@kraken-ai/platform 0.0.4 → 0.0.7

package/dist/cli.js

@@ -1,39 +1,328 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import * as z12 from "zod";
+import { execFile } from "child_process";
+import { promisify } from "util";
+import * as z11 from "zod";
+
+// src/internal/secret-string.ts
+import { inspect } from "util";
+var SecretString = class {
+  #value;
+  constructor(value) {
+    this.#value = value;
+  }
+  unmasked() {
+    return this.#value;
+  }
+  toJSON() {
+    return "[REDACTED]";
+  }
+  toString() {
+    return "[REDACTED]";
+  }
+  [Symbol.toPrimitive]() {
+    return "[REDACTED]";
+  }
+  [inspect.custom]() {
+    return "SecretString([REDACTED])";
+  }
+};
+var unwrapSecret = (value) => value instanceof SecretString ? value.unmasked() : value;
+
+// src/cli/api-keys.ts
+var DURATION_RE = /^(\d+)(h|d|y)$/;
+var parseDuration = (input) => {
+  const match = DURATION_RE.exec(input);
+  if (!match) return null;
+  const amount = Number(match[1]);
+  const unit = match[2];
+  const now = /* @__PURE__ */ new Date();
+  switch (unit) {
+    case "h":
+      return new Date(now.getTime() + amount * 36e5);
+    case "d":
+      return new Date(now.getTime() + amount * 864e5);
+    case "y":
+      return new Date(now.getTime() + amount * 365.25 * 864e5);
+    default:
+      return null;
+  }
+};
+var VALID_ENVIRONMENTS = /* @__PURE__ */ new Set(["dev", "staging", "prod"]);
+var getAuthHeaders = (apiKey) => {
+  const secret = new SecretString(apiKey);
+  return { Authorization: `Bearer ${unwrapSecret(secret)}`, "Content-Type": "application/json" };
+};
+var collectErrorMessages = (err) => {
+  const parts = [];
+  let current = err;
+  while (current instanceof Error) {
+    if (current.message) parts.push(current.message);
+    current = current.cause;
+  }
+  return parts.join(": ");
+};
+var formatNetworkError = (err, baseUrl) => {
+  const msg = collectErrorMessages(err);
+  if (msg.includes("unknown scheme")) {
+    return `Invalid platform URL "${baseUrl}" \u2014 must start with https:// (or http:// for local dev).
+  Run \`kraken login\` to update your credentials.`;
+  }
+  if (msg.includes("ECONNREFUSED")) {
+    return `Could not connect to ${baseUrl} \u2014 is the platform running?
+  Check the URL or run \`kraken login\` to update it.`;
+  }
+  if (msg.includes("ENOTFOUND")) {
+    return `Could not resolve hostname for ${baseUrl} \u2014 check the URL.
+  Run \`kraken login\` to update your credentials.`;
+  }
+  if (msg.includes("abort") || msg.includes("TIMEOUT")) {
+    return `Request to ${baseUrl} timed out.
+  Check your network connection or try again.`;
+  }
+  return `Could not reach ${baseUrl}. Check that the platform is running and the URL is correct.
+  Run \`kraken login\` to update your credentials.`;
+};
+var normalizeBaseUrl = (baseUrl) => {
+  if (!/^https?:\/\//.test(baseUrl)) {
+    return `https://${baseUrl}`;
+  }
+  return baseUrl;
+};
+var fetchApi = async (deps, url, baseUrl, init) => {
+  const normalizedBase = normalizeBaseUrl(baseUrl);
+  const normalizedUrl = baseUrl !== normalizedBase ? url.replace(baseUrl, normalizedBase) : url;
+  try {
+    return await deps.fetch(normalizedUrl, init);
+  } catch (err) {
+    deps.log(`Error: ${formatNetworkError(err, normalizedBase)}`);
+    return null;
+  }
+};
+var handleCreate = async (parsed, deps) => {
+  const creds = deps.loadCredentials();
+  if (!creds?.apiKey || !creds?.baseUrl) {
+    deps.log("Error: not logged in. Run `kraken login` first.");
+    return 1;
+  }
+  const name = parsed.flags.name;
+  if (!name) {
+    deps.log(
+      "Error: --name is required.\n  Usage: kraken api-keys create --name <name> [--env dev] [--expires 90d]"
+    );
+    return 1;
+  }
+  const environment = parsed.flags.env ?? "dev";
+  if (!VALID_ENVIRONMENTS.has(environment)) {
+    deps.log(`Error: invalid environment "${environment}". Must be one of: dev, staging, prod.`);
+    return 1;
+  }
+  let expiresAt;
+  if (parsed.flags.expires) {
+    const date = parseDuration(parsed.flags.expires);
+    if (!date) {
+      deps.log(
+        `Error: invalid duration "${parsed.flags.expires}". Use format like 90d, 24h, or 1y.`
+      );
+      return 1;
+    }
+    expiresAt = date.toISOString();
+  }
+  const res = await fetchApi(deps, `${creds.baseUrl}/api/v1/api-keys`, creds.baseUrl, {
+    method: "POST",
+    headers: getAuthHeaders(creds.apiKey),
+    body: JSON.stringify({ name, environment, expiresAt })
+  });
+  if (!res) return 1;
+  if (!res.ok) {
+    const body = await res.json();
+    deps.log(`Error: ${body.error ?? `request failed (${String(res.status)})`}`);
+    return 1;
+  }
+  const data = await res.json();
+  deps.log(`
+  API Key created successfully.
+`);
+  deps.log(`  Name: ${data.name}`);
+  deps.log(`  Env:  ${data.environment}`);
+  deps.log(`  Key:  ${data.key}`);
+  if (data.expiresAt) {
+    deps.log(`  Expires:    ${data.expiresAt}`);
+  }
+  deps.log(`
+  Copy this key now \u2014 it will not be shown again.
+`);
+  return 0;
+};
+var handleList = async (parsed, deps) => {
+  const creds = deps.loadCredentials();
+  if (!creds?.apiKey || !creds?.baseUrl) {
+    deps.log("Error: not logged in. Run `kraken login` first.");
+    return 1;
+  }
+  const envFilter = parsed.flags.env;
+  const query = envFilter ? `?environment=${encodeURIComponent(envFilter)}` : "";
+  const res = await fetchApi(deps, `${creds.baseUrl}/api/v1/api-keys${query}`, creds.baseUrl, {
+    headers: getAuthHeaders(creds.apiKey)
+  });
+  if (!res) return 1;
+  if (!res.ok) {
+    const body = await res.json();
+    deps.log(`Error: ${body.error ?? `request failed (${String(res.status)})`}`);
+    return 1;
+  }
+  const keys = await res.json();
+  if (keys.length === 0) {
+    deps.log("No API keys found. Create one with: kraken api-keys create --name <name>");
+    return 0;
+  }
+  deps.log("\n  API Keys:\n");
+  deps.log(
+    "  ID                                   Name            Env       Key                    Created             Last Used           Expires"
+  );
+  deps.log(`  ${"\u2500".repeat(150)}`);
+  for (const k of keys) {
+    const expired = k.expired ? " (expired)" : "";
+    const lastUsed = k.lastUsed ? k.lastUsed.slice(0, 10) : "never";
+    const expires = k.expiresAt ? `${k.expiresAt.slice(0, 10)}${expired}` : "never";
+    deps.log(
+      `  ${k.id}  ${k.name.padEnd(16)}${k.environment.padEnd(10)}${k.prefix.padEnd(23)}${k.createdAt.slice(0, 10).padEnd(20)}${lastUsed.padEnd(20)}${expires}`
+    );
+  }
+  deps.log("");
+  return 0;
+};
+var handleRevoke = async (parsed, deps) => {
+  const creds = deps.loadCredentials();
+  if (!creds?.apiKey || !creds?.baseUrl) {
+    deps.log("Error: not logged in. Run `kraken login` first.");
+    return 1;
+  }
+  const id = parsed.positional[1];
+  if (!id) {
+    deps.log("Error: key ID is required.\n  Usage: kraken api-keys revoke <id>");
+    return 1;
+  }
+  const res = await fetchApi(
+    deps,
+    `${creds.baseUrl}/api/v1/api-keys/${encodeURIComponent(id)}`,
+    creds.baseUrl,
+    {
+      method: "DELETE",
+      headers: getAuthHeaders(creds.apiKey)
+    }
+  );
+  if (!res) return 1;
+  if (res.status === 404) {
+    deps.log("Error: API key not found.");
+    return 1;
+  }
+  if (!res.ok) {
+    const body = await res.json();
+    deps.log(`Error: ${body.error ?? `request failed (${String(res.status)})`}`);
+    return 1;
+  }
+  deps.log("API key revoked successfully.");
+  return 0;
+};
+var handleApiKeys = async (parsed, deps) => {
+  const subcommand = parsed.positional[0];
+  switch (subcommand) {
+    case "create":
+      return handleCreate(parsed, deps);
+    case "list":
+      return handleList(parsed, deps);
+    case "revoke":
+      return handleRevoke(parsed, deps);
+    default:
+      deps.log(
+        `kraken api-keys \u2014 Manage API keys
+
+Commands:
+  create  --name <name> [--env dev] [--expires 90d]  Create a new API key
+  list    [--env dev|staging|prod]                   List API keys
+  revoke  <id>                                       Revoke an API key
+`
+      );
+      return 0;
+  }
+};
 
 // src/cli/codegen.ts
 import fs from "fs";
 import path from "path";
 
-// src/cli/log.ts
-var supportsColor = !("NO_COLOR" in process.env) && process.env.FORCE_COLOR !== "0" && (process.stderr.isTTY ?? false);
-var code = (open, close) => {
-  const openStr = `\x1B[${open}m`;
-  const closeStr = `\x1B[${close}m`;
-  return (s) => supportsColor ? `${openStr}${s}${closeStr}` : s;
+// ../../../private-packages/platform-core/dist/qualified-name.js
+var parse = (qualified) => {
+  const slashIndex = qualified.indexOf("/");
+  if (slashIndex === -1) {
+    throw new Error(`Expected qualified name with "/" separator, got: "${qualified}"`);
+  }
+  if (qualified.indexOf("/", slashIndex + 1) !== -1) {
+    throw new Error(`Expected exactly one "/" in qualified name, got: "${qualified}"`);
+  }
+  const repoName = qualified.slice(0, slashIndex);
+  const primitiveName = qualified.slice(slashIndex + 1);
+  if (!repoName || !primitiveName) {
+    throw new Error(`Both repo and primitive segments must be non-empty, got: "${qualified}"`);
+  }
+  return { repoName, primitiveName };
 };
-var bold = code(1, 22);
-var dim = code(2, 22);
-var red = code(31, 39);
-var yellow = code(33, 39);
-var green = code(32, 39);
-var cyan = code(36, 39);
-var warn = (msg) => {
-  process.stderr.write(`  ${dim("[kraken-ai:")} ${yellow("warn")}${dim("]")} ${msg}
-`);
+var isQualified = (name) => {
+  const slashIndex = name.indexOf("/");
+  if (slashIndex === -1 || slashIndex === 0 || slashIndex === name.length - 1)
+    return false;
+  return name.indexOf("/", slashIndex + 1) === -1;
 };
 
-// src/cli/validate.ts
-var ENTITY_NAME_REGEX = /^[a-z0-9][a-z0-9-]{0,62}[a-z0-9]$/;
-var isValidEntityName = (name) => name.length === 1 ? /^[a-z0-9]$/.test(name) : ENTITY_NAME_REGEX.test(name);
+// ../../../private-packages/platform-core/dist/types/environment.js
+import * as z from "zod";
+var environmentSchema = z.enum(["dev", "staging", "prod"]);
+
+// ../../../private-packages/platform-core/dist/types/identity.js
+import * as z2 from "zod";
+var jitPolicySchema = z2.enum(["auto-approve", "policy-based", "require-approval"]);
+var identityConfigSchema = z2.object({
+  basePermissions: z2.array(z2.string()),
+  requestablePermissions: z2.array(z2.string()).optional(),
+  jitPolicy: jitPolicySchema.optional(),
+  maxJitDurationMinutes: z2.number().int().positive().optional()
+});
+
+// ../../../private-packages/platform-core/dist/types/notifications.js
+import * as z3 from "zod";
+var notificationConfigSchema = z3.object({
+  slack: z3.string().optional(),
+  onSuccess: z3.boolean().optional(),
+  onFailure: z3.boolean().optional(),
+  onTimeout: z3.boolean().optional()
+});
+
+// ../../../private-packages/platform-core/dist/types/platform-agent.js
+import * as z7 from "zod";
+
+// ../../../private-packages/platform-core/dist/validate.js
+var PRIMITIVE_NAME_REGEX = /^[a-z0-9][a-z0-9-]{0,62}[a-z0-9]$/;
+var isValidPrimitiveName = (name) => name.length === 1 ? /^[a-z0-9]$/.test(name) : PRIMITIVE_NAME_REGEX.test(name);
 var SKILL_NAME_REGEX = /^[a-zA-Z0-9][a-zA-Z0-9-]{0,62}[a-zA-Z0-9]$/;
 var isValidSkillName = (basename) => basename.length === 1 ? /^[a-zA-Z0-9]$/.test(basename) : SKILL_NAME_REGEX.test(basename);
 var isValidSkillId = (id) => {
   const base = id.endsWith(".md") ? id.slice(0, -3) : id;
   return isValidSkillName(base);
 };
+var isValidQualifiedName = (name) => {
+  if (!isQualified(name))
+    return false;
+  const { repoName, primitiveName } = parse(name);
+  return isValidPrimitiveName(repoName) && isValidPrimitiveName(primitiveName);
+};
+var isValidQualifiedSkillId = (id) => {
+  if (!isQualified(id))
+    return false;
+  const { repoName, primitiveName } = parse(id);
+  return isValidPrimitiveName(repoName) && isValidSkillId(primitiveName);
+};
 var TOOL_NAME_REGEX = /^[a-z][a-z0-9_-]{0,62}[a-z0-9]$/;
 var isValidToolName = (name) => name.length === 1 ? /^[a-z]$/.test(name) : TOOL_NAME_REGEX.test(name);
 var PROPERTY_NAME_REGEX = /^[a-zA-Z_$][a-zA-Z0-9_$]{0,254}$/;
@@ -47,38 +336,169 @@ var FORBIDDEN_PROPS = /* @__PURE__ */ new Set([
   "__lookupSetter__"
 ]);
 var isValidPropertyName = (name) => PROPERTY_NAME_REGEX.test(name) && !FORBIDDEN_PROPS.has(name);
+
+// ../../../private-packages/platform-core/dist/types/resources.js
+import * as z4 from "zod";
+var resourceLimitsSchema = z4.object({
+  maxTokens: z4.number().int().positive().optional(),
+  maxCostUsd: z4.number().positive().optional(),
+  timeoutSeconds: z4.number().int().positive().optional()
+});
+var retryPolicySchema = z4.object({
+  maxAttempts: z4.number().int().min(1).optional(),
+  backoffSeconds: z4.number().positive().optional()
+});
+var concurrencyPolicySchema = z4.object({
+  maxParallelRuns: z4.number().int().min(1).optional()
+});
+
+// ../../../private-packages/platform-core/dist/types/team.js
+import * as z5 from "zod";
+var teamConfigSchema = z5.object({
+  members: z5.array(z5.string()).min(1),
+  maxConcurrentWorkers: z5.number().int().min(1).optional(),
+  maxTokenBudgetPerWorker: z5.number().int().positive().optional(),
+  maxDurationPerWorker: z5.number().positive().optional()
+});
+
+// ../../../private-packages/platform-core/dist/types/trigger.js
+import * as z6 from "zod";
+var cronTriggerSchema = z6.object({
+  type: z6.literal("cron"),
+  expression: z6.string(),
+  timezone: z6.string().optional()
+});
+var webhookTriggerSchema = z6.object({
+  type: z6.literal("webhook"),
+  path: z6.string().startsWith("/"),
+  method: z6.enum(["POST", "GET"]).optional()
+});
+var eventTriggerSchema = z6.object({
+  type: z6.literal("event"),
+  source: z6.string(),
+  event: z6.string()
+});
+var apiTriggerSchema = z6.object({ type: z6.literal("api") });
+var manualTriggerSchema = z6.object({ type: z6.literal("manual") });
+var triggerConfigSchema = z6.discriminatedUnion("type", [
+  cronTriggerSchema,
+  webhookTriggerSchema,
+  eventTriggerSchema,
+  apiTriggerSchema,
+  manualTriggerSchema
+]);
+
+// ../../../private-packages/platform-core/dist/types/platform-agent.js
+var thinkingLevelSchema = z7.enum(["low", "medium", "high"]);
+var logLevelSchema = z7.enum(["silent", "debug", "info", "warn", "error"]);
+var agentDefinitionSchema = z7.object({
+  name: z7.string().min(1),
+  model: z7.string().min(1),
+  instructions: z7.string().min(1),
+  description: z7.string().optional(),
+  skills: z7.array(z7.string()).optional(),
+  temperature: z7.number().min(0).max(2).optional(),
+  allowTemperatureOverride: z7.boolean().optional(),
+  maxOutputTokens: z7.number().int().positive().optional(),
+  thinkingLevel: thinkingLevelSchema.optional(),
+  logLevel: logLevelSchema.optional()
+}).strict();
+var platformAgentConfigSchema = z7.object({
+  agent: agentDefinitionSchema,
+  connectors: z7.array(z7.string()).optional(),
+  triggers: z7.array(triggerConfigSchema),
+  identity: identityConfigSchema.optional(),
+  resources: resourceLimitsSchema.optional(),
+  retries: retryPolicySchema.optional(),
+  concurrency: concurrencyPolicySchema.optional(),
+  fast: z7.boolean().optional(),
+  team: teamConfigSchema.optional(),
+  notifications: notificationConfigSchema.optional(),
+  environment: environmentSchema.optional(),
+  actions: z7.array(z7.string()).optional()
+}).strict().superRefine((data, ctx) => {
+  for (const member of data.team?.members ?? []) {
+    const valid = isQualified(member) ? isValidQualifiedName(member) : isValidPrimitiveName(member);
+    if (!valid) {
+      ctx.addIssue({
+        code: z7.ZodIssueCode.custom,
+        path: ["team", "members"],
+        message: `Invalid team member name: "${member}"`
+      });
+    }
+  }
+  for (const connector of data.connectors ?? []) {
+    const valid = isQualified(connector) ? isValidQualifiedName(connector) : isValidPrimitiveName(connector);
+    if (!valid) {
+      ctx.addIssue({
+        code: z7.ZodIssueCode.custom,
+        path: ["connectors"],
+        message: `Invalid connector name: "${connector}"`
+      });
+    }
+  }
+  for (const skill of data.agent.skills ?? []) {
+    const valid = isQualified(skill) ? isValidQualifiedSkillId(skill) : isValidSkillId(skill);
+    if (!valid) {
+      ctx.addIssue({
+        code: z7.ZodIssueCode.custom,
+        path: ["agent", "skills"],
+        message: `Invalid skill ID: "${skill}"`
+      });
+    }
+  }
+  for (const action of data.actions ?? []) {
+    const valid = isQualified(action) ? isValidQualifiedName(action) : isValidPrimitiveName(action);
+    if (!valid) {
+      ctx.addIssue({
+        code: z7.ZodIssueCode.custom,
+        path: ["actions"],
+        message: `Invalid action name: "${action}"`
+      });
+    }
+  }
+});
+
+// ../../../private-packages/platform-core/dist/types/skill.js
+import * as z8 from "zod";
+var platformSkillInputSchema = z8.object({
+  name: z8.string().min(1),
+  description: z8.string().optional()
+}).strict();
+
+// src/cli/validate.ts
 var MAX_SCHEMA_DEPTH = 20;
 var MAX_OBJECT_BREADTH = 200;
 var validateSchemaBundle = (bundle) => {
   for (const agent of bundle.agents) {
-    assertValidEntity("agent id", agent.id);
+    assertValidPrimitive("agent id", agent.id);
     validateJsonSchemaProperties("agent input schema", agent.input, 0);
     validateJsonSchemaProperties("agent output schema", agent.output, 0);
     if (agent.actions) {
       for (const [actionName, actionSchema] of Object.entries(agent.actions)) {
-        assertValidEntity("agent action name", actionName);
+        assertValidPrimitive("agent action name", actionName);
         validateJsonSchemaProperties("agent action schema", actionSchema, 0);
       }
     }
   }
   for (const query of bundle.queries) {
-    assertValidEntity("query name", query.name);
+    assertValidPrimitive("query name", query.name);
     validateJsonSchemaProperties("query params schema", query.params, 0);
     for (const col of query.columns) {
       assertValidProperty("query column name", col.name);
     }
   }
   for (const connector of bundle.connectors) {
-    assertValidEntity("connector id", connector.id);
+    assertValidPrimitive("connector id", connector.id);
     for (const tool of connector.tools) {
       assertValidTool("connector tool name", tool.name);
       validateJsonSchemaProperties("connector tool parameters", tool.parameters, 0);
     }
   }
   for (const pipeline of bundle.pipelines) {
-    assertValidEntity("pipeline name", pipeline.pipeline);
+    assertValidPrimitive("pipeline name", pipeline.pipeline);
     for (const query of pipeline.queries) {
-      assertValidEntity("pipeline query name", query.name);
+      assertValidPrimitive("pipeline query name", query.name);
       validatePipelineSchema("pipeline query params", query.params, 0);
       validatePipelineSchema("pipeline query returns", query.returns, 0);
     }
@@ -86,32 +506,34 @@ var validateSchemaBundle = (bundle) => {
   for (const skill of bundle.skills) {
     assertValidSkill("skill id", skill.id);
   }
+  for (const action of bundle.actions) {
+    assertValidPrimitive("action id", action.id);
+    validateJsonSchemaProperties("action schema", action.schema, 0);
+  }
 };
-var assertValidEntity = (entityType, value) => {
-  if (!isValidEntityName(value)) {
+var assertValidPrimitive = (label, value) => {
+  if (!isValidPrimitiveName(value) && !isValidQualifiedName(value)) {
     throw new Error(
-      `Invalid remote schema: ${entityType} "${value}". Must match ${ENTITY_NAME_REGEX}`
+      `Invalid remote schema: ${label} "${value}". Must match ${PRIMITIVE_NAME_REGEX} or repo/primitive format`
     );
   }
 };
-var assertValidTool = (entityType, value) => {
+var assertValidTool = (label, value) => {
   if (!isValidToolName(value)) {
-    throw new Error(
-      `Invalid remote schema: ${entityType} "${value}". Must match ${TOOL_NAME_REGEX}`
-    );
+    throw new Error(`Invalid remote schema: ${label} "${value}". Must match ${TOOL_NAME_REGEX}`);
   }
 };
-var assertValidProperty = (entityType, value) => {
+var assertValidProperty = (label, value) => {
   if (!isValidPropertyName(value)) {
     throw new Error(
-      `Invalid remote schema: ${entityType} "${value}". Must match ${PROPERTY_NAME_REGEX} and not be a forbidden property`
+      `Invalid remote schema: ${label} "${value}". Must match ${PROPERTY_NAME_REGEX} and not be a forbidden property`
     );
   }
 };
-var assertValidSkill = (entityType, value) => {
-  if (!isValidSkillId(value)) {
+var assertValidSkill = (label, value) => {
+  if (!isValidSkillId(value) && !isValidQualifiedSkillId(value)) {
     throw new Error(
-      `Invalid remote schema: ${entityType} "${value}". Must match ${SKILL_NAME_REGEX} (with optional .md extension)`
+      `Invalid remote schema: ${label} "${value}". Must match ${SKILL_NAME_REGEX} (with optional .md extension) or repo/skill format`
     );
   }
 };
@@ -197,14 +619,10 @@ var generateTypes = (schemas, projectRoot) => {
   if (!fs.existsSync(outDir)) {
     fs.mkdirSync(outDir, { recursive: true });
   }
-  const stalePipelinesTs = path.join(outDir, "pipelines.ts");
-  if (fs.existsSync(stalePipelinesTs)) {
-    fs.rmSync(stalePipelinesTs);
-    warn(
-      "Migrated: removed .kraken-ai/pipelines.ts. Pipeline schemas now in pipelines.json + pipelines.d.ts."
-    );
-  }
-  fs.writeFileSync(path.join(outDir, "agents.d.ts"), generateAgentsDts(schemas.agents));
+  fs.writeFileSync(
+    path.join(outDir, "agents.d.ts"),
+    generateAgentsDts(schemas.agents, schemas.actions)
+  );
   fs.writeFileSync(path.join(outDir, "queries.d.ts"), generateQueriesDts(schemas.queries));
   const connectorsDtsPath = path.join(outDir, "connectors.d.ts");
   if (schemas.connectors.length > 0) {
@@ -212,13 +630,20 @@ var generateTypes = (schemas, projectRoot) => {
   } else if (fs.existsSync(connectorsDtsPath)) {
     fs.rmSync(connectorsDtsPath);
   }
+  const actionsDtsPath = path.join(outDir, "actions.d.ts");
+  if (schemas.actions.length > 0) {
+    fs.writeFileSync(actionsDtsPath, generateActionsDts(schemas.actions));
+  } else if (fs.existsSync(actionsDtsPath)) {
+    fs.rmSync(actionsDtsPath);
+  }
   fs.writeFileSync(path.join(outDir, "pipelines.json"), generatePipelinesJson(schemas.pipelines));
   fs.writeFileSync(path.join(outDir, "pipelines.d.ts"), generatePipelinesDts(schemas.pipelines));
   const platformTypesDtsPath = path.join(outDir, "platform-types.d.ts");
   const platformTypesDts = generatePlatformTypesDts(
     schemas.agents,
     schemas.connectors,
-    schemas.skills
+    schemas.skills,
+    schemas.actions
   );
   if (platformTypesDts) {
     fs.writeFileSync(platformTypesDtsPath, platformTypesDts);
@@ -229,21 +654,25 @@ var generateTypes = (schemas, projectRoot) => {
     path.join(outDir, "index.d.ts"),
     generateIndexDts(
       schemas.connectors.length > 0,
+      schemas.actions.length > 0,
       schemas.pipelines.length > 0,
       platformTypesDts != null
     )
   );
   fs.writeFileSync(path.join(outDir, "manifest.json"), JSON.stringify(schemas, null, 2));
 };
-var generateAgentsDts = (agents) => {
+var generateAgentsDts = (agents, actions) => {
+  const actionsByName = new Map(actions.map((a) => [a.name, a]));
   const entries = agents.map((a) => {
     const input = jsonSchemaToTsType(a.input);
     const output = jsonSchemaToTsType(a.output);
-    const actions = generateActionsType(a.actions);
+    const hasInlineActions = a.actions && Object.keys(a.actions).length > 0;
+    const agentActions = hasInlineActions ? a.actions : buildAgentActionsFromRefs(a, actionsByName);
+    const actionsType = generateActionsType(agentActions);
     return `  "${a.id}": {
     input: ${input}
     output: ${output}
-    actions: ${actions}
+    actions: ${actionsType}
   }`;
   }).join("\n");
   return [
@@ -258,6 +687,19 @@ var generateAgentsDts = (agents) => {
     ``
   ].join("\n");
 };
+var buildAgentActionsFromRefs = (agent, actionsByName) => {
+  const actionNames = agent.config?.actions;
+  if (!actionNames || actionNames.length === 0) return void 0;
+  const result = {};
+  for (const name of actionNames) {
+    const bareName = name.includes("/") ? name.slice(name.indexOf("/") + 1) : name;
+    const actionSchema = actionsByName.get(bareName) ?? actionsByName.get(name);
+    if (actionSchema) {
+      result[name] = actionSchema.schema;
+    }
+  }
+  return Object.keys(result).length > 0 ? result : void 0;
+};
 var generateActionsType = (actions) => {
   if (!actions || Object.keys(actions).length === 0) {
     return "Record<string, never>";
@@ -265,6 +707,20 @@ var generateActionsType = (actions) => {
   const entries = Object.entries(actions).map(([name, schema]) => `"${name}": ${jsonSchemaToTsType(schema)}`).join("; ");
   return `{ ${entries} }`;
 };
+var generateActionsDts = (actions) => {
+  const entries = actions.map((a) => `    "${a.name}": ${jsonSchemaToTsType(a.schema)}`).join("\n");
+  return [
+    `// Auto-generated by \`kraken generate\` \u2014 do not edit manually`,
+    `export {};`,
+    ``,
+    `declare module "@kraken-ai/platform" {`,
+    `  interface ActionRegistry {`,
+    entries,
+    `  }`,
+    `}`,
+    ``
+  ].join("\n");
+};
 var generateQueriesDts = (queries) => {
   const entries = queries.map((q) => {
     const params = jsonSchemaToTsType(q.params);
@@ -301,7 +757,7 @@ ${entries}
 }
 `;
 };
-var generateIndexDts = (hasConnectors, hasPipelines, hasPlatformTypes) => {
+var generateIndexDts = (hasConnectors, hasActions, hasPipelines, hasPlatformTypes) => {
   let content = `// Auto-generated by \`kraken generate\` \u2014 do not edit manually
 
 /// <reference path="./agents.d.ts" />
@@ -309,6 +765,10 @@ export type { QueryRegistry } from "./queries"
 `;
   if (hasConnectors) {
     content += `export type { ConnectorId, ConnectorTools } from "./connectors"
+`;
+  }
+  if (hasActions) {
+    content += `/// <reference path="./actions.d.ts" />
 `;
   }
   if (hasPipelines) {
@@ -321,7 +781,7 @@ export type { QueryRegistry } from "./queries"
   }
   return content;
 };
-var generatePlatformTypesDts = (agents, connectors, skills) => {
+var generatePlatformTypesDts = (agents, connectors, skills, actions) => {
   const entries = [];
   if (agents.length > 0) {
     const ids = agents.map((a) => `"${a.id}"`).join(" | ");
@@ -335,6 +795,10 @@ var generatePlatformTypesDts = (agents, connectors, skills) => {
     const ids = skills.map((s) => `"${s.id}"`).join(" | ");
     entries.push(`    skillId: ${ids};`);
   }
+  if (actions.length > 0) {
+    const ids = actions.map((a) => `"${a.name}"`).join(" | ");
+    entries.push(`    actionId: ${ids};`);
+  }
   if (entries.length === 0) return null;
   return [
     `// Auto-generated by \`kraken generate\` \u2014 do not edit manually`,
@@ -514,168 +978,127 @@ var clearCredentials = () => {
 
 // src/cli/discover.ts
 import fs3 from "fs";
+import { createRequire } from "module";
 import path3 from "path";
 import { pathToFileURL } from "url";
-import * as z10 from "zod";
-
-// src/agents/types/action.ts
-import * as z from "zod";
-var actionVariantConfigSchema = z.object({
-  schema: z.record(z.string(), z.unknown()),
-  webhook: z.string().url().optional(),
-  hasHandler: z.boolean()
-});
-var actionsConfigSchema = z.object({
-  variants: z.record(z.string(), actionVariantConfigSchema)
-}).strict();
-
-// src/agents/types/environment.ts
-import * as z2 from "zod";
-var environmentSchema = z2.enum(["dev", "staging", "prod"]);
-
-// src/agents/types/identity.ts
-import * as z3 from "zod";
-var jitPolicySchema = z3.enum(["auto-approve", "policy-based", "require-approval"]);
-var identityConfigSchema = z3.object({
-  basePermissions: z3.array(z3.string()),
-  requestablePermissions: z3.array(z3.string()).optional(),
-  jitPolicy: jitPolicySchema.optional(),
-  maxJitDurationMinutes: z3.number().int().positive().optional()
-});
-
-// src/agents/types/notifications.ts
-import * as z4 from "zod";
-var notificationConfigSchema = z4.object({
-  slack: z4.string().optional(),
-  onSuccess: z4.boolean().optional(),
-  onFailure: z4.boolean().optional(),
-  onTimeout: z4.boolean().optional()
-});
+import * as z9 from "zod";
 
-// src/agents/types/platform-agent.ts
-import * as z8 from "zod";
+// src/cli/log.ts
+var supportsColor = !("NO_COLOR" in process.env) && process.env.FORCE_COLOR !== "0" && (process.stderr.isTTY ?? false);
+var code = (open, close) => {
+  const openStr = `\x1B[${open}m`;
+  const closeStr = `\x1B[${close}m`;
+  return (s) => supportsColor ? `${openStr}${s}${closeStr}` : s;
+};
+var bold = code(1, 22);
+var dim = code(2, 22);
+var red = code(31, 39);
+var yellow = code(33, 39);
+var green = code(32, 39);
+var cyan = code(36, 39);
+var warn = (msg) => {
+  process.stderr.write(`  ${dim("[kraken-ai:")} ${yellow("warn")}${dim("]")} ${msg}
+`);
+};
 
-// src/agents/types/resources.ts
-import * as z5 from "zod";
-var resourceLimitsSchema = z5.object({
-  maxTokens: z5.number().int().positive().optional(),
-  maxCostUsd: z5.number().positive().optional(),
-  timeoutSeconds: z5.number().int().positive().optional()
+// src/cli/discover.ts
+var MANIFEST_START = "---KRAKEN-MANIFEST-START---";
+var MANIFEST_END = "---KRAKEN-MANIFEST-END---";
+var skillEntrySchema = z9.object({
+  name: z9.string().min(1),
+  path: z9.string().min(1),
+  content: z9.string()
 });
-var retryPolicySchema = z5.object({
-  maxAttempts: z5.number().int().min(1).optional(),
-  backoffSeconds: z5.number().positive().optional()
+var toolSpecSchema = z9.object({
+  name: z9.string(),
+  description: z9.string(),
+  parameters: z9.record(z9.string(), z9.unknown()).default({}),
+  annotations: z9.object({
+    readOnlyHint: z9.boolean().optional(),
+    destructiveHint: z9.boolean().optional(),
+    idempotentHint: z9.boolean().optional()
+  }).optional()
 });
-var concurrencyPolicySchema = z5.object({
-  maxParallelRuns: z5.number().int().min(1).optional()
+var resourceSpecSchema = z9.object({
+  name: z9.string(),
+  uri: z9.string(),
+  description: z9.string(),
+  mimeType: z9.string().optional()
 });
-
-// src/agents/types/team.ts
-import * as z6 from "zod";
-var teamConfigSchema = z6.object({
-  members: z6.array(z6.string()).min(1),
-  maxConcurrentWorkers: z6.number().int().min(1).optional(),
-  maxTokenBudgetPerWorker: z6.number().int().positive().optional(),
-  maxDurationPerWorker: z6.number().positive().optional()
+var promptSpecSchema = z9.object({
+  name: z9.string(),
+  description: z9.string(),
+  arguments: z9.array(
+    z9.object({
+      name: z9.string(),
+      description: z9.string().optional(),
+      required: z9.boolean().optional()
+    })
+  ).optional()
 });
-
-// src/agents/types/trigger.ts
-import * as z7 from "zod";
-var cronTriggerSchema = z7.object({
-  type: z7.literal("cron"),
-  expression: z7.string(),
-  timezone: z7.string().optional()
-});
-var webhookTriggerSchema = z7.object({
-  type: z7.literal("webhook"),
-  path: z7.string().startsWith("/"),
-  method: z7.enum(["POST", "GET"]).optional()
-});
-var eventTriggerSchema = z7.object({
-  type: z7.literal("event"),
-  source: z7.string(),
-  event: z7.string()
+var connectorEntrySchema = z9.object({
+  name: z9.string().min(1),
+  path: z9.string().min(1),
+  toolSpecs: z9.array(toolSpecSchema).default([]),
+  resourceSpecs: z9.array(resourceSpecSchema).default([]),
+  promptSpecs: z9.array(promptSpecSchema).default([])
 });
-var apiTriggerSchema = z7.object({ type: z7.literal("api") });
-var manualTriggerSchema = z7.object({ type: z7.literal("manual") });
-var triggerConfigSchema = z7.discriminatedUnion("type", [
-  cronTriggerSchema,
-  webhookTriggerSchema,
-  eventTriggerSchema,
-  apiTriggerSchema,
-  manualTriggerSchema
-]);
-
-// src/agents/types/platform-agent.ts
-var thinkingLevelSchema = z8.enum(["low", "medium", "high"]);
-var logLevelSchema = z8.enum(["silent", "debug", "info", "warn", "error"]);
-var agentDefinitionSchema = z8.object({
-  name: z8.string().min(1),
-  model: z8.string().min(1),
-  instructions: z8.string().min(1),
-  description: z8.string().optional(),
-  skills: z8.array(z8.string()).optional(),
-  temperature: z8.number().min(0).max(2).optional(),
-  allowTemperatureOverride: z8.boolean().optional(),
-  maxOutputTokens: z8.number().int().positive().optional(),
-  thinkingLevel: thinkingLevelSchema.optional(),
-  logLevel: logLevelSchema.optional()
-}).strict();
-var platformAgentConfigSchema = z8.object({
-  agent: agentDefinitionSchema,
-  connectors: z8.array(z8.string()).optional(),
-  triggers: z8.array(triggerConfigSchema),
-  identity: identityConfigSchema.optional(),
-  resources: resourceLimitsSchema.optional(),
-  retries: retryPolicySchema.optional(),
-  concurrency: concurrencyPolicySchema.optional(),
-  team: teamConfigSchema.optional(),
-  notifications: notificationConfigSchema.optional(),
-  environment: environmentSchema.optional(),
-  actions: actionsConfigSchema.optional()
-}).strict();
-
-// src/agents/types/skill.ts
-import * as z9 from "zod";
-var platformSkillInputSchema = z9.object({
+var agentEntrySchema = z9.object({
   name: z9.string().min(1),
-  description: z9.string().optional()
-}).strict();
-
-// src/cli/discover.ts
-var MANIFEST_START = "---KRAKEN-MANIFEST-START---";
-var MANIFEST_END = "---KRAKEN-MANIFEST-END---";
-var skillEntrySchema = z10.object({
-  name: z10.string().min(1),
-  path: z10.string().min(1),
-  content: z10.string()
+  entryPoint: z9.string().min(1),
+  config: platformAgentConfigSchema
 });
-var connectorEntrySchema = z10.object({
-  name: z10.string().min(1),
-  path: z10.string().min(1)
+var actionConfigSchema = z9.object({
+  schema: z9.record(z9.string(), z9.unknown()),
+  webhook: z9.string().url().optional(),
+  hasHandler: z9.boolean()
 });
-var agentEntrySchema = z10.object({
-  name: z10.string().min(1),
-  entryPoint: z10.string().min(1),
-  config: platformAgentConfigSchema
+var actionEntrySchema = z9.object({
+  name: z9.string().min(1),
+  entryPoint: z9.string().min(1),
+  config: actionConfigSchema
 });
-var projectManifestSchema = z10.object({
-  agents: z10.array(agentEntrySchema),
-  skills: z10.array(skillEntrySchema),
-  connectors: z10.array(connectorEntrySchema)
+var projectManifestSchema = z9.object({
+  agents: z9.array(agentEntrySchema),
+  skills: z9.array(skillEntrySchema),
+  connectors: z9.array(connectorEntrySchema),
+  actions: z9.array(actionEntrySchema).default([])
 });
 var isTsxAvailable = () => process.env.NODE_OPTIONS?.includes("tsx") === true;
+var tsxLoaded = false;
+var ensureTsxLoader = async (projectRoot) => {
+  if (isTsxAvailable() || tsxLoaded) return true;
+  if (!fs3.existsSync(path3.join(projectRoot, "node_modules", "tsx"))) return false;
+  try {
+    const require2 = createRequire(path3.join(projectRoot, "package.json"));
+    const tsxEsmPath = require2.resolve("tsx/esm");
+    await import(pathToFileURL(tsxEsmPath).href);
+    tsxLoaded = true;
+    return true;
+  } catch {
+    return false;
+  }
+};
 var isPlatformAgentExport = (value) => value != null && typeof value === "object" && value.__type === "PlatformAgent" && "config" in value;
 var discoverAgents = async (projectRoot) => {
   const distAgentsDir = path3.join(projectRoot, "dist", "agents");
   const useDistAgents = fs3.existsSync(distAgentsDir) && fs3.statSync(distAgentsDir).isDirectory();
-  const agentsDir = useDistAgents ? distAgentsDir : path3.join(projectRoot, "agents");
-  const agentsDirPrefix = useDistAgents ? "dist/agents" : "agents";
+  const agentsDir = useDistAgents ? distAgentsDir : path3.join(projectRoot, "src", "agents");
+  const agentsDirPrefix = useDistAgents ? "dist/agents" : "src/agents";
   if (!fs3.existsSync(agentsDir) || !fs3.statSync(agentsDir).isDirectory()) {
     return [];
   }
-  const tsxEnabled = isTsxAvailable();
-  const files = fs3.readdirSync(agentsDir).filter((f) => f.endsWith(".js") || f.endsWith(".mjs") || tsxEnabled && f.endsWith(".ts")).sort();
+  const tsxEnabled = await ensureTsxLoader(projectRoot);
+  const allFiles = fs3.readdirSync(agentsDir);
+  const files = allFiles.filter((f) => f.endsWith(".js") || f.endsWith(".mjs") || tsxEnabled && f.endsWith(".ts")).sort();
+  if (!tsxEnabled) {
+    const skippedTs = allFiles.filter((f) => f.endsWith(".ts"));
+    if (skippedTs.length > 0) {
+      warn(
+        `Found ${String(skippedTs.length)} .ts agent file(s) but tsx is not available. Install tsx as a devDependency or build your project first.`
+      );
+    }
+  }
   const seen = /* @__PURE__ */ new Map();
   for (const file of files) {
     const filePath = path3.join(agentsDir, file);
@@ -698,7 +1121,7 @@ var discoverAgents = async (projectRoot) => {
 };
 var MAX_SKILL_SIZE = 100 * 1024;
 var discoverSkills = (projectRoot) => {
-  const skillsDir = path3.join(projectRoot, "skills");
+  const skillsDir = path3.join(projectRoot, "src", "skills");
   if (!fs3.existsSync(skillsDir) || !fs3.statSync(skillsDir).isDirectory()) {
     return [];
   }
@@ -706,41 +1129,111 @@ var discoverSkills = (projectRoot) => {
   const skills = [];
   for (const file of files) {
     if (!file.endsWith(".md")) {
-      warn(`Skipping skills/${file}: skill files must have a .md extension.`);
+      warn(`Skipping src/skills/${file}: skill files must have a .md extension.`);
       continue;
     }
     const basename = file.replace(/\.md$/, "");
     if (!isValidSkillName(basename)) {
       warn(
-        `Skipping skills/${file}: name must match [a-zA-Z0-9-] (letters, digits, hyphens only).`
+        `Skipping src/skills/${file}: name must match [a-zA-Z0-9-] (letters, digits, hyphens only).`
       );
       continue;
     }
     const filePath = path3.join(skillsDir, file);
     const stat = fs3.statSync(filePath);
     if (stat.size > MAX_SKILL_SIZE) {
-      warn(`Skipping skills/${file}: exceeds ${MAX_SKILL_SIZE} byte limit.`);
+      warn(`Skipping src/skills/${file}: exceeds ${MAX_SKILL_SIZE} byte limit.`);
       continue;
     }
     const content = fs3.readFileSync(filePath, "utf-8");
-    skills.push({ name: file, path: `skills/${file}`, content });
+    skills.push({ name: file, path: `src/skills/${file}`, content });
   }
   return skills;
 };
-var discoverConnectors = (projectRoot) => {
+var isPlatformConnectorExport = (value) => value != null && typeof value === "object" && value.__type === "PlatformConnector";
+var serializeToolParameters = (input) => {
+  try {
+    return z9.toJSONSchema(input, { target: "draft-2020-12" });
+  } catch {
+    warn("Failed to serialize tool parameters via z.toJSONSchema(); falling back to {}");
+    return {};
+  }
+};
+var extractConnectorSpecs = (conn) => {
+  const toolSpecs = [];
+  if (conn.tools) {
+    for (const [name, tool] of Object.entries(conn.tools)) {
+      const spec = {
+        name,
+        description: tool.description,
+        parameters: serializeToolParameters(tool.input)
+      };
+      if (tool.annotations) {
+        const { readOnlyHint, destructiveHint, idempotentHint } = tool.annotations;
+        if (readOnlyHint !== void 0 || destructiveHint !== void 0 || idempotentHint !== void 0) {
+          spec.annotations = {
+            ...readOnlyHint !== void 0 ? { readOnlyHint } : {},
+            ...destructiveHint !== void 0 ? { destructiveHint } : {},
+            ...idempotentHint !== void 0 ? { idempotentHint } : {}
+          };
+        }
+      }
+      toolSpecs.push(spec);
+    }
+  }
+  const resourceSpecs = [];
+  if (conn.resources) {
+    for (const [name, resource] of Object.entries(conn.resources)) {
+      const spec = {
+        name,
+        uri: resource.uri,
+        description: resource.description
+      };
+      if (resource.mimeType) {
+        spec.mimeType = resource.mimeType;
+      }
+      resourceSpecs.push(spec);
+    }
+  }
+  const promptSpecs = [];
+  if (conn.prompts) {
+    for (const [name, prompt] of Object.entries(conn.prompts)) {
+      const spec = {
+        name,
+        description: prompt.description
+      };
+      if (prompt.arguments) {
+        spec.arguments = [...prompt.arguments];
+      }
+      promptSpecs.push(spec);
+    }
+  }
+  return { toolSpecs, resourceSpecs, promptSpecs };
+};
+var findConnectorEntryPoint = (connDir, tsxEnabled) => {
+  const candidates = ["index.js", "index.mjs"];
+  if (tsxEnabled) candidates.push("index.ts");
+  for (const candidate of candidates) {
+    const filePath = path3.join(connDir, candidate);
+    if (fs3.existsSync(filePath)) return filePath;
+  }
+  return void 0;
+};
+var discoverConnectors = async (projectRoot) => {
   const distConnectorsDir = path3.join(projectRoot, "dist", "connectors");
   const useDistConnectors = fs3.existsSync(distConnectorsDir) && fs3.statSync(distConnectorsDir).isDirectory();
-  const connectorsDir = useDistConnectors ? distConnectorsDir : path3.join(projectRoot, "connectors");
-  const connectorsDirPrefix = useDistConnectors ? "dist/connectors" : "connectors";
+  const connectorsDir = useDistConnectors ? distConnectorsDir : path3.join(projectRoot, "src", "connectors");
+  const connectorsDirPrefix = useDistConnectors ? "dist/connectors" : "src/connectors";
   if (!fs3.existsSync(connectorsDir) || !fs3.statSync(connectorsDir).isDirectory()) {
     return [];
   }
+  const tsxEnabled = await ensureTsxLoader(projectRoot);
   const entries = fs3.readdirSync(connectorsDir, { withFileTypes: true });
   const connectors = [];
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
     const name = entry.name;
-    if (!isValidEntityName(name)) {
+    if (!isValidPrimitiveName(name)) {
       warn(
         `Skipping ${connectorsDirPrefix}/${name}: name must match [a-z0-9-] (lowercase, digits, hyphens only).`
       );
@@ -755,23 +1248,109 @@ var discoverConnectors = (projectRoot) => {
     if (!hasPackageJson && !hasDockerfile && !hasIndexJs && !hasIndexMjs && !hasIndexTs) {
       continue;
     }
-    connectors.push({ name, path: `${connectorsDirPrefix}/${name}/` });
+    const connectorPath = `${connectorsDirPrefix}/${name}/`;
+    const entryPoint = findConnectorEntryPoint(connDir, tsxEnabled);
+    if (!entryPoint) {
+      connectors.push({
+        name,
+        path: connectorPath,
+        toolSpecs: [],
+        resourceSpecs: [],
+        promptSpecs: []
+      });
+      continue;
+    }
+    try {
+      const mod = await import(pathToFileURL(entryPoint).href);
+      const exported = mod.default;
+      if (isPlatformConnectorExport(exported)) {
+        const specs = extractConnectorSpecs(exported);
+        connectors.push({ name, path: connectorPath, ...specs });
+      } else {
+        connectors.push({
+          name,
+          path: connectorPath,
+          toolSpecs: [],
+          resourceSpecs: [],
+          promptSpecs: []
+        });
+      }
+    } catch (err) {
+      warn(
+        `Skipping introspection for ${connectorsDirPrefix}/${name}: ${err instanceof Error ? err.message : String(err)}`
+      );
+      connectors.push({
+        name,
+        path: connectorPath,
+        toolSpecs: [],
+        resourceSpecs: [],
+        promptSpecs: []
+      });
+    }
   }
   return connectors.sort((a, b) => a.name.localeCompare(b.name));
 };
+var isPlatformActionExport = (value) => value != null && typeof value === "object" && value.__type === "PlatformAction" && "name" in value && "config" in value;
+var discoverActions = async (projectRoot) => {
+  const distActionsDir = path3.join(projectRoot, "dist", "actions");
+  const useDistActions = fs3.existsSync(distActionsDir) && fs3.statSync(distActionsDir).isDirectory();
+  const actionsDir = useDistActions ? distActionsDir : path3.join(projectRoot, "src", "actions");
+  const actionsDirPrefix = useDistActions ? "dist/actions" : "src/actions";
+  if (!fs3.existsSync(actionsDir) || !fs3.statSync(actionsDir).isDirectory()) {
+    return [];
+  }
+  const tsxEnabled = await ensureTsxLoader(projectRoot);
+  const allFiles = fs3.readdirSync(actionsDir);
+  const files = allFiles.filter((f) => f.endsWith(".js") || f.endsWith(".mjs") || tsxEnabled && f.endsWith(".ts")).sort();
+  if (!tsxEnabled) {
+    const skippedTs = allFiles.filter((f) => f.endsWith(".ts"));
+    if (skippedTs.length > 0) {
+      warn(
+        `Found ${String(skippedTs.length)} .ts action file(s) but tsx is not available. Install tsx as a devDependency or build your project first.`
+      );
+    }
+  }
+  const seen = /* @__PURE__ */ new Map();
+  for (const file of files) {
+    const filePath = path3.join(actionsDir, file);
+    try {
+      const mod = await import(pathToFileURL(filePath).href);
+      const exported = mod.default;
+      if (isPlatformActionExport(exported) && !seen.has(exported.name)) {
+        if (!isValidPrimitiveName(exported.name)) {
+          warn(
+            `Skipping ${actionsDirPrefix}/${file}: action name "${exported.name}" must match [a-z0-9-] (lowercase, digits, hyphens only).`
+          );
+          continue;
+        }
+        seen.set(exported.name, {
+          name: exported.name,
+          entryPoint: `${actionsDirPrefix}/${file}`,
+          config: exported.config
+        });
+      }
+    } catch (err) {
+      warn(
+        `Skipping ${actionsDirPrefix}/${file}: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+  return [...seen.values()];
+};
 var discoverProject = async (projectRoot) => {
   const discovered = await discoverAgents(projectRoot);
   const agents = [];
   for (const { config, entryPoint } of discovered) {
     const name = config.agent.name;
-    if (!isValidEntityName(name)) {
-      throw new Error(`Invalid agent name: "${name}". Names must match ${ENTITY_NAME_REGEX}`);
+    if (!isValidPrimitiveName(name)) {
+      throw new Error(`Invalid agent name: "${name}". Names must match ${PRIMITIVE_NAME_REGEX}`);
     }
     agents.push({ name, entryPoint, config });
   }
   const skills = discoverSkills(projectRoot);
-  const connectors = discoverConnectors(projectRoot);
-  return { agents, skills, connectors };
+  const connectors = await discoverConnectors(projectRoot);
+  const actions = await discoverActions(projectRoot);
+  return { agents, skills, connectors, actions };
 };
 var emitManifest = (manifest) => {
   process.stdout.write(`${MANIFEST_START}
@@ -840,52 +1419,58 @@ var pick = async (label, items) => {
 };
 
 // src/platform/types.ts
-import * as z11 from "zod";
-var jsonSchemaValue = z11.record(z11.string(), z11.unknown());
-var agentSchemaValidator = z11.object({
-  id: z11.string(),
-  name: z11.string(),
+import * as z10 from "zod";
+var jsonSchemaValue = z10.record(z10.string(), z10.unknown());
+var agentSchemaValidator = z10.object({
+  id: z10.string(),
+  name: z10.string(),
   input: jsonSchemaValue,
   output: jsonSchemaValue,
-  actions: z11.record(z11.string(), jsonSchemaValue).optional()
+  actions: z10.record(z10.string(), jsonSchemaValue).optional()
 }).passthrough();
-var queryColumnValidator = z11.object({
-  name: z11.string(),
-  type: z11.string(),
-  description: z11.string().optional()
+var queryColumnValidator = z10.object({
+  name: z10.string(),
+  type: z10.string(),
+  description: z10.string().optional()
 }).passthrough();
-var querySchemaValidator = z11.object({
-  name: z11.string(),
+var querySchemaValidator = z10.object({
+  name: z10.string(),
   params: jsonSchemaValue,
-  columns: z11.array(queryColumnValidator)
+  columns: z10.array(queryColumnValidator)
 }).passthrough();
-var connectorToolValidator = z11.object({
-  name: z11.string(),
-  description: z11.string(),
+var connectorToolValidator = z10.object({
+  name: z10.string(),
+  description: z10.string(),
   parameters: jsonSchemaValue
 }).passthrough();
-var connectorSchemaValidator = z11.object({
-  id: z11.string(),
-  tools: z11.array(connectorToolValidator)
+var connectorSchemaValidator = z10.object({
+  id: z10.string(),
+  tools: z10.array(connectorToolValidator)
 }).passthrough();
-var skillSchemaValidator = z11.object({
-  id: z11.string(),
-  name: z11.string(),
-  description: z11.string().optional()
+var skillSchemaValidator = z10.object({
+  id: z10.string(),
+  name: z10.string(),
+  description: z10.string().optional()
 }).passthrough();
-var pipelineQuerySchemaValidator = z11.object({
-  name: z11.string(),
-  description: z11.string(),
+var actionSchemaValidator = z10.object({
+  id: z10.string(),
+  name: z10.string(),
+  schema: z10.record(z10.string(), z10.unknown()),
+  hasHandler: z10.boolean()
+}).passthrough();
+var pipelineQuerySchemaValidator = z10.object({
+  name: z10.string(),
+  description: z10.string(),
   params: jsonSchemaValue,
   returns: jsonSchemaValue
 }).passthrough();
-var pipelineSchemaValidator = z11.object({
-  pipeline: z11.string(),
-  queries: z11.array(pipelineQuerySchemaValidator)
+var pipelineSchemaValidator = z10.object({
+  pipeline: z10.string(),
+  queries: z10.array(pipelineQuerySchemaValidator)
 }).passthrough();
 
 // src/cli.ts
-var COMMANDS = /* @__PURE__ */ new Set(["login", "generate", "logout", "discover", "init", "dev"]);
+var COMMANDS = /* @__PURE__ */ new Set(["login", "generate", "logout", "discover", "dev", "api-keys"]);
 var parseArgs = (args) => {
   const command = args[0];
   if (!command || command === "--help" || !COMMANDS.has(command)) {
@@ -915,16 +1500,15 @@ var parseArgs = (args) => {
 var runCommand = async (parsed, deps) => {
   switch (parsed.command) {
     case "login":
-      await handleLogin(parsed, deps);
-      return 0;
+      return handleLogin(parsed, deps);
     case "generate":
       return handleGenerate(parsed, deps);
     case "dev":
       return handleDev(parsed, deps);
+    case "api-keys":
+      return handleApiKeys(parsed, deps);
     case "discover":
       return handleDiscover(parsed, deps);
-    case "init":
-      return handleInit(parsed, deps);
     case "logout":
       handleLogout(deps);
       return 0;
@@ -935,29 +1519,131 @@ var runCommand = async (parsed, deps) => {
       return 0;
   }
 };
+var DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+var LOGIN_TIMEOUT_MS = 16 * 60 * 1e3;
+var MAX_TRANSIENT_FAILURES = 3;
 var handleLogin = async (parsed, deps) => {
-  const url = parsed.flags.url ?? await deps.prompt("Platform URL: ");
-  const key = parsed.flags.key ?? await deps.prompt("API Key: ");
-  if (!url || !key) {
-    deps.log("Error: both URL and API key are required.");
-    return;
+  const baseUrl = parsed.flags.url ?? await deps.prompt("Platform URL: ");
+  if (!baseUrl || !/^https?:\/\//.test(baseUrl)) {
+    deps.log("Error: a valid HTTP(S) URL is required.");
+    return 1;
   }
-  deps.saveCredentials({ baseUrl: url, apiKey: key });
-  deps.log(`Credentials saved. Connected to ${url}`);
+  let deviceCodeRes;
+  try {
+    const res = await deps.fetch(`${baseUrl}/api/cli/device-code`, { method: "POST" });
+    if (!res.ok) {
+      deps.log(`Error: device code request failed (HTTP ${String(res.status)})`);
+      return 1;
+    }
+    deviceCodeRes = await res.json();
+  } catch (err) {
+    deps.log(
+      `Error: could not reach ${baseUrl} \u2014 ${err instanceof Error ? err.message : String(err)}`
+    );
+    return 1;
+  }
+  const { deviceCode, verificationUri, userCode } = deviceCodeRes;
+  if (!deviceCode || !verificationUri || !userCode || deviceCodeRes.interval == null) {
+    deps.log("Error: invalid device code response from server.");
+    return 1;
+  }
+  deps.log(`
+  Your device code: ${bold(userCode)}
+`);
+  deps.log(`  Opening ${verificationUri}`);
+  deps.log(`  ${dim("If the browser doesn't open, visit the URL manually.")}
+`);
+  void deps.openUrl(verificationUri).catch(() => {
+  });
+  let interval = deviceCodeRes.interval;
+  const deadline = Date.now() + LOGIN_TIMEOUT_MS;
+  let transientFailures = 0;
+  while (Date.now() < deadline) {
+    await sleep(interval * 1e3);
+    let tokenRes;
+    try {
+      const res = await deps.fetch(`${baseUrl}/api/cli/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ deviceCode, grant_type: DEVICE_CODE_GRANT_TYPE })
+      });
+      if (res.status >= 500) {
+        transientFailures++;
+        if (transientFailures >= MAX_TRANSIENT_FAILURES) {
+          deps.log("Error: server returned repeated errors. Please try again later.");
+          return 1;
+        }
+        continue;
+      }
+      const contentType = res.headers.get("content-type") ?? "";
+      if (!contentType.includes("json")) {
+        transientFailures++;
+        if (transientFailures >= MAX_TRANSIENT_FAILURES) {
+          deps.log("Error: server returned unexpected response format.");
+          return 1;
+        }
+        continue;
+      }
+      tokenRes = await res.json();
+      transientFailures = 0;
+    } catch {
+      transientFailures++;
+      if (transientFailures >= MAX_TRANSIENT_FAILURES) {
+        deps.log("Error: could not reach server. Please check your network and try again.");
+        return 1;
+      }
+      continue;
+    }
+    if (tokenRes.error === "authorization_pending") {
+      continue;
+    }
+    if (tokenRes.error === "slow_down") {
+      interval += 5;
+      continue;
+    }
+    if (tokenRes.error === "access_denied") {
+      deps.log("Authorization denied.");
+      return 1;
+    }
+    if (tokenRes.error === "expired_token") {
+      deps.log("Device code expired. Please run `kraken login` again.");
+      return 1;
+    }
+    if (tokenRes.accessToken) {
+      deps.saveCredentials({ apiKey: tokenRes.accessToken, baseUrl });
+      const who = tokenRes.user?.email ? ` as ${tokenRes.user.email}` : "";
+      deps.log(`Logged in${who}. Credentials saved.`);
+      return 0;
+    }
+    deps.log(`Error: ${tokenRes.error ?? "unknown error"}`);
+    return 1;
+  }
+  deps.log("Error: login timed out. Please try again.");
+  return 1;
 };
+var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 var emptySchemaBundle = {
   agents: [],
   queries: [],
   connectors: [],
   pipelines: [],
-  skills: []
+  skills: [],
+  actions: []
 };
 var fetchRemoteSchemas = async (creds, deps) => {
-  const headers = { Authorization: `Bearer ${creds.apiKey}` };
+  const apiKey = new SecretString(creds.apiKey);
+  const headers = { Authorization: `Bearer ${unwrapSecret(apiKey)}` };
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), 1e4);
   try {
-    const endpoints = ["agents", "queries", "connectors", "pipelines", "skills"];
+    const endpoints = [
+      "agents",
+      "queries",
+      "connectors",
+      "pipelines",
+      "skills",
+      "actions"
+    ];
     const responses = await Promise.all(
       endpoints.map(
         (ep) => deps.fetch(`${creds.baseUrl}/api/v1/schema/${ep}`, { headers, signal: controller.signal }).then(async (res) => {
@@ -968,26 +1654,27 @@ var fetchRemoteSchemas = async (creds, deps) => {
         }).catch(() => null)
       )
     );
-    const [agentsRes, queriesRes, connectorsRes, pipelinesRes, skillsRes] = responses;
+    const [agentsRes, queriesRes, connectorsRes, pipelinesRes, skillsRes, actionsRes] = responses;
     const allFailed = responses.every((r) => !r?.ok);
     if (allFailed) {
       warn(`Could not reach platform at ${creds.baseUrl}. Generating from local definitions only.`);
-      return emptySchemaBundle;
+      return { bundle: emptySchemaBundle, reachable: false };
     }
-    const agents = parseEndpointData(agentsRes, z12.array(agentSchemaValidator), "agents");
-    const queries = parseEndpointData(queriesRes, z12.array(querySchemaValidator), "queries");
+    const agents = parseEndpointData(agentsRes, z11.array(agentSchemaValidator), "agents");
+    const queries = parseEndpointData(queriesRes, z11.array(querySchemaValidator), "queries");
     const connectors = parseEndpointData(
       connectorsRes,
-      z12.array(connectorSchemaValidator),
+      z11.array(connectorSchemaValidator),
       "connectors"
     );
     const pipelines = parseEndpointData(
       pipelinesRes,
-      z12.array(pipelineSchemaValidator),
+      z11.array(pipelineSchemaValidator),
       "pipelines"
     );
-    const skills = parseEndpointData(skillsRes, z12.array(skillSchemaValidator), "skills");
-    return { agents, queries, connectors, pipelines, skills };
+    const skills = parseEndpointData(skillsRes, z11.array(skillSchemaValidator), "skills");
+    const actions = parseEndpointData(actionsRes, z11.array(actionSchemaValidator), "actions");
+    return { bundle: { agents, queries, connectors, pipelines, skills, actions }, reachable: true };
   } finally {
     clearTimeout(timeout);
   }
@@ -998,24 +1685,85 @@ var parseEndpointData = (res, validator, endpointName) => {
   const result = validator.safeParse(data);
   if (!result.success) {
     throw new Error(
-      `Invalid remote schema from ${endpointName} endpoint: ${z12.prettifyError(result.error)}`
+      `Invalid remote schema from ${endpointName} endpoint: ${z11.prettifyError(result.error)}`
     );
   }
   return result.data;
 };
-var mergeLocalAndRemote = (local, remote) => {
-  const remoteAgentIds = new Set(remote.agents.map((a) => a.id));
-  const remoteConnectorIds = new Set(remote.connectors.map((c) => c.id));
-  const remoteSkillIds = new Set(remote.skills.map((s) => s.id));
-  const localAgents = local.agents.filter((a) => !remoteAgentIds.has(a.name)).map((a) => ({ id: a.name, name: a.name, input: {}, output: {} }));
-  const localSkills = local.skills.filter((s) => !remoteSkillIds.has(s.name)).map((s) => ({ id: s.name, name: s.name }));
-  const localConnectors = local.connectors.filter((c) => !remoteConnectorIds.has(c.name)).map((c) => ({ id: c.name, tools: [] }));
+var execFileAsync = promisify(execFile);
+var parseGitRemoteFullName = (url) => {
+  const match = url.match(/[:/]([^/:]+\/[^/.]+?)(?:\.git)?\s*$/);
+  return match?.[1] ?? null;
+};
+var getGitRemoteFullName = async (cwd) => {
+  try {
+    const { stdout } = await execFileAsync("git", ["remote", "get-url", "origin"], { cwd });
+    return parseGitRemoteFullName(stdout.trim());
+  } catch {
+    return null;
+  }
+};
+var resolveRepoName = async (fullName, creds, deps) => {
+  const apiKey = new SecretString(creds.apiKey);
+  try {
+    const res = await deps.fetch(
+      `${creds.baseUrl}/api/v1/schema/repo-name?fullName=${encodeURIComponent(fullName)}`,
+      { headers: { Authorization: `Bearer ${unwrapSecret(apiKey)}` } }
+    );
+    if (!res.ok) return null;
+    const data = await res.json();
+    return data.name;
+  } catch {
+    return null;
+  }
+};
+var mergeLocalAndRemote = (local, remote, repoName) => {
+  const localAgentNames = new Set(local.agents.map((a) => a.name));
+  const localConnectorNames = new Set(local.connectors.map((c) => c.name));
+  const localSkillNames = new Set(local.skills.map((s) => s.name));
+  const localActionNames = new Set(local.actions.map((a) => a.name));
+  const localAgents = local.agents.map((a) => ({
+    id: a.name,
+    name: a.name,
+    input: {},
+    output: {},
+    config: a.config
+  }));
+  const localSkills = local.skills.map((s) => ({
+    id: s.name,
+    name: s.name
+  }));
+  const localConnectors = local.connectors.map((c) => ({
+    id: c.name,
+    tools: []
+  }));
+  const localActions = local.actions.map((a) => ({
+    id: a.name,
+    name: a.name,
+    schema: a.config.schema,
+    hasHandler: a.config.hasHandler
+  }));
+  const isSameRepoLocal = (remoteId, localNames) => {
+    const slashIdx = remoteId.indexOf("/");
+    if (slashIdx === -1) return localNames.has(remoteId);
+    const remoteRepo = remoteId.slice(0, slashIdx);
+    const bareName = remoteId.slice(slashIdx + 1);
+    if (!localNames.has(bareName)) return false;
+    return repoName !== null && remoteRepo === repoName;
+  };
+  const remoteOnlyAgents = remote.agents.filter((a) => !isSameRepoLocal(a.id, localAgentNames));
+  const remoteOnlyConnectors = remote.connectors.filter(
+    (c) => !isSameRepoLocal(c.id, localConnectorNames)
+  );
+  const remoteOnlySkills = remote.skills.filter((s) => !isSameRepoLocal(s.id, localSkillNames));
+  const remoteOnlyActions = remote.actions.filter((a) => !isSameRepoLocal(a.id, localActionNames));
   return {
-    agents: [...remote.agents, ...localAgents],
+    agents: [...localAgents, ...remoteOnlyAgents],
     queries: remote.queries,
-    connectors: [...remote.connectors, ...localConnectors],
+    connectors: [...localConnectors, ...remoteOnlyConnectors],
     pipelines: remote.pipelines,
-    skills: [...remote.skills, ...localSkills]
+    skills: [...localSkills, ...remoteOnlySkills],
+    actions: [...localActions, ...remoteOnlyActions]
   };
 };
 var handleGenerate = async (parsed, deps) => {
@@ -1029,22 +1777,30 @@ var handleGenerate = async (parsed, deps) => {
   }
   const creds = deps.loadCredentials();
   let remote;
+  let remoteReachable = false;
+  let repoName = null;
   if (creds?.apiKey && creds?.baseUrl) {
     try {
-      remote = await fetchRemoteSchemas(creds, deps);
+      const result = await fetchRemoteSchemas(creds, deps);
+      remote = result.bundle;
+      remoteReachable = result.reachable;
     } catch (err) {
       deps.log(
         `Error fetching remote schemas: ${err instanceof Error ? err.message : String(err)}`
       );
       return 1;
     }
+    const fullName = await getGitRemoteFullName(outDir);
+    if (fullName) {
+      repoName = await resolveRepoName(fullName, creds, deps);
+    }
   } else {
     warn(
       "Not logged in. Generating from local definitions only. Run `kraken login` to sync with the platform."
     );
     remote = emptySchemaBundle;
   }
-  const bundle = mergeLocalAndRemote(manifest, remote);
+  const bundle = mergeLocalAndRemote(manifest, remote, repoName);
   if ("check" in parsed.flags) {
     const { mkdtempSync, readFileSync, rmSync } = await import("fs");
     const { join } = await import("path");
@@ -1061,11 +1817,10 @@ var handleGenerate = async (parsed, deps) => {
       const files = [
         "pipelines.json",
         "pipelines.d.ts",
-        "pipelines.ts",
-        // stale file detection — should not exist after migration
         "agents.d.ts",
         "queries.d.ts",
         "connectors.d.ts",
+        "actions.d.ts",
         "platform-types.d.ts",
         "index.d.ts",
         "manifest.json"
@@ -1097,9 +1852,49 @@ var handleGenerate = async (parsed, deps) => {
     deps.log(`Error generating types: ${err instanceof Error ? err.message : String(err)}`);
     return 1;
   }
-  const localCount = manifest.agents.length + manifest.skills.length + manifest.connectors.length;
-  const remoteCount = remote.agents.length + remote.connectors.length + remote.skills.length;
-  deps.log(`Generated types for ${localCount} local + ${remoteCount} remote entities.`);
+  const localNames = {
+    agents: new Set(manifest.agents.map((a) => a.name)),
+    connectors: new Set(manifest.connectors.map((c) => c.name)),
+    skills: new Set(manifest.skills.map((s) => s.name)),
+    actions: new Set(manifest.actions.map((a) => a.name))
+  };
+  const matchesLocalSummary = (remoteId, names) => {
+    const slashIdx = remoteId.indexOf("/");
+    if (slashIdx !== -1) {
+      return names.has(remoteId.slice(slashIdx + 1));
+    }
+    return names.has(remoteId);
+  };
+  const remoteOnlyAgents = remote.agents.filter(
+    (a) => !matchesLocalSummary(a.id, localNames.agents)
+  );
+  const remoteOnlyConnectors = remote.connectors.filter(
+    (c) => !matchesLocalSummary(c.id, localNames.connectors)
+  );
+  const remoteOnlySkills = remote.skills.filter(
+    (s) => !matchesLocalSummary(s.id, localNames.skills)
+  );
+  const remoteOnlyActions = remote.actions.filter(
+    (a) => !matchesLocalSummary(a.id, localNames.actions)
+  );
+  const lines = [];
+  lines.push(`  ${dim("[kraken-ai]")} ${bold("Generated types:")}`);
+  for (const a of manifest.agents) lines.push(`  agent        ${a.name}`);
+  for (const a of remoteOnlyAgents) lines.push(`  agent        ${a.id} (remote)`);
+  for (const c of manifest.connectors) lines.push(`  connector    ${c.name}`);
+  for (const c of remoteOnlyConnectors) lines.push(`  connector    ${c.id} (remote)`);
+  for (const s of manifest.skills) lines.push(`  skill        ${s.name}`);
+  for (const s of remoteOnlySkills) lines.push(`  skill        ${s.id} (remote)`);
+  for (const a of manifest.actions) lines.push(`  action       ${a.name}`);
+  for (const a of remoteOnlyActions) lines.push(`  action       ${a.id} (remote)`);
+  if (bundle.queries.length > 0) lines.push(`  queries      ${String(bundle.queries.length)}`);
+  if (bundle.pipelines.length > 0) lines.push(`  pipelines    ${String(bundle.pipelines.length)}`);
+  const hasRemote = remoteOnlyAgents.length + remoteOnlyConnectors.length + remoteOnlySkills.length + remoteOnlyActions.length > 0;
+  if (!hasRemote && remoteReachable) {
+    lines.push("");
+    lines.push("  All platform entities are defined locally. No remote-only dependencies.");
+  }
+  deps.log(lines.join("\n"));
   return 0;
 };
 var safeReadFile = (readFileSync, filePath) => {
@@ -1123,7 +1918,7 @@ var buildDevBootstrap = (fileUrl, file) => [
 ].join("\n");
 var discoverAgentFiles = async () => {
   const { readdirSync, existsSync } = await import("fs");
-  const agentsDir = "agents";
+  const agentsDir = "src/agents";
   if (!existsSync(agentsDir)) return [];
   return readdirSync(agentsDir).filter((f) => f.endsWith(".ts") || f.endsWith(".js") || f.endsWith(".mjs")).sort();
 };
@@ -1132,7 +1927,9 @@ var handleDev = async (parsed, deps) => {
   if (!name) {
     const agents = await discoverAgentFiles();
     if (agents.length === 0) {
-      deps.log("No agent files found in agents/. Create one or pass a name: kraken dev <agent>");
+      deps.log(
+        "No agent files found in src/agents/. Create one or pass a name: kraken dev <agent>"
+      );
       return 1;
     }
     if (agents.length === 1) {
@@ -1144,7 +1941,7 @@ var handleDev = async (parsed, deps) => {
     }
   }
   if (!name) return 1;
-  const file = name.includes("/") ? name : `agents/${name}`;
+  const file = name.includes("/") ? name : `src/agents/${name}`;
   const { spawn } = await import("child_process");
   const { resolve } = await import("path");
   const { pathToFileURL: pathToFileURL2 } = await import("url");
@@ -1161,9 +1958,11 @@ var handleDev = async (parsed, deps) => {
 var handleDiscover = async (parsed, deps) => {
   const dir = parsed.flags.dir ?? process.cwd();
   const manifest = await deps.discoverProject(dir);
-  const total = manifest.agents.length + manifest.skills.length + manifest.connectors.length;
+  const total = manifest.agents.length + manifest.skills.length + manifest.connectors.length + manifest.actions.length;
   if (total === 0) {
-    deps.log("No entities found in agents/, skills/, or connectors/ directories.");
+    deps.log(
+      "No entities found in src/agents/, src/skills/, src/connectors/, or src/actions/ directories."
+    );
     return 1;
   }
   if ("emit" in parsed.flags) {
@@ -1173,89 +1972,6 @@ var handleDiscover = async (parsed, deps) => {
   }
   return 0;
 };
-var handleInit = async (parsed, deps) => {
-  const name = parsed.flags.name ?? await deps.prompt("Project name: ");
-  if (!name) {
-    deps.log("Error: project name is required.");
-    return 1;
-  }
-  const { writeFileSync, mkdirSync } = await import("fs");
-  const { join } = await import("path");
-  const root = join(process.cwd(), name);
-  mkdirSync(join(root, "agents"), { recursive: true });
-  mkdirSync(join(root, "skills"), { recursive: true });
-  mkdirSync(join(root, "connectors"), { recursive: true });
-  writeFileSync(
-    join(root, "package.json"),
-    JSON.stringify(
-      {
-        name,
-        private: true,
-        type: "module",
-        scripts: { build: "tsc" },
-        dependencies: {
-          "kraken-ai": "latest",
-          "@kraken-ai/platform": "latest"
-        },
-        devDependencies: {
-          typescript: "^5"
-        }
-      },
-      null,
-      2
-    )
-  );
-  writeFileSync(
-    join(root, "tsconfig.json"),
-    JSON.stringify(
-      {
-        compilerOptions: {
-          target: "ES2022",
-          module: "NodeNext",
-          moduleResolution: "nodenext",
-          resolveJsonModule: true,
-          strict: true,
-          outDir: "dist",
-          rootDir: ".",
-          declaration: true,
-          esModuleInterop: true,
-          skipLibCheck: true
-        },
-        include: ["agents", "skills", "connectors"]
-      },
-      null,
-      2
-    )
-  );
-  writeFileSync(
-    join(root, "agents", "my-agent.ts"),
-    `import { definePlatformAgent } from "@kraken-ai/platform";
-
-export default definePlatformAgent({
-  agent: {
-    name: "my-agent",
-    model: "google/gemini-2.5-flash-preview-05-20",
-    instructions: "You are a helpful assistant.",
-  },
-  triggers: [{ type: "manual" }],
-});
-`
-  );
-  writeFileSync(join(root, ".gitignore"), `node_modules/
-dist/
-.kraken-ai/
-data/
-.env
-`);
-  deps.log(`Created project at ${root}/`);
-  deps.log(`
-  cd ${name}
-  pnpm install
-  kraken login
-  kraken generate
-`);
-  return 0;
-};
 var handleLogout = (deps) => {
   deps.clearCredentials();
   deps.log("Credentials cleared.");
@@ -1267,23 +1983,20 @@ kraken \u2014 Kraken AI Platform CLI
 
 Commands:
   dev        Run an agent locally with an interactive REPL
-             [agent]               Agent filename, e.g. researcher.ts (optional \u2014 picks from agents/ if omitted)
+             [agent]               Agent filename, e.g. researcher.ts (optional \u2014 picks from src/agents/ if omitted)
 
-  login      Store API credentials
+  login      Authenticate via browser-based device authorization
              --url <platform-url>  Platform instance URL
-             --key <api-key>       API key
+
+  api-keys   Manage API keys for server-side SDK authentication
+             create --name <name> [--expires 90d]  Create a new API key
+             list                                   List all API keys
+             revoke <id>                            Revoke an API key
 
   generate   Discover local entities and fetch remote schemas to generate types
              --dir <path>          Project root / output directory (default: cwd)
              --check               Check if types are up-to-date (exit 1 if stale)
 
-  discover   Scan agents/, skills/, connectors/ and output project manifest
-             --dir <path>          Project root (default: cwd)
-             --emit                Output with sentinel markers (for orchestrator)
-
-  init       Create a new Kraken project
-             --name <project-name> Project name
-
   logout     Clear stored credentials
 
 Environment variables:
@@ -1302,6 +2015,21 @@ var readlinePrompt = async (question) => {
     });
   });
 };
+var openUrlImpl = async (url) => {
+  if (!/^https?:\/\//.test(url)) return;
+  const { platform } = await import("os");
+  try {
+    const p = platform();
+    if (p === "darwin") {
+      await execFileAsync("open", [url]);
+    } else if (p === "win32") {
+      await execFileAsync("cmd", ["/c", "start", "", url]);
+    } else {
+      await execFileAsync("xdg-open", [url]);
+    }
+  } catch {
+  }
+};
 var main = async () => {
   const parsed = parseArgs(process.argv.slice(2));
   const exitCode = await runCommand(parsed, {
@@ -1312,7 +2040,8 @@ var main = async () => {
     discoverProject,
     fetch: globalThis.fetch,
     prompt: readlinePrompt,
-    log: console.log
+    log: console.log,
+    openUrl: openUrlImpl
   });
   if (exitCode !== 0) process.exit(exitCode);
 };