "toolName", label: "Tool" },
-                        { key: "description", label: "Description" },
-                        { key: "schemaSha256", label: "Schema" }
-                    ]),
-                kind: "mcp_servers_discover_tools",
-                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
-            };
-        }
-        case "mcp.connect": {
-            const serverRef = readRequiredArg(parsed, "server");
-            const data = await api.connectOrgMcpServerOAuth(session, org.id, serverRef);
-            const explicitOpen = parsed.flags.open === true;
-            const shouldOpen = shouldAutoOpenBrowser({
-                env: context.env,
-                explicitNoOpen: parsed.flags["no-open"] === true,
-                explicitOpen,
-                interactive: isInteractive(context),
-                openBrowserConfig: context.config.openBrowser
-            });
-            let opened = false;
-            if (shouldOpen) {
-                opened = await openBrowser(data.authorizationUrl);
-                if (explicitOpen && !opened) {
-                    throw genericProblem(`Could not open a browser automatically. Visit ${data.authorizationUrl}`, parsed.definition.id);
-                }
-            }
-            const finalSession = parsed.flags.wait === true
-                ? await pollMcpOAuthSession(api, session, org.id, serverRef, data.sessionId)
-                : null;
-            if (finalSession && isFailedMcpOAuthSession(finalSession.session.status)) {
-                throw genericProblem(finalSession.session.errorMessage
-                    ?? `MCP OAuth connection ${finalSession.session.status}.`, parsed.definition.id);
-            }
-            return {
-                data: finalSession ? { ...data, session: finalSession.session } : data,
-                human: finalSession
-                    ? renderMcpOAuthSessionHuman(data.authorizationUrl, finalSession.session.status)
-                    : [
-                        "MCP OAuth authorization started.",
-                        `Open: ${data.authorizationUrl}`,
-                        `Session: ${data.sessionId}`
-                    ].join("\n"),
-                kind: "mcp_servers_oauth_connect",
-                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
-            };
-        }
-        case "mcp.disconnect": {
-            const serverRef = readRequiredArg(parsed, "server");
-            await confirmDestructive(parsed, context, `Disconnect OAuth for MCP server ${serverRef}?`);
-            const data = await api.disconnectOrgMcpServerOAuth(session, org.id, serverRef);
-            return {
-                data,
-                human: renderSuccess(`Disconnected OAuth for MCP server ${data.server.slug}.`),
-                kind: "mcp_servers_oauth_disconnect",
-                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
-            };
-        }
-        case "mcp.oauth-status": {
-            const data = await api.getOrgMcpServerOAuthStatus(session, org.id, readRequiredArg(parsed, "server"));
-            return {
-                data,
-                human: renderPrettyJson(data.oauth),
-                kind: "mcp_servers_oauth_status",
-                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
-            };
-        }
-        default:
-            throw genericProblem(`Unhandled MCP command ${parsed.definition.id}.`, parsed.definition.id);
-    }
-}
-async function executeSkills(parsed, context, api) {
-    const { org, session } = await resolveOrgScope(parsed, context, api);
-    switch (parsed.definition.id) {
-        case "skills.list": {
-            const data = await api.listOrgSkillPackages(session, org.id);
-            return {
-                data,
-                human: renderTable(data.skills, [
-                    { key: "slug", label: "Slug" },
-                    { key: "displayName", label: "Name" },
-                    { key: "status", label: "Status" },
-                    { key: "currentRevision", label: "Revision" },
-                    { key: "currentFileCount", label: "Files" },
-                    { key: "currentPackageSha256", label: "Package SHA" },
-                    { key: "updatedAt", label: "Updated" }
-                ]),
-                kind: "skills_list",
-                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
-            };
-        }
-        case "skills.get": {
-            const data = await api.getOrgSkillPackage(session, org.id, readRequiredArg(parsed, "skill"));
-            return {
-                data,
-                human: renderPrettyJson(data),
-                kind: "skills_get",
-                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
-            };
-        }
-        case "skills.create": {
-            const description = readOptionalStringFlag(parsed, "description");
-            const dir = readOptionalStringFlag(parsed, "dir");
-            const files = dir ? await readImportEntries(dir) : undefined;
-            const data = await api.createOrgSkillPackage(session, org.id, {
-                ...(description !== undefined ? { description } : {}),
-                displayName: readRequiredStringFlag(parsed, "name"),
-                ...(files ? { files } : {}),
-                slug: readRequiredStringFlag(parsed, "slug")
-            });
-            return {
-                data,
-                human: renderSuccess(`Created skill package ${data.skill.slug}.`),
-                kind: "skills_create",
-                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
-            };
-        }
-        case "skills.upload": {
-            const skillRef = readRequiredArg(parsed, "skill");
-            const files = await readImportEntries(readRequiredStringFlag(parsed, "dir"));
-            const data = await api.uploadOrgSkillPackageRevision(session, org.id, skillRef, { files });
-            return {
-                data,
-                human: renderSuccess(`Uploaded skill package ${skillRef} revision ${String(data.revision.revision)}.`),
-                kind: "skills_upload",
-                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
-            };
-        }
-        case "skills.download": {
-            const skillRef = readRequiredArg(parsed, "skill");
-            const revision = readOptionalNumberFlag(parsed, "revision");
-            const targetDir = readRequiredStringFlag(parsed, "dir");
-            const data = revision === undefined
-                ? await api.getOrgSkillPackage(session, org.id, skillRef)
-                : await api.getOrgSkillPackageRevision(session, org.id, skillRef, revision);
-            await writeSkillPackageFiles(targetDir, data.files);
-            return {
-                data,
-                human: renderSuccess(`Downloaded ${data.files.length} skill package files to ${resolve(targetDir)}.`),
-                kind: "skills_download",
-                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
-            };
-        }
-        case "skills.update": {
-            const displayName = readOptionalStringFlag(parsed, "name");
-            const description = readOptionalStringFlag(parsed, "description");
-            const disable = parsed.flags.disable === true;
-            const enable = parsed.flags.enable === true;
-            if (disable && enable) {
-                throw usageProblem("Use either --disable or --enable, not both.", parsed.definition.id);
-            }
-            const input = {
-                ...(displayName !== undefined ? { displayName } : {}),
-                ...(description !== undefined ? { description } : {}),
-                ...(disable || enable ? { disabled: disable } : {})
-            };
-            if (Object.keys(input).length === 0) {
-                throw usageProblem("Provide at least one skill package field to update.", parsed.definition.id);
-            }
-            const data = await api.updateOrgSkillPackage(session, org.id, readRequiredArg(parsed, "skill"), input);
-            return {
-                data,
-                human: renderSuccess(`Updated skill package ${data.skill.slug}.`),
-                kind: "skills_update",
-                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
-            };
-        }
-        case "skills.delete": {
-            const skillRef = readRequiredArg(parsed, "skill");
-            await confirmDestructive(parsed, context, `Delete skill package ${skillRef}?`);
-            await api.deleteOrgSkillPackage(session, org.id, skillRef);
-            return {
-                data: {},
-                human: renderSuccess(`Deleted skill package ${skillRef}.`),
-                kind: "skills_delete",
-                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
-            };
-        }
-        default:
-            throw genericProblem(`Unhandled skills command ${parsed.definition.id}.`, parsed.definition.id);
-    }
-}
-async function writeSkillPackageFiles(targetDir, files) {
-    const root = resolve(targetDir);
-    for (const file of files) {
-        const targetPath = resolve(root, file.path);
-        if (!targetPath.startsWith(`${root}/`) && targetPath !== root) {
-            throw usageProblem(`Refusing to write skill package path '${file.path}' outside destination.`, "skills.download");
-        }
-        await mkdir(dirname(targetPath), { recursive: true });
-        await writeFile(targetPath, file.content, "utf8");
-    }
-}
-async function pollMcpOAuthSession(api, session, orgId, serverRef, oauthSessionId) {
-    for (let attempt = 0; attempt < 60; attempt += 1) {
-        const result = await api.getOrgMcpServerOAuthSession(session, orgId, serverRef, oauthSessionId);
-        if (result.session.status !== "pending") {
-            return result;
-        }
-        await new Promise((resolve) => setTimeout(resolve, 2_000));
-    }
-    return await api.getOrgMcpServerOAuthSession(session, orgId, serverRef, oauthSessionId);
-}
-function renderMcpOAuthSessionHuman(authorizationUrl, status) {
-    if (status === "connected") {
-        return renderSuccess("MCP OAuth connection completed.");
-    }
-    if (isFailedMcpOAuthSession(status)) {
-        return "MCP OAuth connection failed.";
-    }
-    return [
-        "MCP OAuth authorization is still pending.",
-        `Open: ${authorizationUrl}`
-    ].join("\n");
-}
-function isFailedMcpOAuthSession(status) {
-    return status === "error" || status === "expired";
-}
 async function executeEnv(parsed, context, api) {
     const { org, session } = await resolveOrgScope(parsed, context, api);
     switch (parsed.definition.id) {
         case "env.list": {
-            const data = await api.listRuntimeVariables(session, org.id);
+            const environment = readCliEnvironmentFlag(parsed);
+            const data = await api.listRuntimeVariables(session, org.id, {
+                ...(environment ? { environment } : {})
+            });
             return {
                 data,
                 human: renderTable(data.variables, [
                     { key: "name", label: "Name" },
                     { key: "value", label: "Value" },
+                    { key: "environmentKey", label: "Environment" },
                     { key: "updatedAt", label: "Updated" }
                 ]),
                 kind: "authoring_env_list",
-                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
+                meta: { command: parsed.definition.path.join(" "), ...(environment ? { environment } : {}), orgId: org.id }
             };
         }
         case "env.get": {
-            const variables = (await api.listRuntimeVariables(session, org.id)).variables;
+            const environment = readRequiredCliEnvironmentFlag(parsed);
+            const variables = (await api.listRuntimeVariables(session, org.id, {
+                environment
+            })).variables;
             const variable = requireFound(variables.find((entry) => entry.name === readRequiredArg(parsed, "name")) ?? null, `Environment variable '${parsed.args.name}' was not found.`, parsed.definition.id);
             return {
                 data: { variable },
                 human: renderPrettyJson(variable),
                 kind: "authoring_env_get",
-                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
+                meta: { command: parsed.definition.path.join(" "), environment, orgId: org.id }
             };
         }
         case "env.replace": {
+            const environment = readRequiredCliEnvironmentFlag(parsed);
             const body = await readJsonInputSpecifier(String(parsed.flags.file), context.stdin, parsed.definition.id);
             const rawVariables = body.variables;
             if (!Array.isArray(rawVariables)) {
@@ -1346,33 +1204,42 @@ async function executeEnv(parsed, context, api) {
                     value: String(entry.value)
                 };
             });
-            const current = (await api.listRuntimeVariables(session, org.id)).variables;
+            const current = (await api.listRuntimeVariables(session, org.id, {
+                environment
+            })).variables;
             const diff = diffVariables(current, nextVariables);
+            announceResolvedEnvironment(parsed, context, environment);
             if (!parsed.json) {
                 context.stdout.write(`${renderDiffSummary(diff)}\n`);
             }
-            await confirmDestructive(parsed, context, `Replace the full environment for ${org.slug}?`);
-            const data = await api.replaceRuntimeVariables(session, org.id, { variables: nextVariables });
+            await confirmDestructive(parsed, context, `Replace runtime variables for ${environment} in ${org.slug}?`);
+            const data = await api.replaceRuntimeVariables(session, org.id, {
+                environment,
+                variables: nextVariables
+            });
             return {
                 data,
-                human: renderSuccess(`Replaced ${data.variables.length} environment variables.`),
+                human: renderSuccess(`Replaced ${data.variables.length} environment variables in ${environment}.`),
                 kind: "authoring_env_replace",
-                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
+                meta: { command: parsed.definition.path.join(" "), environment, orgId: org.id }
             };
         }
         case "env.import": {
+            const environment = readRequiredCliEnvironmentFlag(parsed);
             const filePath = readRequiredArg(parsed, "path-to-.env");
             const content = await readTextInputSpecifier(`@${filePath}`, context.stdin, parsed.definition.id);
             const preview = await parseEnvFile(filePath);
+            announceResolvedEnvironment(parsed, context, environment);
             const data = await api.importRuntimeVariables(session, org.id, {
                 content,
+                environment,
                 fileName: filePath
             });
             return {
                 data,
-                human: renderSuccess(`Imported ${data.importedCount} variables from ${filePath}. Parsed ${preview.length}.`),
+                human: renderSuccess(`Imported ${data.importedCount} variables from ${filePath} into ${environment}. Parsed ${preview.length}.`),
                 kind: "authoring_env_import",
-                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
+                meta: { command: parsed.definition.path.join(" "), environment, orgId: org.id }
             };
         }
         default:
@@ -1383,40 +1250,50 @@ async function executeSecrets(parsed, context, api) {
     const { org, session } = await resolveOrgScope(parsed, context, api);
     switch (parsed.definition.id) {
         case "secrets.list": {
-            const data = await api.listOrgSecrets(session, org.id);
+            const environment = readCliEnvironmentFlag(parsed);
+            const data = await api.listOrgSecrets(session, org.id, {
+                ...(environment ? { environment } : {})
+            });
             return {
                 data,
                 human: renderTable(data.secrets, [
                     { key: "name", label: "Name" },
                     { key: "hasValue", label: "Defined" },
+                    { key: "environmentKey", label: "Environment" },
                     { key: "updatedAt", label: "Updated" }
                 ]),
                 kind: "authoring_secrets_list",
-                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
+                meta: { command: parsed.definition.path.join(" "), ...(environment ? { environment } : {}), orgId: org.id }
             };
         }
         case "secrets.set": {
+            const environment = readRequiredCliEnvironmentFlag(parsed);
             const value = await readTextInputSpecifier("-", context.stdin, parsed.definition.id);
+            announceResolvedEnvironment(parsed, context, environment);
             const data = await api.upsertOrgSecret(session, org.id, {
+                environment,
                 name: readRequiredArg(parsed, "name"),
                 value: value.replace(/\r?\n$/u, "")
             });
             return {
                 data,
-                human: renderSuccess(`Saved secret '${data.secret.name}'.`),
+                human: renderSuccess(`Saved secret '${data.secret.name}' in ${environment}.`),
                 kind: "authoring_secrets_set",
-                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
+                meta: { command: parsed.definition.path.join(" "), environment, orgId: org.id }
             };
         }
         case "secrets.delete": {
+            const environment = readRequiredCliEnvironmentFlag(parsed);
             const name = readRequiredArg(parsed, "name");
-            await confirmDestructive(parsed, context, `Delete secret ${name} from ${org.slug}?`);
-            const data = await api.deleteOrgSecret(session, org.id, name);
+            await confirmDestructive(parsed, context, `Delete secret ${name} from ${environment} in ${org.slug}?`);
+            const data = await api.deleteOrgSecret(session, org.id, name, {
+                environment
+            });
             return {
                 data,
-                human: renderSuccess(data.deleted ? `Deleted secret '${name}'.` : `Secret '${name}' was not defined.`),
+                human: renderSuccess(data.deleted ? `Deleted secret '${name}' from ${environment}.` : `Secret '${name}' was not defined in ${environment}.`),
                 kind: "authoring_secrets_delete",
-                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
+                meta: { command: parsed.definition.path.join(" "), environment, orgId: org.id }
             };
         }
         default:
@@ -1467,62 +1344,6 @@ async function executeChat(parsed, context, api) {
                 meta: { command: parsed.definition.path.join(" "), orgId: org.id }
             };
         }
-        case "chat.changes": {
-            const data = await api.getChatChanges(session, org.id, readRequiredArg(parsed, "session-id"));
-            return {
-                data,
-                human: renderPrettyJson(data.changes),
-                kind: "chat_changes_get",
-                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
-            };
-        }
-        case "chat.validation": {
-            const data = await api.getChatValidation(session, org.id, readRequiredArg(parsed, "session-id"));
-            return {
-                data,
-                human: renderPrettyJson(data.validation),
-                kind: "chat_validation_get",
-                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
-            };
-        }
-        case "chat.draft.get": {
-            const data = await api.getChatDraft(session, org.id, readRequiredArg(parsed, "session-id"));
-            return {
-                data,
-                human: renderPrettyJson(data.draft),
-                kind: "chat_draft_get",
-                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
-            };
-        }
-        case "chat.draft.apply": {
-            await confirmDestructive(parsed, context, `Apply draft for session ${parsed.args["session-id"]}?`);
-            const data = await api.applyChatDraft(session, org.id, readRequiredArg(parsed, "session-id"));
-            return {
-                data,
-                human: renderSuccess(`Applied draft for session ${parsed.args["session-id"]}.`),
-                kind: "chat_draft_apply",
-                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
-            };
-        }
-        case "chat.draft.refresh": {
-            await confirmDestructive(parsed, context, `Refresh draft for session ${parsed.args["session-id"]}?`);
-            const data = await api.refreshChatDraft(session, org.id, readRequiredArg(parsed, "session-id"));
-            return {
-                data,
-                human: renderSuccess(`Refreshed draft for session ${parsed.args["session-id"]}.`),
-                kind: "chat_draft_refresh",
-                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
-            };
-        }
-        case "chat.workspace-state": {
-            const data = await api.getChatWorkspaceState(session, org.id, readRequiredArg(parsed, "session-id"));
-            return {
-                data,
-                human: renderPrettyJson(data.workspaceState),
-                kind: "chat_workspace_state_get",
-                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
-            };
-        }
         default:
             throw genericProblem(`Unhandled chat command ${parsed.definition.id}.`, parsed.definition.id);
     }
@@ -1569,9 +1390,10 @@ async function executeCompletion(parsed) {
     }
 }
 async function executeSchemaGet(parsed) {
-    const schema = getCliSchema(readRequiredArg(parsed, "resource-name"));
+    const resourceName = readRequiredArg(parsed, "resource-name");
+    const schema = getCliSchema(resourceName);
     if (!schema) {
-        throw notFoundProblem(`Schema '${parsed.args["resource-name"]}' was not found.`, "schema get");
+        throw notFoundProblem(`Schema '${resourceName}' was not found. Use lowercase schema names, not YAML kind names. Run \`schema list\` to see all schemas. Known names include: ${schemaNamePreview()}.`, "schema get");
     }
     return {
         data: { schema },
@@ -1589,9 +1411,99 @@ async function executeSchemaGet(parsed) {
         meta: { command: "schema get" }
     };
 }
+function schemaNamePreview() {
+    const names = new Set(listCliSchemas().map((schema) => schema.name));
+    return ["process", "operation", "capability", "decision", "manifest", "organization", "assignments"]
+        .filter((name) => names.has(name))
+        .join(", ");
+}
 async function executeAdmin(parsed, context, api) {
     const session = requireStoredSession(context.session, parsed.definition.id);
     switch (parsed.definition.id) {
+        case "admin.usage.summary": {
+            const { org, session: scopedSession } = await resolveOrgScope(parsed, context, api);
+            const data = await api.getAgentUsage(scopedSession, org.id, readAgentUsageQuery(parsed));
+            return {
+                data,
+                human: renderAgentUsageSummary(org.id, data.usage),
+                kind: "admin_usage_summary",
+                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
+            };
+        }
+        case "admin.usage.workflows": {
+            const { org, session: scopedSession } = await resolveOrgScope(parsed, context, api);
+            const data = await api.getAgentUsage(scopedSession, org.id, readAgentUsageQuery(parsed));
+            return {
+                data,
+                human: renderTable(data.usage.workflows.map((workflow) => ({
+                    cost: formatUsdMicros(workflow.usdMicros),
+                    executions: formatInteger(workflow.agentExecutionCount),
+                    model: formatProviderModel(workflow.provider, workflow.model),
+                    tokensIn: formatInteger(workflow.tokensIn),
+                    tokensOut: formatInteger(workflow.tokensOut),
+                    toolCalls: formatInteger(workflow.toolCallCount),
+                    workflow: workflow.processName
+                })), [
+                    { key: "workflow", label: "Workflow" },
+                    { key: "model", label: "Model" },
+                    { key: "executions", label: "Executions" },
+                    { key: "tokensIn", label: "Tokens in" },
+                    { key: "tokensOut", label: "Tokens out" },
+                    { key: "toolCalls", label: "Tool calls" },
+                    { key: "cost", label: "Cost" }
+                ]),
+                kind: "admin_usage_workflows",
+                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
+            };
+        }
+        case "admin.usage.tools": {
+            const { org, session: scopedSession } = await resolveOrgScope(parsed, context, api);
+            const data = await api.getAgentUsage(scopedSession, org.id, readAgentUsageQuery(parsed));
+            return {
+                data,
+                human: renderTable(data.usage.tools.map((tool) => ({
+                    calls: formatInteger(tool.callCount),
+                    failed: formatInteger(tool.failureCount),
+                    succeeded: formatInteger(tool.successCount),
+                    tool: tool.toolName
+                })), [
+                    { key: "tool", label: "Tool" },
+                    { key: "calls", label: "Calls" },
+                    { key: "succeeded", label: "Succeeded" },
+                    { key: "failed", label: "Failed" }
+                ]),
+                kind: "admin_usage_tools",
+                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
+            };
+        }
+        case "admin.usage.events": {
+            const { org, session: scopedSession } = await resolveOrgScope(parsed, context, api);
+            const data = await api.getAgentUsage(scopedSession, org.id, readAgentUsageQuery(parsed));
+            return {
+                data,
+                human: renderTable(data.usage.recentEvents.map((event) => ({
+                    cost: formatUsdMicros(event.usdMicros),
+                    event: event.eventId,
+                    model: formatProviderModel(event.provider, event.model),
+                    occurredAt: event.occurredAt,
+                    status: event.sourceStatus === "event_only" ? `${event.status} (event only)` : event.status,
+                    tokens: formatInteger(event.tokensIn + event.tokensOut),
+                    toolCalls: formatInteger(event.toolCallCount),
+                    workflow: event.processName
+                })), [
+                    { key: "event", label: "Event" },
+                    { key: "workflow", label: "Workflow" },
+                    { key: "model", label: "Model" },
+                    { key: "status", label: "Status" },
+                    { key: "tokens", label: "Tokens" },
+                    { key: "toolCalls", label: "Tool calls" },
+                    { key: "cost", label: "Cost" },
+                    { key: "occurredAt", label: "Occurred at" }
+                ]),
+                kind: "admin_usage_events",
+                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
+            };
+        }
         case "admin.org.deleted.list": {
             const data = await api.listDeletedOrganizations(session);
             return {
@@ -1638,6 +1550,46 @@ async function executeAdmin(parsed, context, api) {
             throw genericProblem(`Unhandled admin command ${parsed.definition.id}.`, parsed.definition.id);
     }
 }
+function readAgentUsageQuery(parsed) {
+    const from = readOptionalStringFlag(parsed, "from");
+    const to = readOptionalStringFlag(parsed, "to");
+    return {
+        ...(from ? { from } : {}),
+        ...optionalNumberValue("limit", readOptionalNumberFlag(parsed, "limit")),
+        ...(to ? { to } : {})
+    };
+}
+function renderAgentUsageSummary(orgId, usage) {
+    const summary = usage.summary;
+    return renderKeyValue([
+        { label: "Organization", value: orgId },
+        { label: "From", value: summary.from },
+        { label: "To", value: summary.to },
+        { label: "Agent executions", value: formatInteger(summary.agentExecutionCount) },
+        { label: "Tokens in", value: formatInteger(summary.tokensIn) },
+        { label: "Tokens out", value: formatInteger(summary.tokensOut) },
+        { label: "Tool calls", value: formatInteger(summary.toolCallCount) },
+        { label: "Cost", value: formatUsdMicros(summary.usdMicros) },
+        { label: "Event-only records", value: formatInteger(summary.sourceEventOnlyCount) }
+    ]);
+}
+function formatProviderModel(provider, model) {
+    if (provider && model) {
+        return `${provider}/${model}`;
+    }
+    return provider ?? model ?? "";
+}
+function formatInteger(value) {
+    return new Intl.NumberFormat(undefined, { maximumFractionDigits: 0 }).format(value);
+}
+function formatUsdMicros(value) {
+    return new Intl.NumberFormat(undefined, {
+        currency: "USD",
+        maximumFractionDigits: 4,
+        minimumFractionDigits: value > 0 && value < 10_000 ? 4 : 2,
+        style: "currency"
+    }).format(value / 1_000_000);
+}
 async function resolveOrgScope(parsed, context, api) {
     const session = requireStoredSession(context.session, parsed.definition.id);
     const selector = readOptionalStringFlag(parsed, "org");
@@ -1675,16 +1627,109 @@ function isSameSessionIdentity(candidate, session) {
         && candidate.user.id === session.user.id
         && candidate.accessTokenPayload.sub === session.accessTokenPayload.sub;
 }
-function readOptionalMcpAuthMode(parsed) {
-    const value = readOptionalStringFlag(parsed, "auth-mode");
-    if (value === undefined || value === "none" || value === "oauth") {
-        return value;
-    }
-    throw usageProblem("MCP auth mode must be 'none' or 'oauth'.", parsed.definition.id);
-}
 function optionalNumberValue(key, value) {
     return value !== undefined ? { [key]: value } : {};
 }
+function withCliSummary(meta, summary) {
+    const normalized = normalizeCliSummary(summary);
+    return normalized ? { ...meta, summary: normalized } : meta;
+}
+function normalizeCliSummary(value) {
+    const trimmed = value?.trim();
+    return trimmed && trimmed.length > 0 ? trimmed : null;
+}
+function summarizeWorkflowNodeTest(test) {
+    if (test.status === "passed") {
+        const capturedArtifacts = Array.isArray(test.capturedArtifacts)
+            ? test.capturedArtifacts.length
+            : 0;
+        return `Workflow-node test passed${capturedArtifacts > 0 ? ` with ${String(capturedArtifacts)} captured artifact${capturedArtifacts === 1 ? "" : "s"}` : ""}.`;
+    }
+    const label = test.status === "invalid" ? "invalid" : "failed";
+    const error = recordField(test, "error");
+    const message = typeof error.message === "string" && error.message.trim().length > 0
+        ? truncateSummaryText(error.message)
+        : firstDiagnosticMessage(readSummaryDiagnostics(test));
+    return `Workflow-node test ${label}${message ? `: ${message}` : ""}.`;
+}
+function renderWorkflowNodeTestHuman(test) {
+    const summary = summarizeWorkflowNodeTest(test);
+    const capturedArtifacts = Array.isArray(test.capturedArtifacts)
+        ? test.capturedArtifacts.length
+        : 0;
+    const logs = Array.isArray(test.logs)
+        ? test.logs.length
+        : 0;
+    const rows = [
+        { label: "Status", value: test.status },
+        { label: "Workflow", value: test.workflowName },
+        { label: "Node", value: test.nodeId },
+        ...(typeof test.operationName === "string"
+            ? [{ label: "Operation", value: test.operationName }]
+            : []),
+        { label: "Captured artifacts", value: capturedArtifacts },
+        { label: "Logs", value: logs > 0 ? `${String(logs)} stream${logs === 1 ? "" : "s"} available` : "none" }
+    ];
+    const diagnostics = readSummaryDiagnostics(test);
+    const error = recordField(test, "error");
+    const actionable = typeof error.message === "string" && error.message.trim().length > 0
+        ? truncateSummaryText(error.message)
+        : firstDiagnosticMessage(diagnostics);
+    return [
+        summary,
+        renderKeyValue(rows),
+        ...(actionable && test.status !== "passed" ? [`Action: ${actionable}`] : [])
+    ].filter((entry) => entry.trim().length > 0).join("\n");
+}
+function summarizeReleaseValidation(validation) {
+    const diagnostics = readSummaryDiagnostics(validation);
+    return validation.releaseReady === true
+        ? `Release validation passed${formatDiagnosticSummarySuffix(diagnostics)}.`
+        : `Release validation failed${formatDiagnosticSummarySuffix(diagnostics)}.`;
+}
+function summarizeReleaseCreation(releaseId) {
+    return `Release ${releaseId} created. It is not live yet; review and deploy it from /app/releases/${releaseId}.`;
+}
+function readSummaryDiagnostics(record) {
+    const diagnostics = record.diagnostics;
+    return Array.isArray(diagnostics)
+        ? diagnostics.filter((entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry))
+        : [];
+}
+function formatDiagnosticSummarySuffix(diagnostics) {
+    const errorCount = diagnostics.filter((diagnostic) => diagnostic.severity === "error").length;
+    const warningCount = diagnostics.length - errorCount;
+    const parts = [
+        ...(errorCount > 0 ? [formatDiagnosticCount(errorCount, "error")] : []),
+        ...(warningCount > 0 ? [formatDiagnosticCount(warningCount, "warning")] : [])
+    ];
+    if (parts.length === 0) {
+        return "";
+    }
+    const message = firstDiagnosticMessage(diagnostics);
+    return ` with ${parts.join(" and ")}${message ? `: ${message}` : ""}`;
+}
+function formatDiagnosticCount(count, label) {
+    return `${String(count)} ${label}${count === 1 ? "" : "s"}`;
+}
+function firstDiagnosticMessage(diagnostics) {
+    for (const diagnostic of diagnostics) {
+        if (typeof diagnostic.message === "string" && diagnostic.message.trim().length > 0) {
+            return truncateSummaryText(diagnostic.message);
+        }
+    }
+    return null;
+}
+function truncateSummaryText(value) {
+    const trimmed = value.trim();
+    return trimmed.length <= 180 ? trimmed : `${trimmed.slice(0, 177)}...`;
+}
+function recordField(result, key) {
+    const value = result[key];
+    return typeof value === "object" && value !== null && !Array.isArray(value)
+        ? value
+        : {};
+}
 function readRequiredArg(parsed, name) {
     const value = parsed.args[name];
     if (!value) {
@@ -1692,6 +1737,11 @@ function readRequiredArg(parsed, name) {
     }
     return value;
 }
+function announceResolvedEnvironment(parsed, context, environment) {
+    if (!parsed.json) {
+        context.stdout.write(`Environment: ${environment}\n`);
+    }
+}
 function readRequiredIntegerArg(parsed, name) {
     const raw = readRequiredArg(parsed, name);
     const parsedValue = Number(raw);