@mcpcloud/cli 0.24.1 → 0.25.0

package/dist/index.js

@@ -4155,6 +4155,45 @@ ${suggestions.map((s) => `  • ${describeCandidate(s)}`).join(`
 Run \`${kind.listHint}\` to see available ${kind.label}s.`);
 }
 
+// src/lib/resolve-cross-org.ts
+async function otherOrganizationIds(currentOrgId) {
+  try {
+    const data = await api.get("/api/v1/organizations");
+    return data.organizations.filter((org) => org.id && org.id !== currentOrgId).map((org) => org.id).slice(0, 10);
+  } catch {
+    return [];
+  }
+}
+async function findInAnotherOrganization(ref, currentOrgId, loadIn) {
+  const lower = ref.toLowerCase();
+  for (const organizationId of await otherOrganizationIds(currentOrgId)) {
+    let candidates;
+    try {
+      candidates = await loadIn(organizationId);
+    } catch {
+      continue;
+    }
+    const found = candidates.find((candidate) => candidate.id === ref) ?? candidates.find((candidate) => candidate.name.toLowerCase() === lower) ?? candidates.find((candidate) => candidate.slug === lower);
+    if (found) {
+      return { organizationId, id: found.id, name: found.name };
+    }
+  }
+  return null;
+}
+function isOrganizationAccessError(err) {
+  return err instanceof McpCloudApiError && (err.error.code === "organization_access_denied" || err.error.code === "organization_access_required");
+}
+async function organizationAccessError(args) {
+  if (args.crossOrganizationHint) {
+    const elsewhere = await findInAnotherOrganization(args.ref, args.organizationId, args.loadIn);
+    if (elsewhere) {
+      return foundInAnotherOrganizationError(args.kind, args.ref, elsewhere);
+    }
+  }
+  return new CliExitError(1, `You are not a member of organization ${args.organizationId} (from --org or your saved default).
+` + `If the ${args.kind.label} belongs to another organization, pass --org <id> — \`mcp orgs list\` shows yours.`);
+}
+
 // src/lib/resolve.ts
 var KINDS = {
   server: {
@@ -4244,30 +4283,6 @@ async function resolveQualified(kind, spec, ref, scope) {
   const settled = await settleMatches(spec, ref, matches);
   return { id: settled.id, matchedBy: "qualified", name: settled.name };
 }
-async function otherOrganizationIds(currentOrgId) {
-  try {
-    const data = await api.get("/api/v1/organizations");
-    return data.organizations.filter((org) => org.id && org.id !== currentOrgId).map((org) => org.id).slice(0, 10);
-  } catch {
-    return [];
-  }
-}
-async function findInAnotherOrganization(kind, spec, ref, scope) {
-  const lower = ref.toLowerCase();
-  for (const organizationId of await otherOrganizationIds(scope.organizationId)) {
-    let candidates;
-    try {
-      candidates = await loadCandidates(kind, spec, { organizationId });
-    } catch {
-      continue;
-    }
-    const found = candidates.find((candidate) => candidate.id === ref) ?? candidates.find((candidate) => candidate.name.toLowerCase() === lower) ?? candidates.find((candidate) => candidate.slug === lower);
-    if (found) {
-      return { organizationId, id: found.id, name: found.name };
-    }
-  }
-  return null;
-}
 async function resolveRef(kind, reference, scope, options = {}) {
   const spec = KINDS[kind];
   const ref = reference.trim();
@@ -4286,6 +4301,15 @@ async function resolveRef(kind, reference, scope, options = {}) {
       await probeById(spec, scope, ref);
       return { id: ref, matchedBy: "id" };
     } catch (err) {
+      if (isOrganizationAccessError(err)) {
+        throw await organizationAccessError({
+          kind: spec,
+          ref,
+          organizationId: scope.organizationId,
+          crossOrganizationHint: options.crossOrganizationHint !== false,
+          loadIn: (organizationId) => loadCandidates(kind, spec, { organizationId })
+        });
+      }
       if (!isNotFoundError(err)) {
         if (err instanceof McpCloudApiError)
           throw err;
@@ -4301,7 +4325,16 @@ async function resolveRef(kind, reference, scope, options = {}) {
   let candidates;
   try {
     candidates = await loadCandidates(kind, spec, scope);
-  } catch {
+  } catch (err) {
+    if (isOrganizationAccessError(err)) {
+      throw await organizationAccessError({
+        kind: spec,
+        ref,
+        organizationId: scope.organizationId,
+        crossOrganizationHint: options.crossOrganizationHint !== false,
+        loadIn: (organizationId) => loadCandidates(kind, spec, { organizationId })
+      });
+    }
     return { id: ref, matchedBy: "verbatim" };
   }
   const byId = candidates.find((c) => c.id === ref);
@@ -4323,7 +4356,7 @@ async function resolveRef(kind, reference, scope, options = {}) {
     return { id: ref, matchedBy: "verbatim" };
   } catch {
     if (options.crossOrganizationHint !== false) {
-      const elsewhere = await findInAnotherOrganization(kind, spec, ref, scope);
+      const elsewhere = await findInAnotherOrganization(ref, scope.organizationId, (organizationId) => loadCandidates(kind, spec, { organizationId }));
       if (elsewhere) {
         throw foundInAnotherOrganizationError(spec, ref, elsewhere);
       }
@@ -7668,10 +7701,6 @@ function registerServerExportCommands(servers) {
   }));
 }
 
-// src/commands/servers-lifecycle.ts
-import { existsSync as existsSync6 } from "node:fs";
-import { isAbsolute as isAbsolute2, resolve as resolve4 } from "node:path";
-
 // src/lib/deployment-display.ts
 function formatDeploymentExposure(deployment) {
   const exposure = deployment.exposureTarget ?? null;
@@ -7689,6 +7718,118 @@ function formatDeploymentExposure(deployment) {
   return target ?? "unknown";
 }
 
+// src/commands/servers-deploy-shared.ts
+var DEPLOY_TARGETS = [
+  "workersDev",
+  "managedDomain"
+];
+var ACCESS_MODES = [
+  "public",
+  "privateOrg",
+  "unlisted"
+];
+function emptyRuntimeConfig() {
+  return {
+    upstreamBaseUrl: null,
+    upstreamApiKey: null,
+    upstreamApiKeyHeader: null,
+    upstreamApiKeyPrefix: null,
+    upstreamCustomHeaders: null,
+    additionalPlainTextBindings: null,
+    additionalSecretBindings: null
+  };
+}
+function reportDeployFailure(terminalEvent) {
+  if (!terminalEvent || !isFailureEvent(terminalEvent))
+    return false;
+  const reason = formatEventDetails(terminalEvent.details);
+  printError(`Deploy failed: ${reason ?? terminalEvent.message}`);
+  return true;
+}
+async function isOnlyDeployment(args) {
+  try {
+    const listing = await api.get(`/api/v1/server/deployments?organizationId=${encodeURIComponent(args.orgId)}&serverId=${encodeURIComponent(args.serverId)}&limit=2`);
+    const rows = listing.deployments;
+    if (!Array.isArray(rows) || rows.length === 0)
+      return false;
+    return rows.every((row) => row.id === args.deploymentId);
+  } catch {
+    return false;
+  }
+}
+async function refreshDeploymentRow(args) {
+  try {
+    const refreshed = await api.get(`/api/v1/server/deployments?organizationId=${encodeURIComponent(args.orgId)}&serverId=${encodeURIComponent(args.serverId)}&limit=5`);
+    return (refreshed.deployments ?? []).find((entry) => entry.id === args.deploymentId) ?? null;
+  } catch {
+    return null;
+  }
+}
+async function waitForDeploy(args) {
+  const dep = args.deployment;
+  let terminalEvent = null;
+  let waitDone = !args.wait;
+  if (args.wait) {
+    if (isTerminalDeploymentStatus(dep.status)) {
+      waitDone = true;
+    } else {
+      const totalTimeoutMs = Math.max(10, Number.parseInt(args.waitTimeout, 10) || 300) * 1000;
+      if (!isJsonMode()) {
+        printStep(`Following events for ${c.bold(dep.deploymentId)}${args.announceTimeout ? ` (timeout ${Math.round(totalTimeoutMs / 1000)}s)` : ""}…`);
+      }
+      const result = await followDeploymentEvents({
+        organizationId: args.orgId,
+        deploymentId: dep.deploymentId,
+        totalTimeoutMs,
+        onEvent: (event) => {
+          if (!isJsonMode())
+            printInfo(formatEventLine(event));
+        }
+      });
+      terminalEvent = result.terminalEvent;
+      waitDone = result.done;
+      if (!waitDone && !isJsonMode()) {
+        printError(`Deploy did not reach a terminal state within ${Math.round(totalTimeoutMs / 1000)}s. Check \`mcp deployments get ${dep.deploymentId}\` and \`mcp deployments health ${dep.deploymentId}\`, or tail \`mcp deployments logs ${dep.deploymentId} --follow\`.`);
+      }
+    }
+  }
+  const deployFailed = dep.status === "failed" || Boolean(terminalEvent && isFailureEvent(terminalEvent));
+  return { terminalEvent, waitDone, deployFailed };
+}
+function terminalEventFields(terminalEvent) {
+  if (!terminalEvent)
+    return {};
+  return {
+    "terminal event": `${terminalEvent.stage} (${terminalEvent.level}) — ${terminalEvent.message}`,
+    "terminal at": formatDate(terminalEvent.timestamp)
+  };
+}
+async function finishDeployReport(args) {
+  const dep = args.deployment;
+  if (!args.accessModeRequested && dep.accessMode === "public" && await isOnlyDeployment({
+    deploymentId: dep.deploymentId,
+    orgId: args.orgId,
+    serverId: args.serverId
+  })) {
+    printWarn("This first deployment is public — anyone with the URL can call it. Redeploy with --access-mode privateOrg or unlisted to require sign-in (recommended when the upstream API needs credentials).");
+  }
+  if (!args.wait && dep.status === "queued") {
+    printInfo(`Deploy is running in the background — follow with \`mcp deployments get ${dep.deploymentId}\` or rerun with --wait.`);
+  }
+  if (args.wait && !args.outcome.waitDone)
+    throw new CliExitError(1);
+  if (args.outcome.deployFailed) {
+    if (!reportDeployFailure(args.outcome.terminalEvent)) {
+      printError("Deploy failed.");
+    }
+    throw new CliExitError(1);
+  }
+}
+
+// src/commands/servers-push-spec.ts
+import { existsSync as existsSync6 } from "node:fs";
+import { isAbsolute as isAbsolute2, resolve as resolve4 } from "node:path";
+
 // src/lib/dev/spec-watcher.ts
 import { createHash as createHash2 } from "node:crypto";
 import {
@@ -7706,7 +7847,8 @@ async function regenerateDevBundle(args) {
       sourceType: args.sourceType ?? "openapi",
       preserveEnrichment: args.preserveEnrichment ?? true,
       ...args.applySpec ? { applySpec: true } : {},
-      ...args.dryRunApply ? { dryRunApply: true } : {}
+      ...args.dryRunApply ? { dryRunApply: true } : {},
+      ...args.renameToOperationIds ? { renameToOperationIds: true } : {}
     });
     return {
       ok: true,
@@ -7812,39 +7954,374 @@ function watchSpecFile(options) {
   };
 }
 
-// src/commands/servers-lifecycle.ts
-var DEPLOY_TARGETS = ["workersDev", "managedDomain"];
-var ACCESS_MODES = [
-  "public",
-  "privateOrg",
-  "unlisted"
+// src/commands/servers-push-spec-deploy.ts
+async function deployPushedSpec(args) {
+  const { result, orgId, serverId, target, accessMode, opts } = args;
+  const serverData = await api.get("/api/v1/server", {
+    organizationId: orgId,
+    serverId
+  });
+  const body = {
+    organizationId: orgId,
+    projectId: serverData.server.projectId,
+    serverId,
+    target,
+    ...accessMode ? { accessMode } : {},
+    runtimeConfig: emptyRuntimeConfig()
+  };
+  if (!isJsonMode()) {
+    printStep(`Deploying ${c.bold(serverId)} to ${c.cyan(target)}…`);
+  }
+  const data = await api.post("/api/v1/server/deploy", body);
+  const dep = data.deployment;
+  const outcome = await waitForDeploy({
+    deployment: dep,
+    orgId,
+    wait: opts.wait,
+    waitTimeout: opts.waitTimeout
+  });
+  const { terminalEvent, waitDone, deployFailed } = outcome;
+  let final = dep;
+  if (opts.wait && waitDone) {
+    const row = await refreshDeploymentRow({
+      deploymentId: dep.deploymentId,
+      orgId,
+      serverId
+    });
+    if (row)
+      final = { ...dep, ...row };
+  }
+  if (isJsonMode()) {
+    printJson({
+      pushed: true,
+      diff: result.diff,
+      enrichmentApplied: result.enrichmentApplied,
+      applied: result.applied,
+      deployment: final,
+      waitDone,
+      terminalEvent
+    });
+    if (opts.wait && (!waitDone || deployFailed))
+      throw new CliExitError(1);
+    return;
+  }
+  printSuccess(`Deployment ${c.bold(dep.deploymentId)} created.`);
+  printKeyValue({
+    id: dep.deploymentId,
+    ...final.deploymentUrl ? { url: final.deploymentUrl } : {},
+    target: final.target,
+    "access mode": final.accessMode,
+    status: final.status,
+    health: final.healthStatus,
+    ...terminalEventFields(terminalEvent)
+  });
+  await finishDeployReport({
+    deployment: dep,
+    accessModeRequested: accessMode,
+    orgId,
+    serverId,
+    wait: opts.wait,
+    outcome
+  });
+}
+
+// src/commands/tool-name-drift.ts
+function nameDriftWarning(args) {
+  const drift = args.drift ?? [];
+  const example = drift[0];
+  if (!example)
+    return null;
+  const subject = drift.length === 1 ? "1 tool keeps its current name" : `${drift.length} tools keep their current names`;
+  const alternative = args.offerPushSpecFlag ? " or re-run with --rename-to-operation-ids" : "";
+  return `${subject} (the naming rule changed: codegen now keeps the operationId's case, ` + `e.g. ${example.name} → ${example.codegenName}). ` + `Run \`mcp tools rename --from-operation-ids --server ${args.serverId}\`${alternative} to adopt it.`;
+}
+function formatNameList(names, max = 8) {
+  if (names.length <= max)
+    return names.join(", ");
+  return `${names.slice(0, max).join(", ")}, +${names.length - max} more`;
+}
+
+// src/commands/servers-push-spec-report.ts
+function printSpecReconcile(args) {
+  const { result, serverId } = args;
+  const applied = result.applied;
+  if (!applied) {
+    printNameDiff(result);
+    if (args.renameToOperationIds)
+      printRenameUnsupported(serverId);
+  } else {
+    printAppliedSummary(applied);
+    printRenames(applied, serverId, args.renameToOperationIds);
+    if (applied.removedKeys.length > 0) {
+      printWarn(`  ! ${applied.removedKeys.length} tool(s) no longer in the spec, left in place: ${applied.removedKeys.join(", ")}`);
+    }
+    for (const warning of applied.warnings)
+      printWarn(`  ! ${warning}`);
+    if (!args.renameToOperationIds) {
+      const drift = nameDriftWarning({
+        drift: applied.nameDrift,
+        serverId,
+        offerPushSpecFlag: true
+      });
+      if (drift)
+        printWarn(`  ! ${drift}`);
+    }
+    if (!applied.dryRun)
+      printStoredBundle(applied, serverId);
+    if (applied.dryRun) {
+      printInfo(c.dim("  → re-run with --apply to write this to the server’s tools."));
+    }
+  }
+  if (result.enrichmentApplied) {
+    printInfo(c.dim("  → preserved per-tool enrichment."));
+  }
+  printSuccess(applied && !applied.dryRun ? "Spec applied." : "Bundle regenerated (preview).");
+}
+function printNameDiff(result) {
+  const summary = summarizeDiff(result.diff);
+  if (!summary.hasChanges) {
+    printInfo(c.dim("  → no tool surface changes; bundle refreshed."));
+    return;
+  }
+  printInfo(`  → ${summary.total} tool change${summary.total === 1 ? "" : "s"} by name (nothing written):`);
+  printInfo(summary.text);
+}
+function withNames(names, label) {
+  const head = `${names.length} ${label}`;
+  return names.length > 0 ? `${head} (${formatNameList(names)})` : head;
+}
+function printAppliedSummary(applied) {
+  const lead = applied.dryRun ? "would apply (nothing written)" : "applied";
+  printInfo(`  → ${lead}: ${withNames(applied.inserted, "inserted")}, ` + `${withNames(applied.updated, "updated")}, ${applied.unchanged} unchanged`);
+}
+function printRenames(applied, serverId, requested) {
+  if (!requested)
+    return;
+  const renamed = applied.renamed;
+  if (renamed === undefined) {
+    printRenameUnsupported(serverId);
+    return;
+  }
+  if (applied.renameError) {
+    printWarn(`  ! the spec was ${applied.dryRun ? "previewed" : "applied"}, but no tools were renamed: ${applied.renameError} ` + `See \`mcp tools rename --from-operation-ids --server ${serverId} --dry-run\`.`);
+    return;
+  }
+  if (renamed.length === 0) {
+    printInfo(c.dim("  → no tools to rename; names already follow the operationId."));
+    return;
+  }
+  printInfo(`  → ${applied.dryRun ? "would rename" : "renamed"} ${renamed.length} tool${renamed.length === 1 ? "" : "s"} to the operationId's case:`);
+  for (const entry of renamed)
+    printInfo(`      ${entry.from} → ${entry.to}`);
+  if (!applied.dryRun) {
+    printInfo(c.dim("  → the live server keeps the old names until the next deploy; after it, agents calling an old name get unknown-tool."));
+  }
+}
+function printRenameUnsupported(serverId) {
+  printWarn(`  ! this backend did not report any renames, so it may not support --rename-to-operation-ids. Run \`mcp tools rename --from-operation-ids --server ${serverId}\` instead.`);
+}
+function printStoredBundle(applied, serverId) {
+  if (applied.storedBundle) {
+    printInfo(c.dim("  → stored bundle regenerated; a deploy now ships this spec."));
+    return;
+  }
+  printWarn(`  ! stored bundle NOT regenerated${applied.storeError ? `: ${applied.storeError}` : ""}. ` + `Deploy ships the stored bundle — run \`mcp servers generate ${serverId} --store\` before deploying.`);
+}
+
+// src/commands/servers-push-spec.ts
+var HELP_AFTER = [
+  "",
+  "Examples:",
+  "  # Preview what the spec would change (writes nothing):",
+  "  $ mcp servers push-spec srv_123 --spec ./openapi.yaml",
+  "",
+  "  # Actually reconcile the tools against the spec, then deploy:",
+  "  $ mcp servers push-spec srv_123 --spec ./openapi.yaml --apply --deploy --wait",
+  "",
+  "  # Push and deploy in one step:",
+  "  $ mcp servers push-spec srv_123 --spec ./openapi.yaml --deploy --wait",
+  "",
+  "  # Adopt the current naming rule while applying (getrecording → getRecording):",
+  "  $ mcp servers push-spec srv_123 --spec ./openapi.yaml --apply --rename-to-operation-ids",
+  "",
+  "  # Idempotent retry-safe push in CI:",
+  "  $ mcp --ci --idempotency-key $GITHUB_RUN_ID servers push-spec srv_123 --deploy --wait",
+  "",
+  "Notes (--apply):",
+  "  Without --apply this regenerates the BUNDLE and previews the reconcile",
+  "  --apply would run (inserted / updated / unchanged) — it does not touch",
+  "  the stored tools, so a deploy afterwards still ships the old ones.",
+  "  --apply writes the tools AND regenerates the stored bundle (what",
+  "  deploy ships), so the next deploy advertises the new spec. If the",
+  "  bundle step fails you are told, and --deploy refuses to ship the",
+  "  stale one; `mcp servers generate <server> --store` repairs it.",
+  "  --apply reconciles: tools match on their stable operation key so",
+  "  renames survive, spec-derived shape is refreshed, and curated fields",
+  "  (description, tags, riskClass, projections, enrichment) are kept.",
+  "  Operations missing from the spec are REPORTED, never deleted.",
+  "  It is lossy for hand-edited input schemas — the spec becomes the",
+  "  truth — which is why it is opt-in.",
+  "",
+  "Notes (tool names):",
+  "  The reconcile never renames a tool. Codegen now keeps the operationId’s",
+  "  case (getRecording); servers created before that change keep their",
+  "  lowercased names (getrecording), and the preview says how many.",
+  "  --rename-to-operation-ids adopts the current rule for those tools,",
+  "  keeping tool ids, access grants and saved scenarios — the same rename",
+  "  `mcp tools rename --from-operation-ids` performs. The live server keeps",
+  "  the old names until the next deploy."
 ];
-function reportDeployFailure(terminalEvent) {
-  if (!terminalEvent || !isFailureEvent(terminalEvent))
-    return false;
-  const reason = formatEventDetails(terminalEvent.details);
-  printError(`Deploy failed: ${reason ?? terminalEvent.message}`);
-  return true;
+function registerServerPushSpecCommand(servers) {
+  servers.command("push-spec <server>").description("Regenerate a server’s bundle from a local OpenAPI spec. Previews the tool changes; --apply writes them.").option("--org <organizationId>", "Organization ID").option("--apply", "Write the spec onto the server’s tools, refreshing their schemas. Without this the command only previews.").option("--spec <path>", "Path to the OpenAPI/Swagger spec file", "./openapi.yaml").option("--enrich-on-change", "Preserve per-tool enrichment when the spec changes").option("--rename-to-operation-ids", "Also rename tools whose names differ from codegen’s only by case (getrecording → getRecording). Previews without --apply.").option("--deploy", "Immediately deploy the regenerated bundle to Cloudflare Workers").option("--target <target>", `Deploy target (with --deploy): ${DEPLOY_TARGETS.join(" | ")}`, "workersDev").option("--access-mode <mode>", `Access mode (with --deploy): ${ACCESS_MODES.join(" | ")} (default: keep the server's current mode). Per-member upstream keys need privateOrg or unlisted.`).option("--wait", "With --deploy: tail deployment events until terminal state").option("--wait-timeout <seconds>", "Maximum seconds to wait for terminal state (default 300)", "300").addHelpText("after", HELP_AFTER.join(`
+`)).action(runAction(async (serverRef, opts) => {
+    await runPushSpec(serverRef, opts);
+  }));
 }
-async function isOnlyDeployment(args) {
-  try {
-    const listing = await api.get(`/api/v1/server/deployments?organizationId=${encodeURIComponent(args.orgId)}&serverId=${encodeURIComponent(args.serverId)}&limit=2`);
-    const rows = listing.deployments;
-    if (!Array.isArray(rows) || rows.length === 0)
-      return false;
-    return rows.every((row) => row.id === args.deploymentId);
-  } catch {
-    return false;
+async function runPushSpec(serverRef, opts) {
+  const cwd = process.cwd();
+  const specPath = isAbsolute2(opts.spec) ? opts.spec : resolve4(cwd, opts.spec);
+  if (!existsSync6(specPath)) {
+    throw new Error(`Spec file not found: ${specPath}`);
+  }
+  const orgId = await resolveOrgId(opts.org);
+  const serverId = await resolveServerId(serverRef, orgId);
+  const target = validateChoice("target", opts.target, DEPLOY_TARGETS);
+  const accessMode = opts.accessMode ? validateChoice("access-mode", opts.accessMode, ACCESS_MODES) : undefined;
+  if (!isJsonMode()) {
+    printStep(`Pushing spec ${c.bold(specPath)} to ${c.bold(serverId)}…`);
+  }
+  const { content } = readSpecFile(specPath);
+  const result = await regenerateDevBundle({
+    applySpec: true,
+    dryRunApply: !opts.apply,
+    organizationId: orgId,
+    serverId,
+    rawSpec: content,
+    sourceType: "openapi",
+    preserveEnrichment: Boolean(opts.enrichOnChange),
+    renameToOperationIds: Boolean(opts.renameToOperationIds)
+  });
+  if (!result.ok) {
+    const hint = result.code === "insufficient_scope" ? " push-spec --apply regenerates the server’s code, which needs the servers:build scope; mint the key with --preset ci-build or add --scope servers:build." : "";
+    throw new Error(`Spec regen failed: ${result.message} (code: ${result.code})${hint}`);
+  }
+  if (!isJsonMode()) {
+    printSpecReconcile({
+      result,
+      serverId,
+      renameToOperationIds: Boolean(opts.renameToOperationIds)
+    });
+  }
+  const appliedWithoutStore = result.applied !== null && !result.applied.dryRun && result.applied.storedBundle === false;
+  if (!opts.deploy) {
+    if (isJsonMode()) {
+      printJson({
+        applied: result.applied,
+        diff: result.diff,
+        enrichmentApplied: result.enrichmentApplied,
+        pushed: Boolean(result.applied && !result.applied.dryRun)
+      });
+    } else if (appliedWithoutStore) {
+      printInfo(c.dim(`  → run \`mcp servers generate ${serverId} --store\`, then \`mcp servers deploy ${serverId} --wait\` to ship.`));
+    } else {
+      printInfo(c.dim(`  → run \`mcp servers deploy ${serverId} --wait\` (or pass --deploy) to ship.`));
+    }
+    return;
   }
+  if (appliedWithoutStore) {
+    throw new Error(`The spec was applied but the stored bundle was not regenerated${result.applied?.storeError ? ` (${result.applied.storeError})` : ""}. ` + `Run \`mcp servers generate ${serverId} --store\`, then deploy.`);
+  }
+  await deployPushedSpec({ result, orgId, serverId, target, accessMode, opts });
 }
-async function refreshDeploymentRow(args) {
-  try {
-    const refreshed = await api.get(`/api/v1/server/deployments?organizationId=${encodeURIComponent(args.orgId)}&serverId=${encodeURIComponent(args.serverId)}&limit=5`);
-    return (refreshed.deployments ?? []).find((entry) => entry.id === args.deploymentId) ?? null;
-  } catch {
-    return null;
+
+// src/commands/servers-regenerate.ts
+function registerServerRegenerateCommand(servers) {
+  servers.command("regenerate <server>").description("Re-fetch a server's source spec and rebuild its tools with the current codegen (preserves customizations). Works for spec-URL, OpenAPI, and GraphQL sources; a pasted or manual server has nothing to re-fetch. Wraps POST /api/v1/server/regenerate.").option("--org <organizationId>", "Organization ID").option("--project <project>", "Project (id or name; defaults to the server's project)").option("--source-url <url>", "Override the stored spec source URL (needed for GraphQL servers whose introspection endpoint wasn't persisted)").option("--dry-run", "Report what would change (per tool) without writing anything").addHelpText("after", [
+    "",
+    "Regenerate re-introspects/re-parses the source and rebuilds each tool with",
+    "the current codegen, so codegen fixes reach existing servers. It does not",
+    "deploy — run `mcp servers deploy` afterwards to ship the rebuilt bundle.",
+    "It never renames a tool: names that predate the current naming rule",
+    "(getrecording vs getRecording) are reported, and",
+    "`mcp tools rename --from-operation-ids` adopts the rule.",
+    "",
+    "Examples:",
+    "  # See which tools the current codegen would change, writing nothing:",
+    "  $ mcp servers regenerate srv_123 --dry-run",
+    "",
+    "  # Propagate codegen fixes into an existing server, then deploy:",
+    "  $ mcp servers regenerate srv_123 && mcp servers deploy srv_123 --wait",
+    "",
+    "  # GraphQL server whose introspection endpoint must be supplied:",
+    "  $ mcp servers regenerate srv_123 --source-url https://api.example.com/graphql"
+  ].join(`
+`)).action(runAction(async (serverRef, opts) => {
+    await runRegenerate(serverRef, opts);
+  }));
+}
+async function runRegenerate(serverRef, opts) {
+  const orgId = await resolveOrgId(opts.org);
+  let projectId = await resolveOptionalProjectId(opts.project, orgId);
+  const serverId = await resolveServerId(serverRef, orgId, projectId);
+  if (!projectId) {
+    const serverData = await api.get("/api/v1/server", { organizationId: orgId, serverId });
+    projectId = serverData.server.projectId;
+  }
+  if (!isJsonMode()) {
+    printStep(opts.dryRun ? `Previewing a regenerate of ${c.bold(serverId)} from its source spec…` : `Regenerating ${c.bold(serverId)} from its source spec…`);
+  }
+  const data = await api.post("/api/v1/server/regenerate", {
+    organizationId: orgId,
+    projectId,
+    serverId,
+    ...opts.sourceUrl ? { sourceUrl: opts.sourceUrl } : {},
+    ...opts.dryRun ? { dryRun: true } : {}
+  });
+  const r = data.regeneration;
+  const previewIgnored = Boolean(opts.dryRun) && r.dryRun !== true;
+  if (isJsonMode()) {
+    printJson({ regeneration: r });
+    if (previewIgnored)
+      throw new CliExitError(1);
+    return;
   }
+  if (previewIgnored) {
+    printError("This backend does not support --dry-run and REGENERATED the server. The report below is what was written.");
+  }
+  printRegeneration(r, serverId);
+  if (previewIgnored)
+    throw new CliExitError(1);
 }
+function printRegeneration(r, serverId) {
+  const dryRun = r.dryRun === true;
+  printSuccess(dryRun ? `Regenerate preview for ${c.bold(serverId)} (${r.sourceType}) — nothing written.` : `Regenerated ${c.bold(serverId)} (${r.sourceType}).`);
+  const verb = dryRun ? "that would change" : "updated";
+  printKeyValue({
+    [`tools ${verb}`]: String(r.updated),
+    [`tools ${dryRun ? "that would be added" : "added"}`]: String(r.inserted),
+    ...r.unchanged !== undefined ? { "tools unchanged": String(r.unchanged) } : {},
+    "tools dropped from spec": String(r.removed),
+    generation: r.generationStatus
+  });
+  for (const change of r.changes ?? []) {
+    printInfo(`  ~ ${change.name}${change.fields.length > 0 ? ` (${change.fields.join(", ")})` : ""}`);
+  }
+  for (const name of r.insertedNames ?? [])
+    printInfo(`  + ${name}`);
+  if (r.removed > 0) {
+    printInfo(c.dim(`  → ${r.removed} operation(s) no longer in the spec ${dryRun ? "would be" : "were"} kept, not deleted (removal stays a manual action): ${formatNameList(r.removedKeys, 5)}`));
+  }
+  const drift = nameDriftWarning({
+    drift: r.nameDrift,
+    serverId,
+    offerPushSpecFlag: false
+  });
+  if (drift)
+    printWarn(`  ! ${drift}`);
+  printInfo(c.dim(dryRun ? `  → run \`mcp servers regenerate ${serverId}\` (without --dry-run) to apply, then \`mcp servers deploy ${serverId} --wait\`.` : `  → run \`mcp servers deploy ${serverId} --wait\` to ship the regenerated bundle.`));
+}
+
+// src/commands/servers-lifecycle.ts
 function registerServerLifecycleCommands(servers) {
   servers.command("deploy <server>").description("Deploy a server's generated bundle to Cloudflare Workers (closes the spec → deploy loop)").option("--org <organizationId>", "Organization ID").option("--project <project>", "Project (id or name; defaults to the server's project)").option("--target <target>", `Deploy target: ${DEPLOY_TARGETS.join(" | ")}`, "workersDev").option("--access-mode <mode>", `Access mode: ${ACCESS_MODES.join(" | ")} (default: keep the server's current mode). A server with per-member upstream keys needs privateOrg or unlisted — public has no caller identity.`).option("--env <environment>", "Deploy into a named environment (lane) — its own worker, hostname and credentials. Omit, or pass production, for the default lane.").option("--channel <channel>", "Deprecated alias for --env: beta means --env beta, stable means production. Mutually exclusive with --env.").option("--upstream-base-url <url>", "Upstream API base URL bound into the worker").option("--upstream-api-key <key>", "Upstream API key (encrypted at rest server-side)").option("--upstream-api-key-header <header>", "Header name to inject the upstream API key on (default: Authorization)").option("--upstream-api-key-prefix <prefix>", 'Prefix for the upstream API key value (e.g. "Bearer ")').option("--wait", "Tail deployment events until the deploy reaches a terminal state").option("--wait-timeout <seconds>", "Maximum seconds to wait for terminal state (default 300)", "300").addHelpText("after", [
     "",
@@ -7863,389 +8340,91 @@ function registerServerLifecycleCommands(servers) {
     "  $ mcp servers deploy srv_123 --env staging --wait"
   ].join(`
 `)).action(runAction(async (serverRef, opts) => {
-    const target = validateChoice("target", opts.target, DEPLOY_TARGETS);
-    const environment = resolveDeployEnvironment(opts);
-    const accessMode = opts.accessMode ? validateChoice("access-mode", opts.accessMode, ACCESS_MODES) : undefined;
-    const orgId = await resolveOrgId(opts.org);
-    let projectId = await resolveOptionalProjectId(opts.project, orgId);
-    const serverId = await resolveServerId(serverRef, orgId, projectId);
-    if (!projectId) {
-      const serverData = await api.get("/api/v1/server", {
-        organizationId: orgId,
-        serverId
-      });
-      projectId = serverData.server.projectId;
-    }
-    const runtimeConfig = {
-      upstreamBaseUrl: opts.upstreamBaseUrl ?? null,
-      upstreamApiKey: opts.upstreamApiKey ?? null,
-      upstreamApiKeyHeader: opts.upstreamApiKeyHeader ?? null,
-      upstreamApiKeyPrefix: opts.upstreamApiKeyPrefix ?? null,
-      upstreamCustomHeaders: null,
-      additionalPlainTextBindings: null,
-      additionalSecretBindings: null
-    };
-    const body = {
-      organizationId: orgId,
-      projectId,
-      serverId,
-      target,
-      ...accessMode ? { accessMode } : {},
-      ...environment ? { environment } : {},
-      runtimeConfig
-    };
-    if (!isJsonMode()) {
-      printStep(`Deploying ${c.bold(serverId)} to ${c.cyan(target)}${environment ? ` in ${c.cyan(environment)}` : ""}…`);
-    }
-    const data = await api.post("/api/v1/server/deploy", body);
-    const dep = data.deployment;
-    let terminalEvent = null;
-    let waitDone = !opts.wait;
-    if (opts.wait) {
-      if (isTerminalDeploymentStatus(dep.status)) {
-        waitDone = true;
-      } else {
-        const totalTimeoutMs = Math.max(10, Number.parseInt(opts.waitTimeout, 10) || 300) * 1000;
-        if (!isJsonMode()) {
-          printStep(`Following events for ${c.bold(dep.deploymentId)} (timeout ${Math.round(totalTimeoutMs / 1000)}s)…`);
-        }
-        const result = await followDeploymentEvents({
-          organizationId: orgId,
-          deploymentId: dep.deploymentId,
-          totalTimeoutMs,
-          onEvent: (event) => {
-            if (!isJsonMode()) {
-              printInfo(formatEventLine(event));
-            }
-          }
-        });
-        terminalEvent = result.terminalEvent;
-        waitDone = result.done;
-        if (!waitDone && !isJsonMode()) {
-          printError(`Deploy did not reach a terminal state within ${Math.round(totalTimeoutMs / 1000)}s. Check \`mcp deployments get ${dep.deploymentId}\` and \`mcp deployments health ${dep.deploymentId}\`, or tail \`mcp deployments logs ${dep.deploymentId} --follow\`.`);
-        }
-      }
-    }
-    const deployFailed = dep.status === "failed" || Boolean(terminalEvent && isFailureEvent(terminalEvent));
-    let final = dep;
-    if (opts.wait && waitDone) {
-      const row = await refreshDeploymentRow({
-        deploymentId: dep.deploymentId,
-        orgId,
-        serverId
-      });
-      if (row)
-        final = { ...dep, ...row };
-    }
-    if (isJsonMode()) {
-      printJson({ deployment: final, waitDone, terminalEvent });
-      if (opts.wait && (!waitDone || deployFailed))
-        throw new CliExitError(1);
-      return;
-    }
-    printSuccess(`Deployment ${c.bold(dep.deploymentId)} created.`);
-    printKeyValue({
-      id: dep.deploymentId,
-      ...environment ? { environment } : {},
-      ...final.deploymentUrl ? { url: final.deploymentUrl } : {},
-      exposure: formatDeploymentExposure(final),
-      "access mode": dep.accessMode,
-      status: final.status,
-      health: final.healthStatus,
-      ...terminalEvent ? {
-        "terminal event": `${terminalEvent.stage} (${terminalEvent.level}) — ${terminalEvent.message}`,
-        "terminal at": formatDate(terminalEvent.timestamp)
-      } : {}
-    });
-    if (!accessMode && dep.accessMode === "public" && await isOnlyDeployment({
-      deploymentId: dep.deploymentId,
-      orgId,
-      serverId
-    })) {
-      printWarn("This first deployment is public — anyone with the URL can call it. Redeploy with --access-mode privateOrg or unlisted to require sign-in (recommended when the upstream API needs credentials).");
-    }
-    if (!opts.wait && dep.status === "queued") {
-      printInfo(`Deploy is running in the background — follow with \`mcp deployments get ${dep.deploymentId}\` or rerun with --wait.`);
-    }
-    if (opts.wait && !waitDone)
-      throw new CliExitError(1);
-    if (deployFailed) {
-      if (!reportDeployFailure(terminalEvent)) {
-        printError("Deploy failed.");
-      }
-      throw new CliExitError(1);
-    }
+    await runDeploy(serverRef, opts);
   }));
-  servers.command("push-spec <server>").description("Regenerate a server’s bundle from a local OpenAPI spec. Previews the tool changes; --apply writes them.").option("--org <organizationId>", "Organization ID").option("--apply", "Write the spec onto the server’s tools, refreshing their schemas. Without this the command only previews.").option("--spec <path>", "Path to the OpenAPI/Swagger spec file", "./openapi.yaml").option("--enrich-on-change", "Preserve per-tool enrichment when the spec changes").option("--deploy", "Immediately deploy the regenerated bundle to Cloudflare Workers").option("--target <target>", `Deploy target (with --deploy): ${DEPLOY_TARGETS.join(" | ")}`, "workersDev").option("--access-mode <mode>", `Access mode (with --deploy): ${ACCESS_MODES.join(" | ")} (default: keep the server's current mode). Per-member upstream keys need privateOrg or unlisted.`).option("--wait", "With --deploy: tail deployment events until terminal state").option("--wait-timeout <seconds>", "Maximum seconds to wait for terminal state (default 300)", "300").addHelpText("after", [
-    "",
-    "Examples:",
-    "  # Preview what the spec would change (writes nothing):",
-    "  $ mcp servers push-spec srv_123 --spec ./openapi.yaml",
-    "",
-    "  # Actually reconcile the tools against the spec, then deploy:",
-    "  $ mcp servers push-spec srv_123 --spec ./openapi.yaml --apply --deploy --wait",
-    "",
-    "  # Push and deploy in one step:",
-    "  $ mcp servers push-spec srv_123 --spec ./openapi.yaml --deploy --wait",
-    "",
-    "  # Idempotent retry-safe push in CI:",
-    "  $ mcp --ci --idempotency-key $GITHUB_RUN_ID servers push-spec srv_123 --deploy --wait",
-    "",
-    "Notes (--apply):",
-    "  Without --apply this regenerates the BUNDLE and reports the tool",
-    "  changes the spec implies — it does not touch the stored tools, so a",
-    "  deploy afterwards still ships the old ones.",
-    "  --apply writes the tools AND regenerates the stored bundle (what",
-    "  deploy ships), so the next deploy advertises the new spec. If the",
-    "  bundle step fails you are told, and --deploy refuses to ship the",
-    "  stale one; `mcp servers generate <server> --store` repairs it.",
-    "  --apply reconciles: tools match on their stable operation key so",
-    "  renames survive, spec-derived shape is refreshed, and curated fields",
-    "  (description, tags, riskClass, projections, enrichment) are kept.",
-    "  Operations missing from the spec are REPORTED, never deleted.",
-    "  It is lossy for hand-edited input schemas — the spec becomes the",
-    "  truth — which is why it is opt-in."
-  ].join(`
-`)).action(runAction(async (serverRef, opts) => {
-    const cwd = process.cwd();
-    const specPath = isAbsolute2(opts.spec) ? opts.spec : resolve4(cwd, opts.spec);
-    if (!existsSync6(specPath)) {
-      throw new Error(`Spec file not found: ${specPath}`);
-    }
-    const orgId = await resolveOrgId(opts.org);
-    const serverId = await resolveServerId(serverRef, orgId);
-    const target = validateChoice("target", opts.target, DEPLOY_TARGETS);
-    const accessMode = opts.accessMode ? validateChoice("access-mode", opts.accessMode, ACCESS_MODES) : undefined;
-    if (!isJsonMode()) {
-      printStep(`Pushing spec ${c.bold(specPath)} to ${c.bold(serverId)}…`);
-    }
-    const { content } = readSpecFile(specPath);
-    const result = await regenerateDevBundle({
-      applySpec: true,
-      dryRunApply: !opts.apply,
-      organizationId: orgId,
-      serverId,
-      rawSpec: content,
-      sourceType: "openapi",
-      preserveEnrichment: Boolean(opts.enrichOnChange)
-    });
-    if (!result.ok) {
-      const hint = result.code === "insufficient_scope" ? " push-spec --apply regenerates the server’s code, which needs the servers:build scope; mint the key with --preset ci-build or add --scope servers:build." : "";
-      throw new Error(`Spec regen failed: ${result.message} (code: ${result.code})${hint}`);
-    }
-    const summary = summarizeDiff(result.diff);
-    if (!isJsonMode()) {
-      if (!summary.hasChanges) {
-        printInfo(c.dim("  → no tool surface changes; bundle refreshed."));
-      } else {
-        printInfo(`  → ${summary.total} tool change${summary.total === 1 ? "" : "s"} by name${result.applied?.dryRun === false ? "" : " (nothing written)"}:`);
-        printInfo(summary.text);
-      }
-      if (result.applied) {
-        const {
-          dryRun,
-          inserted,
-          removedKeys,
-          unchanged,
-          updated,
-          warnings
-        } = result.applied;
-        printInfo(`  → ${dryRun ? "would apply" : "applied"}: ${updated.length} updated, ${inserted.length} added, ${unchanged} unchanged`);
-        if (removedKeys.length > 0) {
-          printWarn(`  ! ${removedKeys.length} tool(s) no longer in the spec, left in place: ${removedKeys.join(", ")}`);
-        }
-        for (const warning of warnings)
-          printWarn(`  ! ${warning}`);
-        if (!dryRun) {
-          if (result.applied.storedBundle) {
-            printInfo(c.dim("  → stored bundle regenerated; a deploy now ships this spec."));
-          } else {
-            printWarn(`  ! stored bundle NOT regenerated${result.applied.storeError ? `: ${result.applied.storeError}` : ""}. ` + `Deploy ships the stored bundle — run \`mcp servers generate ${serverId} --store\` before deploying.`);
-          }
-        }
-      }
-      if (result.applied?.dryRun) {
-        printInfo(c.dim("  → re-run with --apply to write this to the server’s tools."));
-      }
-      if (result.enrichmentApplied) {
-        printInfo(c.dim("  → preserved per-tool enrichment."));
-      }
-      printSuccess(result.applied && !result.applied.dryRun ? "Spec applied." : "Bundle regenerated (preview).");
-    }
-    const appliedWithoutStore = result.applied !== null && !result.applied.dryRun && result.applied.storedBundle === false;
-    if (!opts.deploy) {
-      if (isJsonMode()) {
-        printJson({
-          applied: result.applied,
-          diff: result.diff,
-          enrichmentApplied: result.enrichmentApplied,
-          pushed: Boolean(result.applied && !result.applied.dryRun)
-        });
-      } else if (appliedWithoutStore) {
-        printInfo(c.dim("  → run `mcp servers generate " + serverId + " --store`, then `mcp servers deploy " + serverId + " --wait` to ship."));
-      } else {
-        printInfo(c.dim("  → run `mcp servers deploy " + serverId + " --wait` (or pass --deploy) to ship."));
-      }
-      return;
-    }
-    if (appliedWithoutStore) {
-      throw new Error(`The spec was applied but the stored bundle was not regenerated${result.applied?.storeError ? ` (${result.applied.storeError})` : ""}. ` + `Run \`mcp servers generate ${serverId} --store\`, then deploy.`);
-    }
+  registerServerPushSpecCommand(servers);
+  registerServerRegenerateCommand(servers);
+}
+async function runDeploy(serverRef, opts) {
+  const target = validateChoice("target", opts.target, DEPLOY_TARGETS);
+  const environment = resolveDeployEnvironment(opts);
+  const accessMode = opts.accessMode ? validateChoice("access-mode", opts.accessMode, ACCESS_MODES) : undefined;
+  const orgId = await resolveOrgId(opts.org);
+  let projectId = await resolveOptionalProjectId(opts.project, orgId);
+  const serverId = await resolveServerId(serverRef, orgId, projectId);
+  if (!projectId) {
     const serverData = await api.get("/api/v1/server", {
       organizationId: orgId,
       serverId
     });
-    const body = {
-      organizationId: orgId,
-      projectId: serverData.server.projectId,
-      serverId,
-      target,
-      ...accessMode ? { accessMode } : {},
-      runtimeConfig: {
-        upstreamBaseUrl: null,
-        upstreamApiKey: null,
-        upstreamApiKeyHeader: null,
-        upstreamApiKeyPrefix: null,
-        upstreamCustomHeaders: null,
-        additionalPlainTextBindings: null,
-        additionalSecretBindings: null
-      }
-    };
-    if (!isJsonMode()) {
-      printStep(`Deploying ${c.bold(serverId)} to ${c.cyan(target)}…`);
-    }
-    const data = await api.post("/api/v1/server/deploy", body);
-    const dep = data.deployment;
-    let terminalEvent = null;
-    let waitDone = !opts.wait;
-    if (opts.wait) {
-      if (isTerminalDeploymentStatus(dep.status)) {
-        waitDone = true;
-      } else {
-        const totalTimeoutMs = Math.max(10, Number.parseInt(opts.waitTimeout, 10) || 300) * 1000;
-        if (!isJsonMode()) {
-          printStep(`Following events for ${c.bold(dep.deploymentId)}…`);
-        }
-        const r = await followDeploymentEvents({
-          organizationId: orgId,
-          deploymentId: dep.deploymentId,
-          totalTimeoutMs,
-          onEvent: (event) => {
-            if (!isJsonMode())
-              printInfo(formatEventLine(event));
-          }
-        });
-        terminalEvent = r.terminalEvent;
-        waitDone = r.done;
-        if (!waitDone && !isJsonMode()) {
-          printError(`Deploy did not reach a terminal state within ${Math.round(totalTimeoutMs / 1000)}s. Check \`mcp deployments get ${dep.deploymentId}\` and \`mcp deployments health ${dep.deploymentId}\`, or tail \`mcp deployments logs ${dep.deploymentId} --follow\`.`);
-        }
-      }
-    }
-    const deployFailed = dep.status === "failed" || Boolean(terminalEvent && isFailureEvent(terminalEvent));
-    let final = dep;
-    if (opts.wait && waitDone) {
-      const row = await refreshDeploymentRow({
-        deploymentId: dep.deploymentId,
-        orgId,
-        serverId
-      });
-      if (row)
-        final = { ...dep, ...row };
-    }
-    if (isJsonMode()) {
-      printJson({
-        pushed: true,
-        diff: result.diff,
-        enrichmentApplied: result.enrichmentApplied,
-        applied: result.applied,
-        deployment: final,
-        waitDone,
-        terminalEvent
-      });
-      if (opts.wait && (!waitDone || deployFailed))
-        throw new CliExitError(1);
-      return;
-    }
-    printSuccess(`Deployment ${c.bold(dep.deploymentId)} created.`);
-    printKeyValue({
-      id: dep.deploymentId,
-      ...final.deploymentUrl ? { url: final.deploymentUrl } : {},
-      target: final.target,
-      "access mode": final.accessMode,
-      status: final.status,
-      health: final.healthStatus,
-      ...terminalEvent ? {
-        "terminal event": `${terminalEvent.stage} (${terminalEvent.level}) — ${terminalEvent.message}`,
-        "terminal at": formatDate(terminalEvent.timestamp)
-      } : {}
-    });
-    if (!accessMode && dep.accessMode === "public" && await isOnlyDeployment({
+    projectId = serverData.server.projectId;
+  }
+  const runtimeConfig = {
+    upstreamBaseUrl: opts.upstreamBaseUrl ?? null,
+    upstreamApiKey: opts.upstreamApiKey ?? null,
+    upstreamApiKeyHeader: opts.upstreamApiKeyHeader ?? null,
+    upstreamApiKeyPrefix: opts.upstreamApiKeyPrefix ?? null,
+    upstreamCustomHeaders: null,
+    additionalPlainTextBindings: null,
+    additionalSecretBindings: null
+  };
+  const body = {
+    organizationId: orgId,
+    projectId,
+    serverId,
+    target,
+    ...accessMode ? { accessMode } : {},
+    ...environment ? { environment } : {},
+    runtimeConfig
+  };
+  if (!isJsonMode()) {
+    printStep(`Deploying ${c.bold(serverId)} to ${c.cyan(target)}${environment ? ` in ${c.cyan(environment)}` : ""}…`);
+  }
+  const data = await api.post("/api/v1/server/deploy", body);
+  const dep = data.deployment;
+  const outcome = await waitForDeploy({
+    deployment: dep,
+    orgId,
+    wait: opts.wait,
+    waitTimeout: opts.waitTimeout,
+    announceTimeout: true
+  });
+  const { terminalEvent, waitDone, deployFailed } = outcome;
+  let final = dep;
+  if (opts.wait && waitDone) {
+    const row = await refreshDeploymentRow({
       deploymentId: dep.deploymentId,
       orgId,
       serverId
-    })) {
-      printWarn("This first deployment is public — anyone with the URL can call it. Redeploy with --access-mode privateOrg or unlisted to require sign-in (recommended when the upstream API needs credentials).");
-    }
-    if (!opts.wait && dep.status === "queued") {
-      printInfo(`Deploy is running in the background — follow with \`mcp deployments get ${dep.deploymentId}\` or rerun with --wait.`);
-    }
-    if (opts.wait && !waitDone)
-      throw new CliExitError(1);
-    if (deployFailed) {
-      if (!reportDeployFailure(terminalEvent)) {
-        printError("Deploy failed.");
-      }
-      throw new CliExitError(1);
-    }
-  }));
-  servers.command("regenerate <server>").description("Re-fetch a server's source spec and rebuild its tools with the current codegen (preserves customizations). Works for spec-URL, OpenAPI, and GraphQL sources; a pasted or manual server has nothing to re-fetch. Wraps POST /api/v1/server/regenerate.").option("--org <organizationId>", "Organization ID").option("--project <project>", "Project (id or name; defaults to the server's project)").option("--source-url <url>", "Override the stored spec source URL (needed for GraphQL servers whose introspection endpoint wasn't persisted)").addHelpText("after", [
-    "",
-    "Regenerate re-introspects/re-parses the source and rebuilds each tool with",
-    "the current codegen, so codegen fixes reach existing servers. It does not",
-    "deploy — run `mcp servers deploy` afterwards to ship the rebuilt bundle.",
-    "",
-    "Examples:",
-    "  # Propagate codegen fixes into an existing server, then deploy:",
-    "  $ mcp servers regenerate srv_123 && mcp servers deploy srv_123 --wait",
-    "",
-    "  # GraphQL server whose introspection endpoint must be supplied:",
-    "  $ mcp servers regenerate srv_123 --source-url https://api.example.com/graphql"
-  ].join(`
-`)).action(runAction(async (serverRef, opts) => {
-    const orgId = await resolveOrgId(opts.org);
-    let projectId = await resolveOptionalProjectId(opts.project, orgId);
-    const serverId = await resolveServerId(serverRef, orgId, projectId);
-    if (!projectId) {
-      const serverData = await api.get("/api/v1/server", { organizationId: orgId, serverId });
-      projectId = serverData.server.projectId;
-    }
-    if (!isJsonMode()) {
-      printStep(`Regenerating ${c.bold(serverId)} from its source spec…`);
-    }
-    const data = await api.post("/api/v1/server/regenerate", {
-      organizationId: orgId,
-      projectId,
-      serverId,
-      ...opts.sourceUrl ? { sourceUrl: opts.sourceUrl } : {}
-    });
-    const r = data.regeneration;
-    if (isJsonMode()) {
-      printJson({ regeneration: r });
-      return;
-    }
-    printSuccess(`Regenerated ${c.bold(serverId)} (${r.sourceType}).`);
-    printKeyValue({
-      "tools updated": String(r.updated),
-      "tools added": String(r.inserted),
-      "tools dropped from spec": String(r.removed),
-      generation: r.generationStatus
     });
-    if (r.removed > 0) {
-      printInfo(c.dim(`  → ${r.removed} operation(s) no longer in the spec were kept, not deleted (removal stays a manual action): ${r.removedKeys.slice(0, 5).join(", ")}`));
-    }
-    printInfo(c.dim(`  → run \`mcp servers deploy ${serverId} --wait\` to ship the regenerated bundle.`));
-  }));
+    if (row)
+      final = { ...dep, ...row };
+  }
+  if (isJsonMode()) {
+    printJson({ deployment: final, waitDone, terminalEvent });
+    if (opts.wait && (!waitDone || deployFailed))
+      throw new CliExitError(1);
+    return;
+  }
+  printSuccess(`Deployment ${c.bold(dep.deploymentId)} created.`);
+  printKeyValue({
+    id: dep.deploymentId,
+    ...environment ? { environment } : {},
+    ...final.deploymentUrl ? { url: final.deploymentUrl } : {},
+    exposure: formatDeploymentExposure(final),
+    "access mode": dep.accessMode,
+    status: final.status,
+    health: final.healthStatus,
+    ...terminalEventFields(terminalEvent)
+  });
+  await finishDeployReport({
+    deployment: dep,
+    accessModeRequested: accessMode,
+    orgId,
+    serverId,
+    wait: opts.wait,
+    outcome
+  });
 }
 
 // src/commands/servers-traces.ts
@@ -9506,20 +9685,9 @@ function registerServerCommands(program) {
   }));
 }
 
-// src/commands/tools-diff.ts
-import { existsSync as existsSync11, readFileSync as readFileSync14 } from "node:fs";
-import { relative } from "node:path";
-
-// src/lib/dev/handlers-sync.ts
-import {
-  existsSync as existsSync10,
-  mkdirSync as mkdirSync7,
-  readFileSync as readFileSync13,
-  statSync,
-  writeFileSync as writeFileSync6
-} from "node:fs";
-import { createHash as createHash3 } from "node:crypto";
-import { dirname as dirname5, join as join8 } from "node:path";
+// src/commands/tools-delete.ts
+import { existsSync as existsSync10 } from "node:fs";
+import { join as join8, relative } from "node:path";
 
 // src/lib/dev/state.ts
 import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync11, writeFileSync as writeFileSync4 } from "node:fs";
@@ -9921,6 +10089,9 @@ async function pushLocalToolEdit(args) {
       return { kind: "missing-file" };
     return { kind: "unknown-tool" };
   }
+  if (local.view.name !== args.toolName) {
+    return { kind: "rename-requested", from: args.toolName, to: local.view.name };
+  }
   const newHash = hashLocalView(local.view);
   if (newHash === local.storedHash) {
     return { kind: "noop" };
@@ -9993,12 +10164,119 @@ async function fetchToolsForServer(args) {
   }));
 }
 
+// src/commands/tools-context.ts
+async function resolveToolsContext(opts = {}) {
+  const cwd = process.cwd();
+  const cached = readState(cwd);
+  const serverRef = opts.serverOverride ?? cached?.serverId;
+  if (!serverRef) {
+    if (opts.requireServer === false)
+      return null;
+    printError("No server selected. Pass --server <server> or run from a directory with .mcpcloud/state.json.");
+    throw new CliExitError(1);
+  }
+  const organizationId = opts.orgOverride ?? cached?.organizationId ?? await resolveOrgId(undefined);
+  const serverId = opts.serverOverride ? await resolveServerId(opts.serverOverride, organizationId) : serverRef;
+  let projectId = cached?.projectId;
+  if (!projectId) {
+    const data = await api.get("/api/v1/server", {
+      organizationId,
+      serverId
+    });
+    projectId = data.server.projectId;
+  }
+  return { organizationId, projectId, serverId };
+}
+
+// src/commands/tools-delete.ts
+var HELP_AFTER2 = [
+  "",
+  "This is the remove-and-re-add route: the tool is deleted, and a later",
+  "`mcp servers push-spec <server> --apply` (or `servers regenerate`) re-creates",
+  "it from the spec as a NEW tool — new id, codegen’s current name. The deleted",
+  "tool’s access grants are removed and its saved test scenarios archived.",
+  "To change only the name and keep the id, grants and scenarios, use",
+  "`mcp tools rename` instead.",
+  "",
+  "The stored bundle is regenerated without the tool; the live server keeps",
+  "serving it until `mcp servers deploy <server> --wait`.",
+  "",
+  "Examples:",
+  "  $ mcp tools delete getrecording --server srv_123 --confirm getrecording"
+];
+function plural(count, noun) {
+  return `${count} ${noun}${count === 1 ? "" : "s"}`;
+}
+function registerToolsDeleteCommand(tools) {
+  tools.command("delete <name>").description('Delete one tool from a server (the remove-and-re-add route). Removes its access grants and archives its saved test scenarios. Requires --confirm "<name>".').option("--org <organizationId>", "Organization ID (defaults to .mcpcloud/state.json)").option("--server <server>", "Server (id, name, or slug; defaults to .mcpcloud/state.json)").option("--confirm <name>", "The exact tool name, typed to confirm the destructive action").addHelpText("after", HELP_AFTER2.join(`
+`)).action(runAction(async (name, opts) => {
+    await runToolsDelete(name, opts);
+  }));
+}
+async function runToolsDelete(toolName, opts) {
+  assertConfirmMatches({
+    entityKind: "tool",
+    entityName: toolName,
+    confirm: opts.confirm
+  });
+  const ctx = await resolveToolsContext({
+    orgOverride: opts.org,
+    serverOverride: opts.server
+  });
+  if (!ctx)
+    return;
+  if (!isJsonMode()) {
+    printStep(`Deleting tool ${c.bold(toolName)} from ${c.bold(ctx.serverId)}…`);
+  }
+  const res = await api.delete("/api/v1/server/tool", {
+    organizationId: ctx.organizationId,
+    serverId: ctx.serverId,
+    toolName
+  });
+  if (isJsonMode()) {
+    printJson(res);
+    return;
+  }
+  printSuccess(`Deleted tool ${c.bold(res.deleted.name)} (${res.deleted.toolId}) from ${c.bold(ctx.serverId)}.`);
+  printInfo(`  Removed ${plural(res.removed.accessGrants, "access grant")}; archived ${plural(res.removed.testScenarios, "saved scenario")}.`);
+  if (res.references.length > 0) {
+    printWarn(`${plural(res.references.length, "reference")} still ${res.references.length === 1 ? "points" : "point"} at ${res.deleted.name} — update ${res.references.length === 1 ? "it" : "them"} by hand:`);
+    for (const ref of res.references) {
+      printInfo(`    ${ref.kind.padEnd(11)} ${ref.name} (${ref.id})${ref.detail ? ` — ${ref.detail}` : ""}`);
+    }
+  }
+  if (res.storedBundle) {
+    printInfo(c.dim("  → stored bundle regenerated without it."));
+  } else {
+    printWarn(`stored bundle NOT regenerated${res.storeError ? `: ${res.storeError}` : ""}. ` + `Run \`mcp servers generate ${ctx.serverId} --store\` before deploying.`);
+  }
+  printInfo(`  → The live server still serves ${res.deleted.name}. Run ${c.bold(`mcp servers deploy ${ctx.serverId} --wait`)} to remove it there.`);
+  const cwd = process.cwd();
+  const localFile = join8(serverToolsDir(devRoot(cwd), ctx.serverId), `${res.deleted.name}.md`);
+  if (existsSync10(localFile)) {
+    printInfo(`  → ${relative(cwd, localFile)} is now stale — run ${c.bold(`mcp tools pull --server ${ctx.serverId}`)} to remove it.`);
+  }
+}
+
+// src/commands/tools-diff.ts
+import { existsSync as existsSync12, readFileSync as readFileSync14 } from "node:fs";
+import { relative as relative2 } from "node:path";
+
 // src/lib/dev/handlers-sync.ts
+import {
+  existsSync as existsSync11,
+  mkdirSync as mkdirSync7,
+  readFileSync as readFileSync13,
+  statSync,
+  writeFileSync as writeFileSync6
+} from "node:fs";
+import { createHash as createHash3 } from "node:crypto";
+import { dirname as dirname5, join as join9 } from "node:path";
 function toKebabSlug(value) {
   return value.replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/[^a-zA-Z0-9]+/g, "-").replace(/^-+|-+$/g, "").toLowerCase() || "generated-mcp-server";
 }
 function serverBundleHandlersDir(devRootDir) {
-  return join8(devRootDir, "server", "src", "tools");
+  return join9(devRootDir, "server", "src", "tools");
 }
 function handlerSlugFromWatcherPath(rel) {
   if (!rel)
@@ -10027,8 +10305,8 @@ function hashSource(source) {
 }
 var lastPushedHash = new Map;
 async function pushLocalHandlerEdit(args) {
-  const filePath = join8(serverBundleHandlersDir(args.devRootDir), `${args.slug}.ts`);
-  if (!existsSync10(filePath)) {
+  const filePath = join9(serverBundleHandlersDir(args.devRootDir), `${args.slug}.ts`);
+  if (!existsSync11(filePath)) {
     return { kind: "missing-file" };
   }
   const resolved = resolveToolFromSlug(args.devRootDir, args.serverId, args.slug);
@@ -10179,7 +10457,7 @@ async function resetCloudHandler(args) {
   }
 }
 function writeLocalHandlerFromCloud(args) {
-  const filePath = join8(serverBundleHandlersDir(args.devRootDir), `${args.slug}.ts`);
+  const filePath = join9(serverBundleHandlersDir(args.devRootDir), `${args.slug}.ts`);
   mkdirSync7(dirname5(filePath), { recursive: true });
   writeFileSync6(filePath, args.content, "utf-8");
   lastPushedHash.set(filePath, hashSource(args.content));
@@ -10190,8 +10468,8 @@ function handlerSlugFromToolName(toolName) {
 }
 var RECENT_EDIT_WINDOW_MS = 5 * 60 * 1000;
 function inspectLocalHandler(args) {
-  const filePath = join8(serverBundleHandlersDir(args.devRootDir), `${args.slug}.ts`);
-  if (!existsSync10(filePath))
+  const filePath = join9(serverBundleHandlersDir(args.devRootDir), `${args.slug}.ts`);
+  if (!existsSync11(filePath))
     return { kind: "no-local-file" };
   const cached = lastPushedHash.get(filePath);
   const onDisk = hashSource(readFileSync13(filePath, "utf-8"));
@@ -10223,30 +10501,6 @@ async function fetchHandlerOverrideStatuses(args) {
   }));
 }
 
-// src/commands/tools-context.ts
-async function resolveToolsContext(opts = {}) {
-  const cwd = process.cwd();
-  const cached = readState(cwd);
-  const serverRef = opts.serverOverride ?? cached?.serverId;
-  if (!serverRef) {
-    if (opts.requireServer === false)
-      return null;
-    printError("No server selected. Pass --server <server> or run from a directory with .mcpcloud/state.json.");
-    throw new CliExitError(1);
-  }
-  const organizationId = opts.orgOverride ?? cached?.organizationId ?? await resolveOrgId(undefined);
-  const serverId = opts.serverOverride ? await resolveServerId(opts.serverOverride, organizationId) : serverRef;
-  let projectId = cached?.projectId;
-  if (!projectId) {
-    const data = await api.get("/api/v1/server", {
-      organizationId,
-      serverId
-    });
-    projectId = data.server.projectId;
-  }
-  return { organizationId, projectId, serverId };
-}
-
 // src/commands/tools-diff.ts
 function registerToolsDiffCommand(tools) {
   tools.command("diff <name>").description("Compare a tool's local files (metadata .md + handler .ts) against the cloud version.").option("--org <organizationId>", "Organization ID (defaults to .mcpcloud/state.json)").option("--server <server>", "Server (id, name, or slug; defaults to .mcpcloud/state.json)").option("--metadata-only", "Skip the handler-source diff (faster — only one cloud round-trip).", false).option("--handler-only", "Skip the metadata diff (only compare the .ts handler).", false).addHelpText("after", [
@@ -10325,7 +10579,7 @@ async function runToolsDiff(args) {
 }
 function buildMetadataDiff(args) {
   const filePath = `${serverToolsDir(args.devRootDir, args.serverId)}/${args.cloud.name}.md`;
-  if (!existsSync11(filePath)) {
+  if (!existsSync12(filePath)) {
     return {
       hasLocal: false,
       localPath: null,
@@ -10335,7 +10589,7 @@ function buildMetadataDiff(args) {
       diff: {}
     };
   }
-  const rel = relative(args.cwd, filePath) || filePath;
+  const rel = relative2(args.cwd, filePath) || filePath;
   let local = null;
   let parseError = null;
   try {
@@ -10381,9 +10635,9 @@ async function buildHandlerDiff(args) {
   }
   const slug = handlerSlugFromToolName(args.toolName);
   const filePath = `${serverBundleHandlersDir(args.devRootDir)}/${slug}.ts`;
-  const hasLocal = existsSync11(filePath);
+  const hasLocal = existsSync12(filePath);
   const localContent = hasLocal ? readFileSync14(filePath, "utf-8") : null;
-  const localPath = hasLocal ? relative(args.cwd, filePath) || filePath : null;
+  const localPath = hasLocal ? relative2(args.cwd, filePath) || filePath : null;
   const changed = hasLocal ? localContent !== cloudResult.snapshot.content : true;
   return {
     kind: "ok",
@@ -10492,18 +10746,18 @@ function renderBool(value) {
 }
 
 // src/commands/tools-edit.ts
-import { existsSync as existsSync13 } from "node:fs";
-import { join as join10, relative as relative2 } from "node:path";
+import { existsSync as existsSync14 } from "node:fs";
+import { join as join11, relative as relative3 } from "node:path";
 
 // src/lib/editor-shell.ts
 import { spawn as spawn2 } from "node:child_process";
-import { existsSync as existsSync12, readFileSync as readFileSync15 } from "node:fs";
+import { existsSync as existsSync13, readFileSync as readFileSync15 } from "node:fs";
 import { platform as platform2 } from "node:os";
-import { delimiter, join as join9 } from "node:path";
+import { delimiter, join as join10 } from "node:path";
 var DEFAULT_FALLBACKS = ["vi"];
 function isExecutableFile(path) {
   try {
-    return existsSync12(path);
+    return existsSync13(path);
   } catch {
     return false;
   }
@@ -10520,7 +10774,7 @@ function findOnPath(command) {
     if (!dir)
       continue;
     for (const ext of exts) {
-      const candidate = join9(dir, command + ext);
+      const candidate = join10(dir, command + ext);
       if (isExecutableFile(candidate))
         return candidate;
     }
@@ -10548,7 +10802,7 @@ function defaultRun(cmd, args) {
   });
 }
 async function runEditor(args) {
-  if (!existsSync12(args.filePath)) {
+  if (!existsSync13(args.filePath)) {
     return {
       ok: false,
       reason: "file-missing",
@@ -10616,13 +10870,13 @@ async function runToolsEdit(args) {
   if (!ctx)
     return;
   const cwd = process.cwd();
-  const filePath = join10(serverToolsDir(devRoot(cwd), ctx.serverId), `${args.toolName}.md`);
-  if (!existsSync13(filePath)) {
-    printError(`Tool file not found: ${relative2(cwd, filePath)}`);
+  const filePath = join11(serverToolsDir(devRoot(cwd), ctx.serverId), `${args.toolName}.md`);
+  if (!existsSync14(filePath)) {
+    printError(`Tool file not found: ${relative3(cwd, filePath)}`);
     printInfo(`  ${c.dim("Run")} ${c.bold(`mcp tools pull ${args.toolName}`)} ${c.dim("first to materialize it, or check the name is spelled correctly.")}`);
     throw new CliExitError(1);
   }
-  printStep(`Opening ${c.bold(relative2(cwd, filePath))} in editor…`);
+  printStep(`Opening ${c.bold(relative3(cwd, filePath))} in editor…`);
   const editorResult = await runEditor({
     filePath,
     ...args.editorOverride ? { command: args.editorOverride } : {}
@@ -10655,6 +10909,12 @@ async function runToolsEdit(args) {
       printInfo(`  ${c.dim("Re-open and fix the file, or run")} ${c.bold(`mcp tools pull ${args.toolName}`)} ${c.dim("to reset.")}`);
       throw new CliExitError(1);
       return;
+    case "rename-requested":
+      printError(`The name isn't changed by editing ${args.toolName}.md (you changed \`name:\` to ${c.bold(push.to)}) — nothing was pushed.`);
+      printInfo(`  ${c.dim("Rename it with")} ${c.bold(`mcp tools rename ${push.from} ${push.to} --server ${ctx.serverId}`)}${c.dim(", then")} ${c.bold(`mcp tools pull --server ${ctx.serverId}`)} ${c.dim("to refresh the local files.")}`);
+      printInfo(`  ${c.dim(`To push your other edits, set \`name:\` back to ${push.from} and save again.`)}`);
+      throw new CliExitError(1);
+      return;
     case "patched":
       if (isJsonMode()) {
         printJson({ ok: true, updatedAt: push.updatedAt, changedFields: push.changedFields });
@@ -11204,7 +11464,7 @@ async function runToolsHandlersList(args) {
 }
 
 // src/commands/tools-pull.ts
-import { relative as relative3 } from "node:path";
+import { relative as relative4 } from "node:path";
 function registerToolsPullCommand(tools) {
   tools.command("pull [name]").description("Refresh local tool files from the cloud, overwriting any unsaved local edits. Use after `409 conflict` to re-sync.").option("--org <organizationId>", "Organization ID (defaults to .mcpcloud/state.json)").option("--server <server>", "Server (id, name, or slug; defaults to .mcpcloud/state.json)").option("--all", "Refresh every tool for the server (default when no name given)").addHelpText("after", [
     "",
@@ -11268,7 +11528,7 @@ async function runToolsPull(args) {
     });
     return;
   }
-  const dirRel = relative3(cwd, serverToolsDir(dest, ctx.serverId)) || ".";
+  const dirRel = relative4(cwd, serverToolsDir(dest, ctx.serverId)) || ".";
   printSuccess(`Pulled ${result.filesWritten} tool${result.filesWritten === 1 ? "" : "s"} to ${c.bold(dirRel + "/")}.`);
   if (args.toolName) {
     printInfo(`  ${c.dim("Edit the .md file and re-save to push your changes back.")}`);
@@ -11278,7 +11538,7 @@ async function runToolsPull(args) {
 }
 
 // src/commands/tools-pull-handler.ts
-import { relative as relative4 } from "node:path";
+import { relative as relative5 } from "node:path";
 function registerToolsPullHandlerCommand(tools) {
   tools.command("pull-handler <name>").description("Refresh a tool's handler source from the cloud, overwriting any local edits. Use after `409 conflict` to re-sync.").option("--org <organizationId>", "Organization ID (defaults to .mcpcloud/state.json)").option("--server <server>", "Server (id, name, or slug; defaults to .mcpcloud/state.json)").option("--force", "Overwrite local file even if it has unsaved changes (default: refuse).", false).addHelpText("after", [
     "",
@@ -11365,7 +11625,7 @@ async function runPullHandler(args) {
     });
     return;
   }
-  const fileRel = relative4(cwd, written) || written;
+  const fileRel = relative5(cwd, written) || written;
   printSuccess(`Pulled handler for ${c.bold(result.snapshot.toolName)} (version ${result.snapshot.version}) to ${c.bold(fileRel)}.`);
   if (result.snapshot.isDefault) {
     printInfo(`  ${c.dim("Status: default (matches codegen output).")}`);
@@ -11376,8 +11636,274 @@ async function runPullHandler(args) {
   printInfo(`  ${c.dim("Re-save the file to push your changes back.")}`);
 }
 
+// src/commands/tools-rename.ts
+import { existsSync as existsSync16 } from "node:fs";
+import { relative as relative6 } from "node:path";
+
+// src/commands/tools-rename-input.ts
+import { existsSync as existsSync15, readFileSync as readFileSync16 } from "node:fs";
+import { isAbsolute as isAbsolute3, resolve as resolve7 } from "node:path";
+var MODES_HINT = "Pass exactly one of: <old> <new>, --from-operation-ids, or --map @renames.json.";
+function resolveRenameSelection(args) {
+  const positional = args.oldName !== undefined || args.newName !== undefined;
+  const modes = [positional, Boolean(args.fromOperationIds), args.map !== undefined];
+  const chosen = modes.filter(Boolean).length;
+  if (chosen === 0)
+    throw new CliExitError(1, `Nothing to rename. ${MODES_HINT}`);
+  if (chosen > 1)
+    throw new CliExitError(1, `Choose one way to rename. ${MODES_HINT}`);
+  if (args.fromOperationIds)
+    return { fromOperationIds: true };
+  if (args.map !== undefined) {
+    return { renames: readRenameMap(args.map, args.cwd) };
+  }
+  const from = args.oldName?.trim() ?? "";
+  const to = args.newName?.trim() ?? "";
+  if (!from || !to) {
+    throw new CliExitError(1, "Pass both the current name and the new one: mcp tools rename <old> <new> --server <server>.");
+  }
+  if (from === to) {
+    throw new CliExitError(1, `"${from}" is already the tool's name.`);
+  }
+  return { renames: [{ from, to }] };
+}
+function readRenameMap(ref, cwd) {
+  const raw = ref.trim().replace(/^@/, "");
+  if (!raw)
+    throw new CliExitError(1, "--map needs a file path, e.g. --map @renames.json.");
+  const path = isAbsolute3(raw) ? raw : resolve7(cwd, raw);
+  if (!existsSync15(path))
+    throw new CliExitError(1, `--map file not found: ${path}`);
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync16(path, "utf-8"));
+  } catch (err) {
+    throw new CliExitError(1, `--map file is not valid JSON (${path}): ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const pairs = parseRenameMap(parsed);
+  if (pairs.length === 0) {
+    throw new CliExitError(1, `--map file lists no renames: ${path}`);
+  }
+  return pairs;
+}
+var MAP_SHAPE = 'Expected {"oldName": "newName", …} or [{"from": "oldName", "to": "newName"}, …].';
+function parseRenameMap(value) {
+  const entries = Array.isArray(value) ? value.map((item) => {
+    if (!item || typeof item !== "object") {
+      throw new CliExitError(1, `--map entry is not an object. ${MAP_SHAPE}`);
+    }
+    const record = item;
+    return [record["from"], record["to"]];
+  }) : value && typeof value === "object" ? Object.entries(value) : (() => {
+    throw new CliExitError(1, `--map file has the wrong shape. ${MAP_SHAPE}`);
+  })();
+  return entries.map(([from, to]) => {
+    if (typeof from !== "string" || !from.trim()) {
+      throw new CliExitError(1, `--map entry has no current name. ${MAP_SHAPE}`);
+    }
+    if (typeof to !== "string" || !to.trim()) {
+      throw new CliExitError(1, `--map entry for "${from}" has no new name. ${MAP_SHAPE}`);
+    }
+    return { from: from.trim(), to: to.trim() };
+  });
+}
+
+// src/commands/tools-rename-report.ts
+var SKIP_LABELS = {
+  already_named: "already named",
+  custom_name: "custom name, kept",
+  graphql: "GraphQL tool",
+  ambiguous: "ambiguous"
+};
+function plural2(count, noun) {
+  return `${count} ${noun}${count === 1 ? "" : "s"}`;
+}
+function printRenameReport(res, ctx) {
+  const { serverId } = ctx;
+  if (res.renamed.length === 0) {
+    printSuccess(ctx.fromOperationIds ? `Nothing to rename on ${c.bold(serverId)} — no tool name differs from its operationId only by case.` : `Nothing to rename on ${c.bold(serverId)}.`);
+  } else {
+    const count = plural2(res.renamed.length, "tool");
+    printSuccess(res.dryRun ? `Would rename ${count} on ${c.bold(serverId)} — dry run, nothing written.` : `Renamed ${count} on ${c.bold(serverId)}.`);
+    for (const entry of res.renamed)
+      printInfo(`    ${entry.from} → ${entry.to}`);
+  }
+  printSkipped(res.skipped);
+  if (res.renamed.length > 0)
+    printCarried(res);
+  printReferences(res.references, serverId);
+  if (res.droppedHandlerOverrides.length > 0) {
+    printWarn(`${res.dryRun ? "Would drop" : "Dropped"} ${plural2(res.droppedHandlerOverrides.length, "edited handler override")} (the handler is regenerated from the spec): ${res.droppedHandlerOverrides.map((entry) => `${entry.toolName} (${entry.path})`).join(", ")}`);
+  }
+  if (res.renamed.length === 0)
+    return;
+  if (res.dryRun) {
+    printInfo(c.dim("  → re-run without --dry-run to apply."));
+    return;
+  }
+  printNextSteps(res, ctx);
+}
+function printSkipped(skipped) {
+  if (skipped.length === 0)
+    return;
+  printInfo(`  Skipped ${plural2(skipped.length, "tool")}:`);
+  const groups = new Map;
+  for (const entry of skipped) {
+    const bucket = groups.get(entry.reason);
+    if (bucket)
+      bucket.push(entry);
+    else
+      groups.set(entry.reason, [entry]);
+  }
+  for (const [reason, entries] of groups) {
+    const label = SKIP_LABELS[reason] ?? reason;
+    const names = entries.map((entry) => reason === "custom_name" && entry.codegenName ? `${entry.name} (codegen: ${entry.codegenName})` : entry.name);
+    printInfo(`    ${label} (${entries.length}): ${formatNameList(names)}`);
+    if (reason === "ambiguous") {
+      for (const entry of entries) {
+        if (entry.detail)
+          printInfo(c.dim(`      ${entry.name}: ${entry.detail}`));
+      }
+    }
+  }
+}
+function printCarried(res) {
+  const { accessGrants, testScenarios, compositions } = res.carried;
+  printInfo(`  ${res.dryRun ? "Would carry" : "Carried"} to the new names: ` + `${plural2(accessGrants, "access grant")}, ` + `${plural2(testScenarios, "saved test scenario")}, ` + `${plural2(compositions, "composition reference")}.`);
+}
+function printReferences(references, serverId) {
+  if (references.length === 0)
+    return;
+  const prompts = references.filter((ref) => ref.kind === "prompt").length;
+  const skills = references.length - prompts;
+  const subject = [
+    prompts > 0 ? plural2(prompts, "prompt") : null,
+    skills > 0 ? plural2(skills, "skill") : null
+  ].filter(Boolean).join(" and ");
+  printWarn(`${subject} still ${references.length === 1 ? "mentions" : "mention"} an old tool name — that text is not rewritten; update it by hand:`);
+  for (const ref of references) {
+    printInfo(`    ${ref.kind.padEnd(6)} ${ref.name} (${ref.id}): ${ref.toolNames.join(", ")}`);
+  }
+  printInfo(c.dim(`    prompts: \`mcp servers prompts set ${serverId} <name>\` · skills: \`mcp skills set-content <skill>\``));
+}
+function printNextSteps(res, ctx) {
+  if (res.storedBundle) {
+    printInfo(c.dim("  → stored bundle regenerated with the new names."));
+  } else {
+    printWarn(`stored bundle NOT regenerated${res.storeError ? `: ${res.storeError}` : ""}. ` + `Run \`mcp servers generate ${ctx.serverId} --store\` before deploying.`);
+  }
+  printInfo(`  → The live server still serves the old names. Run ${c.bold(`mcp servers deploy ${ctx.serverId} --wait`)} to ship the new ones — after that, agents calling an old name get unknown-tool.`);
+  if (ctx.localToolsDir) {
+    printInfo(`  → Local tool files in ${ctx.localToolsDir}/ still use the old names — run ${c.bold(`mcp tools pull --server ${ctx.serverId}`)} to refresh them.`);
+  }
+}
+
+// src/commands/tools-rename.ts
+var HELP_AFTER3 = [
+  "",
+  "A rename keeps the tool id, so what points at the tool follows it: end-user",
+  "and RBAC access grants, saved test scenarios, and parent-server composition",
+  "allowlists are rewritten to the new name. Prompt and skill TEXT is not — the",
+  "report lists what still mentions an old name.",
+  "",
+  "The stored bundle is regenerated with the new names; the LIVE server keeps",
+  "the old ones until `mcp servers deploy <server> --wait`. After that deploy an",
+  "agent calling an old name gets unknown-tool.",
+  "",
+  "--from-operation-ids adopts the current naming rule: codegen now keeps the",
+  "operationId's case (getRecording), where servers created earlier were named",
+  "getrecording. Only names that differ from codegen by case are renamed; a",
+  "custom name is kept and reported. A tool with an edited handler override is",
+  "refused unless --drop-handler-overrides discards the override.",
+  "",
+  "Examples:",
+  "  $ mcp tools rename getrecording getRecording --server srv_123",
+  "  $ mcp tools rename --from-operation-ids --server srv_123 --dry-run",
+  "  $ mcp tools rename --map @renames.json --server srv_123",
+  '  # renames.json: {"getrecording": "getRecording"} or [{"from": "…", "to": "…"}]'
+];
+function registerToolsRenameCommand(tools) {
+  tools.command("rename [old] [new]").description("Rename tools on a server, keeping their ids — access grants, saved test scenarios and composition references follow. Regenerates the stored bundle; deploy to ship the new names.").option("--org <organizationId>", "Organization ID (defaults to .mcpcloud/state.json)").option("--server <server>", "Server (id, name, or slug; defaults to .mcpcloud/state.json)").option("--dry-run", "Report what would be renamed; nothing is written").option("--from-operation-ids", "Rename every OpenAPI tool whose name differs from its operationId only by case (getrecording → getRecording)").option("--map <file>", 'Rename several tools from a JSON file (@renames.json): {"old": "new", …} or [{"from", "to"}, …]').option("--drop-handler-overrides", "Allow renaming tools that carry an edited handler override by discarding the override (it is regenerated from the spec)").addHelpText("after", HELP_AFTER3.join(`
+`)).action(runAction(async (oldName, newName, opts) => {
+    await runToolsRename(oldName, newName, opts);
+  }));
+}
+async function runToolsRename(oldName, newName, opts) {
+  const cwd = process.cwd();
+  const selection = resolveRenameSelection({
+    oldName,
+    newName,
+    fromOperationIds: opts.fromOperationIds,
+    map: opts.map,
+    cwd
+  });
+  const ctx = await resolveToolsContext({
+    orgOverride: opts.org,
+    serverOverride: opts.server
+  });
+  if (!ctx)
+    return;
+  if (!isJsonMode()) {
+    printStep(`${opts.dryRun ? "Previewing renames" : "Renaming tools"} on ${c.bold(ctx.serverId)}…`);
+  }
+  let res;
+  try {
+    res = await api.post("/api/v1/server/tools/rename", {
+      organizationId: ctx.organizationId,
+      serverId: ctx.serverId,
+      ...selectionBody(selection),
+      ...opts.dryRun ? { dryRun: true } : {},
+      ...opts.dropHandlerOverrides ? { dropHandlerOverrides: true } : {}
+    });
+  } catch (err) {
+    if (!isJsonMode())
+      reportRenameRefusal(err, ctx.serverId);
+    throw err;
+  }
+  if (isJsonMode()) {
+    printJson(res);
+    return;
+  }
+  const localDir = serverToolsDir(devRoot(cwd), ctx.serverId);
+  printRenameReport(res, {
+    serverId: ctx.serverId,
+    fromOperationIds: "fromOperationIds" in selection,
+    localToolsDir: existsSync16(localDir) ? relative6(cwd, localDir) || "." : null
+  });
+}
+function selectionBody(selection) {
+  return "fromOperationIds" in selection ? { fromOperationIds: true } : { renames: selection.renames };
+}
+var PROBLEM_HINTS = {
+  tool_not_found: (serverId) => `\`mcp tools list --server ${serverId}\` shows the current names.`,
+  handler_override: () => "Re-run with --drop-handler-overrides to discard the edited handler (it is regenerated from the spec), or pull it first with `mcp tools pull-handler`.",
+  name_conflict: () => "Pick a name no other tool on the server uses.",
+  codegen_name_taken: () => "Codegen gives that name to a different operation in the spec, so this tool would inherit that operation's schema — choose another name."
+};
+function reportRenameRefusal(err, serverId) {
+  if (!(err instanceof McpCloudApiError))
+    return;
+  if (err.error.code !== "tool_rename_invalid")
+    return;
+  const problems = err.error.details?.["problems"];
+  if (!Array.isArray(problems) || problems.length === 0)
+    return;
+  printError("Rename refused — nothing was changed:");
+  const hints = new Set;
+  for (const raw of problems) {
+    const pair = raw.to ? `${raw.from} → ${raw.to}` : raw.from;
+    printInfo(`  ${pair}: ${raw.message} (${raw.code})`);
+    const hint = PROBLEM_HINTS[raw.code];
+    if (hint)
+      hints.add(hint(serverId));
+  }
+  for (const hint of hints)
+    printInfo(c.dim(`  → ${hint}`));
+  throw new CliExitError(1);
+}
+
 // src/commands/tools-reset-handler.ts
-import { relative as relative5 } from "node:path";
+import { relative as relative7 } from "node:path";
 function registerToolsResetHandlerCommand(tools) {
   tools.command("reset-handler <name>").description("Drop the cloud handler override for a tool and re-materialize the codegen default. Prompts to confirm unless --yes is passed.").option("--org <organizationId>", "Organization ID (defaults to .mcpcloud/state.json)").option("--server <server>", "Server (id, name, or slug; defaults to .mcpcloud/state.json)").option("--yes", "Skip the confirmation prompt", false).option("--force", "Overwrite local file even if it has unsaved changes (default: refuse).", false).addHelpText("after", [
     "",
@@ -11488,7 +12014,7 @@ async function runResetHandler(args) {
     });
     return;
   }
-  const fileRel = relative5(cwd, written) || written;
+  const fileRel = relative7(cwd, written) || written;
   if (result.snapshot.alreadyDefault) {
     printSuccess(`Handler for ${c.bold(result.snapshot.toolName)} was already at the codegen default (no content change). Local file refreshed at ${c.bold(fileRel)}.`);
   } else {
@@ -11498,7 +12024,7 @@ async function runResetHandler(args) {
 }
 
 // src/commands/tools-show.ts
-import { existsSync as existsSync14 } from "node:fs";
+import { existsSync as existsSync17 } from "node:fs";
 function registerToolsShowCommand(tools) {
   tools.command("show <name>").description("Show a tool's full applied metadata (and any pending AI suggestion).").option("--org <organizationId>", "Organization ID (defaults to .mcpcloud/state.json)").option("--server <server>", "Server (id, name, or slug; defaults to .mcpcloud/state.json)").action(runAction(async (name, opts) => {
     await runToolsShow({
@@ -11526,7 +12052,7 @@ async function runToolsShow(args) {
     throw new CliExitError(1);
   }
   const devRootDir = devRoot(process.cwd());
-  const inDevTree = existsSync14(devRootDir);
+  const inDevTree = existsSync17(devRootDir);
   const [detailed, handlerResult] = await Promise.all([
     fetchEnrichedToolDetail({
       organizationId: ctx.organizationId,
@@ -11669,6 +12195,8 @@ function registerToolCommands(program) {
   registerToolsShowCommand(tools);
   registerToolsDiffCommand(tools);
   registerToolsEditCommand(tools);
+  registerToolsRenameCommand(tools);
+  registerToolsDeleteCommand(tools);
   registerToolsEnrichCommand(tools);
   registerToolsPullCommand(tools);
   registerToolsPullHandlerCommand(tools);
@@ -11826,13 +12354,13 @@ function isAgentKey(value) {
 }
 
 // src/commands/skills-lifecycle.ts
-import { readFileSync as readFileSync16 } from "node:fs";
+import { readFileSync as readFileSync17 } from "node:fs";
 function readValueOption2(raw) {
   if (raw === "@-") {
-    return readFileSync16(0, "utf8");
+    return readFileSync17(0, "utf8");
   }
   if (raw.startsWith("@")) {
-    return readFileSync16(raw.slice(1), "utf8");
+    return readFileSync17(raw.slice(1), "utf8");
   }
   return raw;
 }
@@ -12182,7 +12710,7 @@ function registerSkillMutationCommands(skills) {
 }
 
 // src/commands/skills-test-authoring.ts
-import { readFileSync as readFileSync17 } from "node:fs";
+import { readFileSync as readFileSync18 } from "node:fs";
 var FIXTURE_MODES = [
   "baseline",
   "validationFailure",
@@ -12191,9 +12719,9 @@ var FIXTURE_MODES = [
 ];
 function readValueOption3(raw) {
   if (raw === "@-")
-    return readFileSync17(0, "utf8");
+    return readFileSync18(0, "utf8");
   if (raw.startsWith("@"))
-    return readFileSync17(raw.slice(1), "utf8");
+    return readFileSync18(raw.slice(1), "utf8");
   return raw;
 }
 function parseAssertionsOption(raw) {
@@ -12760,14 +13288,14 @@ function registerSkillInstallCommand(skills) {
 
 // src/commands/skills-pull.ts
 import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync7 } from "node:fs";
-import { dirname as dirname6, isAbsolute as isAbsolute3, join as join11, resolve as resolve7 } from "node:path";
+import { dirname as dirname6, isAbsolute as isAbsolute4, join as join12, resolve as resolve8 } from "node:path";
 function formatBytes2(bytes) {
   if (bytes < 1024)
     return `${bytes} B`;
   return `${(bytes / 1024).toFixed(1)} KB`;
 }
 function assertSafeRelativePath2(path) {
-  if (isAbsolute3(path) || path.split(/[\\/]/).includes("..")) {
+  if (isAbsolute4(path) || path.split(/[\\/]/).includes("..")) {
     throw new Error(`Refusing to write unsafe package path: ${path}`);
   }
 }
@@ -12788,10 +13316,10 @@ function registerSkillPullCommand(skills) {
       registryArtifactId,
       ...opts.skillVersion ? { version: opts.skillVersion } : {}
     });
-    const dir = resolve7(opts.output ?? `./${result.skill.slug}`);
+    const dir = resolve8(opts.output ?? `./${result.skill.slug}`);
     for (const file of result.files) {
       assertSafeRelativePath2(file.path);
-      const full = join11(dir, file.path);
+      const full = join12(dir, file.path);
       mkdirSync8(dirname6(full), { recursive: true });
       writeFileSync7(full, file.content);
     }
@@ -12809,12 +13337,12 @@ function registerSkillPullCommand(skills) {
     const missing = result.dependencies.filter((entry) => !entry.installed);
     if (result.dependencies.length === 0) {
       printKeyValue({
-        Next: `Copy ${join11(dir, "SKILL.md")} into the skills directory your agent reads.`
+        Next: `Copy ${join12(dir, "SKILL.md")} into the skills directory your agent reads.`
       });
       return;
     }
     printKeyValue({
-      Next: `Copy ${join11(dir, "SKILL.md")} into the skills directory your agent reads.`,
+      Next: `Copy ${join12(dir, "SKILL.md")} into the skills directory your agent reads.`,
       Servers: result.dependencies.map((entry) => `${entry.name}${entry.installed ? "" : " (not installed)"}`).join(", ")
     });
     if (missing.length > 0) {
@@ -13246,18 +13774,18 @@ function registerSkillCommands(program) {
 }
 
 // src/lib/dev/prepare.ts
-import { existsSync as existsSync21, readFileSync as readFileSync21, writeFileSync as writeFileSync12 } from "node:fs";
-import { join as join18, relative as relative6, resolve as resolve8 } from "node:path";
+import { existsSync as existsSync24, readFileSync as readFileSync22, writeFileSync as writeFileSync12 } from "node:fs";
+import { join as join19, relative as relative8, resolve as resolve9 } from "node:path";
 
 // src/lib/dev/bundle-sync.ts
 import {
-  existsSync as existsSync15,
+  existsSync as existsSync18,
   mkdirSync as mkdirSync9,
-  readFileSync as readFileSync18,
+  readFileSync as readFileSync19,
   rmSync as rmSync2,
   writeFileSync as writeFileSync8
 } from "node:fs";
-import { dirname as dirname7, join as join12 } from "node:path";
+import { dirname as dirname7, join as join13 } from "node:path";
 async function resolveServerProject(args) {
   const data = await api.get("/api/v1/server", {
     organizationId: args.organizationId,
@@ -13318,7 +13846,7 @@ async function fetchBundle(args) {
   return parsed;
 }
 function materializeBundle(destDir, bundle, options = {}) {
-  if (!existsSync15(destDir)) {
+  if (!existsSync18(destDir)) {
     mkdirSync9(destDir, { recursive: true });
   }
   const preserve = options.preservePaths;
@@ -13334,7 +13862,7 @@ function materializeBundle(destDir, bundle, options = {}) {
       preservedCount += 1;
       continue;
     }
-    const target = join12(destDir, safePath);
+    const target = join13(destDir, safePath);
     mkdirSync9(dirname7(target), { recursive: true });
     writeFileSync8(target, file.content, "utf-8");
     writtenCount += 1;
@@ -13364,7 +13892,7 @@ function pruneStaleFiles(rootDir, currentDir, kept) {
   const { relative } = __require("node:path");
   let removed = 0;
   for (const entry of readdirSync(currentDir)) {
-    const abs = join12(currentDir, entry);
+    const abs = join13(currentDir, entry);
     const stat = statSync(abs);
     if (stat.isDirectory()) {
       removed += pruneStaleFiles(rootDir, abs, kept);
@@ -13388,12 +13916,12 @@ function pruneStaleFiles(rootDir, currentDir, kept) {
 // src/lib/dev/git-clone.ts
 import { spawnSync } from "node:child_process";
 import {
-  existsSync as existsSync16,
+  existsSync as existsSync19,
   mkdirSync as mkdirSync10,
-  readFileSync as readFileSync19,
+  readFileSync as readFileSync20,
   writeFileSync as writeFileSync9
 } from "node:fs";
-import { dirname as dirname8, join as join13 } from "node:path";
+import { dirname as dirname8, join as join14 } from "node:path";
 
 class GitNotAvailableError extends Error {
   constructor() {
@@ -13484,12 +14012,12 @@ function isGitAvailable() {
   }
 }
 function applyLocalExcludes(repoDir) {
-  const excludePath = join13(repoDir, ".git", "info", "exclude");
-  const existing = existsSync16(excludePath) ? readFileSync19(excludePath, "utf-8") : "";
+  const excludePath = join14(repoDir, ".git", "info", "exclude");
+  const existing = existsSync19(excludePath) ? readFileSync20(excludePath, "utf-8") : "";
   const next = mergeLocalExcludes(existing);
   if (next === null)
     return;
-  if (!existsSync16(dirname8(excludePath))) {
+  if (!existsSync19(dirname8(excludePath))) {
     mkdirSync10(dirname8(excludePath), { recursive: true });
   }
   writeFileSync9(excludePath, next, "utf-8");
@@ -13498,7 +14026,7 @@ function ensureClone(opts) {
   if (!isGitAvailable()) {
     throw new GitNotAvailableError;
   }
-  if (existsSync16(join13(opts.repoDir, ".git"))) {
+  if (existsSync19(join14(opts.repoDir, ".git"))) {
     opts.onStep?.("Refreshing existing clone (git fetch)…");
     runGit(gitFetchArgs(opts.branch), opts.repoDir);
     applyLocalExcludes(opts.repoDir);
@@ -13514,12 +14042,12 @@ function ensureClone(opts) {
 }
 
 // src/lib/dev/host-runtime.ts
-import { existsSync as existsSync18, mkdirSync as mkdirSync12, writeFileSync as writeFileSync11 } from "node:fs";
-import { dirname as dirname9, join as join15 } from "node:path";
+import { existsSync as existsSync21, mkdirSync as mkdirSync12, writeFileSync as writeFileSync11 } from "node:fs";
+import { dirname as dirname9, join as join16 } from "node:path";
 
 // src/lib/dev/inspector-module.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync11, writeFileSync as writeFileSync10 } from "node:fs";
-import { join as join14 } from "node:path";
+import { existsSync as existsSync20, mkdirSync as mkdirSync11, writeFileSync as writeFileSync10 } from "node:fs";
+import { join as join15 } from "node:path";
 
 // src/lib/dev/inspector-assets.ts
 var INSPECTOR_HTML = `<!doctype html>
@@ -28667,9 +29195,9 @@ function buildInspectorModule() {
 `);
 }
 function writeInspectorModule(serverDir) {
-  if (!existsSync17(serverDir))
+  if (!existsSync20(serverDir))
     mkdirSync11(serverDir, { recursive: true });
-  const target = join14(serverDir, INSPECTOR_FILE_NAME);
+  const target = join15(serverDir, INSPECTOR_FILE_NAME);
   writeFileSync10(target, buildInspectorModule(), "utf-8");
   return target;
 }
@@ -28855,9 +29383,9 @@ function buildHostScript(options) {
 `);
 }
 function writeHostScript(serverDir, options) {
-  if (!existsSync18(serverDir))
+  if (!existsSync21(serverDir))
     mkdirSync12(serverDir, { recursive: true });
-  const target = join15(serverDir, HOST_FILE_NAME);
+  const target = join16(serverDir, HOST_FILE_NAME);
   mkdirSync12(dirname9(target), { recursive: true });
   writeFileSync11(target, buildHostScript(options), "utf-8");
   if (options.inspector) {
@@ -28869,38 +29397,38 @@ function writeHostScript(serverDir, options) {
 // src/lib/dev/inspector-store.ts
 import {
   appendFileSync as appendFileSync2,
-  existsSync as existsSync19,
+  existsSync as existsSync22,
   mkdirSync as mkdirSync13,
-  readFileSync as readFileSync20,
+  readFileSync as readFileSync21,
   readdirSync as readdirSync2,
   renameSync,
   statSync as statSync2
 } from "node:fs";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 var INSPECTOR_DIRNAME = "inspector";
 var ACTIVE_FILE = "calls.ndjson";
 var ROTATED_PREFIX = "calls.";
 var ROTATED_SUFFIX = ".ndjson";
 var ROTATION_LIMIT_BYTES = 50 * 1024 * 1024;
 function inspectorDir(cwd) {
-  return join16(devRoot(cwd), INSPECTOR_DIRNAME);
+  return join17(devRoot(cwd), INSPECTOR_DIRNAME);
 }
 function ensureInspectorDir(dir) {
-  if (!existsSync19(dir))
+  if (!existsSync22(dir))
     mkdirSync13(dir, { recursive: true });
 }
 function activeFilePath(dir) {
-  return join16(dir, ACTIVE_FILE);
+  return join17(dir, ACTIVE_FILE);
 }
 function isRotatedName(name) {
   return name !== ACTIVE_FILE && name.startsWith(ROTATED_PREFIX) && name.endsWith(ROTATED_SUFFIX);
 }
 function listRotatedFiles(dir) {
-  if (!existsSync19(dir))
+  if (!existsSync22(dir))
     return [];
   const rotated = readdirSync2(dir).filter(isRotatedName);
   rotated.sort();
-  return rotated.map((n) => join16(dir, n));
+  return rotated.map((n) => join17(dir, n));
 }
 function parseLines(text) {
   if (!text)
@@ -28917,13 +29445,13 @@ function parseLines(text) {
   return out;
 }
 function readAll(dir) {
-  if (!existsSync19(dir))
+  if (!existsSync22(dir))
     return [];
   const out = [];
   for (const path of [...listRotatedFiles(dir), activeFilePath(dir)]) {
-    if (!existsSync19(path))
+    if (!existsSync22(path))
       continue;
-    out.push(...parseLines(readFileSync20(path, "utf-8")));
+    out.push(...parseLines(readFileSync21(path, "utf-8")));
   }
   return out;
 }
@@ -28973,8 +29501,8 @@ function parseDuration(input) {
 
 // src/lib/dev/local-runtime.ts
 import { spawn as spawn4 } from "node:child_process";
-import { existsSync as existsSync20 } from "node:fs";
-import { join as join17 } from "node:path";
+import { existsSync as existsSync23 } from "node:fs";
+import { join as join18 } from "node:path";
 function detectRuntime(preferred = "auto") {
   if (preferred === "bun" || preferred === "node")
     return preferred;
@@ -28985,7 +29513,7 @@ function detectRuntime(preferred = "auto") {
   return "node";
 }
 function startRuntime(options) {
-  if (!existsSync20(options.hostScriptPath)) {
+  if (!existsSync23(options.hostScriptPath)) {
     throw new Error(`Host script not found: ${options.hostScriptPath}`);
   }
   const runtime = detectRuntime(options.runtime);
@@ -29026,11 +29554,11 @@ function startRuntime(options) {
   };
 }
 async function installDependencies(options) {
-  const pkgPath = join17(options.serverDir, "package.json");
-  if (!existsSync20(pkgPath))
+  const pkgPath = join18(options.serverDir, "package.json");
+  if (!existsSync23(pkgPath))
     return { ran: false, exitCode: null };
-  const nodeModules = join17(options.serverDir, "node_modules");
-  if (options.skipIfPresent !== false && existsSync20(nodeModules)) {
+  const nodeModules = join18(options.serverDir, "node_modules");
+  if (options.skipIfPresent !== false && existsSync23(nodeModules)) {
     return { ran: false, exitCode: 0 };
   }
   options.onStep?.("Installing dependencies (bun install)…");
@@ -29069,22 +29597,22 @@ function missingEnvBindingNames(envExample, envJson) {
   return names;
 }
 function printEnvBindingHint(dest, envPath, cwd) {
-  const examplePath = join18(dest, ".env.example");
-  if (!existsSync21(examplePath))
+  const examplePath = join19(dest, ".env.example");
+  if (!existsSync24(examplePath))
     return;
   let example = "";
   let envJson = "{}";
   try {
-    example = readFileSync21(examplePath, "utf-8");
-    if (existsSync21(envPath))
-      envJson = readFileSync21(envPath, "utf-8");
+    example = readFileSync22(examplePath, "utf-8");
+    if (existsSync24(envPath))
+      envJson = readFileSync22(envPath, "utf-8");
   } catch {
     return;
   }
   const missing = missingEnvBindingNames(example, envJson);
   if (missing.length === 0)
     return;
-  printInfo(`  → this server expects ${missing.map((n) => c.bold(n)).join(", ")} — add value${missing.length === 1 ? "" : "s"} to ${relative6(cwd, envPath)} (upstream calls 401 until then)`);
+  printInfo(`  → this server expects ${missing.map((n) => c.bold(n)).join(", ")} — add value${missing.length === 1 ? "" : "s"} to ${relative8(cwd, envPath)} (upstream calls 401 until then)`);
 }
 var ENTRY_CANDIDATES = ["src/worker.ts", "src/server.ts", "src/index.ts"];
 async function prepareDev(opts) {
@@ -29111,9 +29639,9 @@ async function prepareDev(opts) {
     projectId = projectId ?? gitLink.projectId;
     serverName = `${gitLink.owner}/${gitLink.name}`;
     const registered = readConfig().gitRepoDirs?.[opts.serverId];
-    const chosen = opts.repoDirOverride ? resolve8(cwd, opts.repoDirOverride) : registered;
+    const chosen = opts.repoDirOverride ? resolve9(cwd, opts.repoDirOverride) : registered;
     repoDir = chosen ?? gitCloneDir(cwd, gitLink.owner, gitLink.name);
-    if (chosen && existsSync21(join18(repoDir, ".git"))) {
+    if (chosen && existsSync24(join19(repoDir, ".git"))) {
       const origin = getOriginUrl(repoDir);
       if (!origin || !originMatchesRepo(origin, gitLink.owner, gitLink.name)) {
         printError(`${repoDir} is a checkout of ${origin ?? "an unknown remote"}, not ${gitLink.owner}/${gitLink.name}. Pass a checkout of the linked repo, or drop --repo to use the default clone.`);
@@ -29123,7 +29651,7 @@ async function prepareDev(opts) {
     if (registered && !opts.repoDirOverride) {
       printInfo(`  → using registered checkout ${repoDir}`);
     }
-    dest = gitLink.pathPrefix ? join18(repoDir, gitLink.pathPrefix) : repoDir;
+    dest = gitLink.pathPrefix ? join19(repoDir, gitLink.pathPrefix) : repoDir;
     printStep(`Git-linked server — cloning ${gitLink.owner}/${gitLink.name}@${gitLink.branch}…`);
     try {
       const result = ensureClone({
@@ -29132,7 +29660,7 @@ async function prepareDev(opts) {
         branch: gitLink.branch,
         onStep: (m) => printStep(m)
       });
-      printSuccess(result.cloned ? `Cloned to ${relative6(cwd, repoDir)}` : `Using existing clone at ${relative6(cwd, repoDir)}`);
+      printSuccess(result.cloned ? `Cloned to ${relative8(cwd, repoDir)}` : `Using existing clone at ${relative8(cwd, repoDir)}`);
       const cfg = readConfig();
       if (cfg.gitRepoDirs?.[opts.serverId] !== repoDir) {
         cfg.gitRepoDirs = { ...cfg.gitRepoDirs, [opts.serverId]: repoDir };
@@ -29148,10 +29676,10 @@ async function prepareDev(opts) {
       }
       process.exit(1);
     }
-    if (!existsSync21(env)) {
+    if (!existsSync24(env)) {
       writeFileSync12(env, `{}
 `, "utf-8");
-      printInfo(`  → seeded ${relative6(cwd, env)} (empty; fill secrets here)`);
+      printInfo(`  → seeded ${relative8(cwd, env)} (empty; fill secrets here)`);
     }
     printEnvBindingHint(dest, env, cwd);
     printInfo(`  ${"Open the clone in your editor; commit + push to sync (config under mcpcloud/ is read-only)."}`);
@@ -29174,10 +29702,10 @@ async function prepareDev(opts) {
     });
     const result = materializeBundle(dest, bundle, { prune: true });
     printInfo(`  → wrote ${result.filesWritten} files (pruned ${result.filesRemoved})`);
-    if (!existsSync21(env)) {
+    if (!existsSync24(env)) {
       writeFileSync12(env, `{}
 `, "utf-8");
-      printInfo(`  → seeded ${relative6(cwd, env)} (empty; fill secrets here)`);
+      printInfo(`  → seeded ${relative8(cwd, env)} (empty; fill secrets here)`);
     }
     printEnvBindingHint(dest, env, cwd);
     printStep("Fetching tool metadata…");
@@ -29193,7 +29721,7 @@ async function prepareDev(opts) {
     });
     printInfo(`  → wrote ${toolsResult.filesWritten} editable tool file${toolsResult.filesWritten === 1 ? "" : "s"}${toolsResult.filesRemoved > 0 ? ` (pruned ${toolsResult.filesRemoved})` : ""}`);
   } else {
-    if (!existsSync21(dest)) {
+    if (!existsSync24(dest)) {
       printError("No cached bundle found. Run once without --offline first.");
       process.exit(1);
     }
@@ -29202,7 +29730,7 @@ async function prepareDev(opts) {
       process.exit(1);
     }
   }
-  const entryRel = ENTRY_CANDIDATES.find((c2) => existsSync21(join18(dest, c2)));
+  const entryRel = ENTRY_CANDIDATES.find((c2) => existsSync24(join19(dest, c2)));
   if (!entryRel) {
     printError("Could not locate an entry file (expected src/worker.ts).");
     process.exit(1);
@@ -29250,8 +29778,8 @@ async function prepareDev(opts) {
 
 // src/lib/dev/tree-sync.ts
 import { createHash as createHash4 } from "node:crypto";
-import { existsSync as existsSync22, mkdirSync as mkdirSync14, readdirSync as readdirSync3, readFileSync as readFileSync22, writeFileSync as writeFileSync13 } from "node:fs";
-import { join as join19 } from "node:path";
+import { existsSync as existsSync25, mkdirSync as mkdirSync14, readdirSync as readdirSync3, readFileSync as readFileSync23, writeFileSync as writeFileSync13 } from "node:fs";
+import { join as join20 } from "node:path";
 var AUTHORING_GUIDE_FILE = "AGENTS.md";
 var STRUCTURAL_FRONTMATTER_KEYS = [
   "inputSchema",
@@ -29266,13 +29794,13 @@ function isEmptyPlan(plan) {
 }
 function listToolFiles(devRootDir, serverId) {
   const dir = serverToolsDir(devRootDir, serverId);
-  if (!existsSync22(dir))
+  if (!existsSync25(dir))
     return [];
   return readdirSync3(dir).filter((entry) => entry.endsWith(".md")).filter((entry) => entry !== AUTHORING_GUIDE_FILE).map((entry) => entry.slice(0, -3)).sort();
 }
 function readToolFile(devRootDir, serverId, toolName) {
-  const file = join19(serverToolsDir(devRootDir, serverId), `${toolName}.md`);
-  const raw = readFileSync22(file, "utf-8");
+  const file = join20(serverToolsDir(devRootDir, serverId), `${toolName}.md`);
+  const raw = readFileSync23(file, "utf-8");
   try {
     return { raw, view: parseToolMarkdown(raw) };
   } catch (err) {
@@ -29298,7 +29826,7 @@ async function writeAuthoringGuide(args) {
       return null;
     const dir = serverToolsDir(args.devRootDir, args.serverId);
     mkdirSync14(dir, { recursive: true });
-    const guidePath = join19(dir, AUTHORING_GUIDE_FILE);
+    const guidePath = join20(dir, AUTHORING_GUIDE_FILE);
     writeFileSync13(guidePath, markdown, "utf8");
     return guidePath;
   } catch {
@@ -29350,6 +29878,14 @@ function planPush(args) {
       changes.push({ kind: "new-tool", toolName });
       continue;
     }
+    if (parsed.view.name !== toolName) {
+      blockers.push({
+        reason: `\`name:\` was changed to ${parsed.view.name}; editing the file does not rename a tool`,
+        remedy: `mcp tools rename ${toolName} ${parsed.view.name}`,
+        toolName
+      });
+      continue;
+    }
     if (hashLocalView(parsed.view) !== tracked.descriptionHash) {
       changes.push({
         changedFields: changedFieldNames(parsed.view, tracked.descriptionHash),
@@ -29381,18 +29917,18 @@ function changedFieldNames(view, storedHash) {
 }
 var HANDLER_MANIFEST_FILE = ".handlers-state.json";
 function handlerManifestPath(devRootDir, serverId) {
-  return join19(serverToolsDir(devRootDir, serverId), HANDLER_MANIFEST_FILE);
+  return join20(serverToolsDir(devRootDir, serverId), HANDLER_MANIFEST_FILE);
 }
 function hashSource2(source) {
   return createHash4("sha256").update(source).digest("hex");
 }
 function listHandlerFiles(devRootDir) {
   const dir = serverBundleHandlersDir(devRootDir);
-  if (!existsSync22(dir))
+  if (!existsSync25(dir))
     return [];
   return readdirSync3(dir).filter((entry) => entry.endsWith(".ts") && !entry.endsWith(".definition.ts")).sort().map((entry) => ({
     slug: entry.slice(0, -3),
-    source: readFileSync22(join19(dir, entry), "utf-8")
+    source: readFileSync23(join20(dir, entry), "utf-8")
   }));
 }
 function writeHandlerManifest(args) {
@@ -29401,7 +29937,7 @@ function writeHandlerManifest(args) {
     handlers[file.slug] = hashSource2(file.source);
   }
   const dir = serverToolsDir(args.devRootDir, args.serverId);
-  if (!existsSync22(dir))
+  if (!existsSync25(dir))
     mkdirSync14(dir, { recursive: true });
   const manifest = {
     handlers,
@@ -29412,23 +29948,23 @@ function writeHandlerManifest(args) {
   return Object.keys(handlers).length;
 }
 function recordHandlerPushed(args) {
-  const file = join19(serverBundleHandlersDir(args.devRootDir), `${args.slug}.ts`);
-  if (!existsSync22(file))
+  const file = join20(serverBundleHandlersDir(args.devRootDir), `${args.slug}.ts`);
+  if (!existsSync25(file))
     return;
   const manifest = readHandlerManifest(args.devRootDir, args.serverId) ?? {
     handlers: {},
     serverId: args.serverId,
     version: 1
   };
-  manifest.handlers[args.slug] = hashSource2(readFileSync22(file, "utf-8"));
+  manifest.handlers[args.slug] = hashSource2(readFileSync23(file, "utf-8"));
   writeFileSync13(handlerManifestPath(args.devRootDir, args.serverId), JSON.stringify(manifest, null, 2), "utf-8");
 }
 function readHandlerManifest(devRootDir, serverId) {
   const file = handlerManifestPath(devRootDir, serverId);
-  if (!existsSync22(file))
+  if (!existsSync25(file))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync22(file, "utf-8"));
+    const parsed = JSON.parse(readFileSync23(file, "utf-8"));
     return parsed.version === 1 && parsed.handlers ? parsed : null;
   } catch {
     return null;
@@ -29513,12 +30049,22 @@ function describeToolPush(toolName, result) {
         ok: false,
         target: toolName
       };
-    default:
+    case "rename-requested":
+      return {
+        detail: `editing \`name:\` does not rename — use \`mcp tools rename ${result.from} ${result.to}\``,
+        ok: false,
+        target: toolName
+      };
+    case "api-error":
       return {
         detail: `${result.message} (HTTP ${result.status})`,
         ok: false,
         target: toolName
       };
+    default: {
+      const exhaustive = result;
+      return exhaustive;
+    }
   }
 }
 function describeHandlerPush(toolName, result) {
@@ -30188,9 +30734,9 @@ function registerDomainCommands(program) {
 
 // src/commands/config.ts
 import { homedir as homedir2 } from "node:os";
-import { join as join20 } from "node:path";
+import { join as join21 } from "node:path";
 function configFilePath() {
-  return join20(homedir2(), ".mcpcloud", "config.json");
+  return join21(homedir2(), ".mcpcloud", "config.json");
 }
 function previewKey2(key) {
   if (!key)
@@ -30435,30 +30981,30 @@ function registerConfigCommands(program) {
 }
 
 // src/commands/dev.ts
-import { existsSync as existsSync35 } from "node:fs";
-import { isAbsolute as isAbsolute4, relative as relative7, resolve as resolve10 } from "node:path";
+import { existsSync as existsSync38 } from "node:fs";
+import { isAbsolute as isAbsolute5, relative as relative9, resolve as resolve11 } from "node:path";
 
 // src/lib/dev/sessions.ts
 import {
-  existsSync as existsSync23,
+  existsSync as existsSync26,
   mkdirSync as mkdirSync15,
-  readFileSync as readFileSync23,
+  readFileSync as readFileSync24,
   readdirSync as readdirSync4,
   unlinkSync,
   writeFileSync as writeFileSync14
 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { join as join21 } from "node:path";
+import { join as join22 } from "node:path";
 var SESSIONS_DIR_NAME = "dev-sessions";
 function sessionsDir() {
-  return join21(homedir3(), ".mcpcloud", SESSIONS_DIR_NAME);
+  return join22(homedir3(), ".mcpcloud", SESSIONS_DIR_NAME);
 }
 function sessionFile(pid) {
-  return join21(sessionsDir(), `${pid}.json`);
+  return join22(sessionsDir(), `${pid}.json`);
 }
 function ensureDir() {
   const dir = sessionsDir();
-  if (!existsSync23(dir))
+  if (!existsSync26(dir))
     mkdirSync15(dir, { recursive: true, mode: 448 });
 }
 function recordSession(record) {
@@ -30470,7 +31016,7 @@ function recordSession(record) {
 }
 function removeSession(pid) {
   const path = sessionFile(pid);
-  if (existsSync23(path)) {
+  if (existsSync26(path)) {
     try {
       unlinkSync(path);
     } catch {}
@@ -30478,15 +31024,15 @@ function removeSession(pid) {
 }
 function listSessions() {
   const dir = sessionsDir();
-  if (!existsSync23(dir))
+  if (!existsSync26(dir))
     return [];
   const live = [];
   for (const entry of readdirSync4(dir)) {
     if (!entry.endsWith(".json"))
       continue;
-    const path = join21(dir, entry);
+    const path = join22(dir, entry);
     try {
-      const parsed = JSON.parse(readFileSync23(path, "utf-8"));
+      const parsed = JSON.parse(readFileSync24(path, "utf-8"));
       if (typeof parsed.pid !== "number") {
         unlinkSync(path);
         continue;
@@ -30823,13 +31369,13 @@ function formatSummary(record) {
 
 // src/commands/dev-tail.ts
 import {
-  existsSync as existsSync24,
+  existsSync as existsSync27,
   openSync,
   readSync,
   closeSync,
   statSync as statSync3
 } from "node:fs";
-import { join as join22 } from "node:path";
+import { join as join23 } from "node:path";
 var DEFAULT_INTERVAL_MS = 250;
 var MAX_READ_CHUNK = 64 * 1024;
 function registerDevTailCommand(dev) {
@@ -30838,14 +31384,14 @@ function registerDevTailCommand(dev) {
 async function runDevTail(opts) {
   const cwd = process.cwd();
   const dir = inspectorDir(cwd);
-  const activePath = join22(dir, ACTIVE_FILE);
+  const activePath = join23(dir, ACTIVE_FILE);
   const intervalMs = parseInterval(opts.intervalMs);
-  if (!existsSync24(dir)) {
+  if (!existsSync27(dir)) {
     printInfo(`No inspector history yet at ${dir}. Run \`mcp dev\` to start capturing.`);
     throw new CliExitError(0);
   }
   let cursor = 0;
-  if (existsSync24(activePath)) {
+  if (existsSync27(activePath)) {
     try {
       cursor = opts.fromStart ? 0 : statSync3(activePath).size;
     } catch {
@@ -30861,7 +31407,7 @@ async function runDevTail(opts) {
   process.on("SIGTERM", stop);
   while (!stopped) {
     let size = 0;
-    if (existsSync24(activePath)) {
+    if (existsSync27(activePath)) {
       try {
         size = statSync3(activePath).size;
       } catch {
@@ -31106,8 +31652,8 @@ function startGitPullPoll(args) {
 
 // src/lib/dev/editor.ts
 import { spawn as spawn5 } from "node:child_process";
-import { existsSync as existsSync25, statSync as statSync4 } from "node:fs";
-import { delimiter as delimiter2, join as join23 } from "node:path";
+import { existsSync as existsSync28, statSync as statSync4 } from "node:fs";
+import { delimiter as delimiter2, join as join24 } from "node:path";
 import { platform as platform3 } from "node:os";
 var TARGET_LABEL = {
   tools: "tool metadata",
@@ -31143,8 +31689,8 @@ function findOnPath2(command) {
     if (!dir)
       continue;
     for (const ext of exts) {
-      const candidate = join23(dir, command + ext);
-      if (existsSync25(candidate) && isExecutable(candidate))
+      const candidate = join24(dir, command + ext);
+      if (existsSync28(candidate) && isExecutable(candidate))
         return candidate;
     }
   }
@@ -31433,11 +31979,11 @@ function parseOpenChoice(raw) {
 }
 
 // src/lib/dev/file-watcher.ts
-import { existsSync as existsSync26, statSync as statSync5, watch as fsWatch2 } from "node:fs";
-import { join as join24 } from "node:path";
+import { existsSync as existsSync29, statSync as statSync5, watch as fsWatch2 } from "node:fs";
+import { join as join25 } from "node:path";
 var DEFAULT_IGNORE = ["node_modules", ".git", "_mcpsh_host.mjs"];
 function watchDir(options) {
-  if (!existsSync26(options.rootDir)) {
+  if (!existsSync29(options.rootDir)) {
     throw new Error(`watchDir: directory does not exist: ${options.rootDir}`);
   }
   const ignore = new Set([...DEFAULT_IGNORE, ...options.ignore ?? []]);
@@ -31473,7 +32019,7 @@ function watchDir(options) {
       for (const entry of readdirSync(options.rootDir)) {
         if (ignore.has(entry))
           continue;
-        const sub = join24(options.rootDir, entry);
+        const sub = join25(options.rootDir, entry);
         try {
           const stat = statSync5(sub);
           if (!stat.isDirectory())
@@ -31521,10 +32067,10 @@ function isToolHandlerPath(rel) {
 }
 
 // src/lib/dev/tools-watcher.ts
-import { existsSync as existsSync27 } from "node:fs";
+import { existsSync as existsSync30 } from "node:fs";
 function startToolsWatcher(args) {
   const rootDir = serverToolsDir(devRoot(args.cwd), args.serverId);
-  if (!existsSync27(rootDir))
+  if (!existsSync30(rootDir))
     return null;
   let inflight = false;
   let pendingNames = new Set;
@@ -31589,6 +32135,10 @@ async function handleOne(args) {
       printError(`Couldn't parse ${args.toolName}.md: ${result.message}`);
       printInfo(c.dim(`  → fix the file and save again, or run \`mcp tools pull ${args.toolName}\` to reset.`));
       return;
+    case "rename-requested":
+      printWarn(`${args.toolName}.md: \`name:\` was changed to ${c.bold(result.to)}, but editing the file does not rename a tool — nothing was pushed.`);
+      printInfo(c.dim(`  → run \`mcp tools rename ${result.from} ${result.to} --server ${args.serverId}\`, then \`mcp tools pull\`; or set \`name:\` back to ${result.from} to push your other edits.`));
+      return;
     case "patched": {
       printSuccess(`Saved ${c.bold(args.toolName)} ${c.dim(`(${result.changedFields.length} field${result.changedFields.length === 1 ? "" : "s"} patched)`)}`);
       const hotPatched = await maybeHotReload({
@@ -31639,10 +32189,10 @@ async function maybeHotReload(args) {
 }
 
 // src/lib/dev/handlers-watcher.ts
-import { existsSync as existsSync28 } from "node:fs";
+import { existsSync as existsSync31 } from "node:fs";
 function startHandlersWatcher(args) {
   const rootDir = serverBundleHandlersDir(devRoot(args.cwd));
-  if (!existsSync28(rootDir))
+  if (!existsSync31(rootDir))
     return null;
   let inflight = false;
   let pendingSlugs = new Set;
@@ -31849,24 +32399,24 @@ function createBurstGuard() {
 }
 
 // src/lib/dev/agent-connectors/claude-code.ts
-import { existsSync as existsSync30, unlinkSync as unlinkSync2, writeFileSync as writeFileSync16 } from "node:fs";
+import { existsSync as existsSync33, unlinkSync as unlinkSync2, writeFileSync as writeFileSync16 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { join as join26 } from "node:path";
+import { join as join27 } from "node:path";
 
 // src/lib/dev/agent-connectors/json-config-utils.ts
-import { existsSync as existsSync29, mkdirSync as mkdirSync16, readFileSync as readFileSync24, writeFileSync as writeFileSync15 } from "node:fs";
-import { dirname as dirname10, join as join25, basename } from "node:path";
+import { existsSync as existsSync32, mkdirSync as mkdirSync16, readFileSync as readFileSync25, writeFileSync as writeFileSync15 } from "node:fs";
+import { dirname as dirname10, join as join26, basename } from "node:path";
 function readJsonFile(path) {
-  if (!existsSync29(path))
+  if (!existsSync32(path))
     return { ok: true, value: {} };
   try {
-    const raw = readFileSync24(path, "utf-8");
+    const raw = readFileSync25(path, "utf-8");
     if (!raw.trim())
       return { ok: true, value: {} };
     return { ok: true, value: JSON.parse(raw) };
   } catch {
     try {
-      return { ok: false, raw: readFileSync24(path, "utf-8") };
+      return { ok: false, raw: readFileSync25(path, "utf-8") };
     } catch {
       return { ok: false };
     }
@@ -31881,25 +32431,25 @@ function atomicWriteJson(path, value) {
   renameSync(tmp, path);
 }
 function backupConfig(args) {
-  if (!existsSync29(args.configPath)) {
+  if (!existsSync32(args.configPath)) {
     return { backupPath: null, existed: false };
   }
   mkdirSync16(args.backupsDir, { recursive: true });
   const filename = `${args.agentId}__${basename(args.configPath)}.bak`;
-  const backupPath = join25(args.backupsDir, filename);
-  if (!existsSync29(backupPath)) {
-    const raw = readFileSync24(args.configPath, "utf-8");
+  const backupPath = join26(args.backupsDir, filename);
+  if (!existsSync32(backupPath)) {
+    const raw = readFileSync25(args.configPath, "utf-8");
     writeFileSync15(backupPath, raw, "utf-8");
   }
   return { backupPath, existed: true };
 }
 function restoreFromBackup(args) {
   const filename = `${args.agentId}__${basename(args.configPath)}.bak`;
-  const backupPath = join25(args.backupsDir, filename);
-  if (!existsSync29(backupPath)) {
+  const backupPath = join26(args.backupsDir, filename);
+  if (!existsSync32(backupPath)) {
     return { restored: false };
   }
-  const raw = readFileSync24(backupPath, "utf-8");
+  const raw = readFileSync25(backupPath, "utf-8");
   mkdirSync16(dirname10(args.configPath), { recursive: true });
   writeFileSync15(args.configPath, raw, "utf-8");
   return { restored: true };
@@ -31907,15 +32457,15 @@ function restoreFromBackup(args) {
 
 // src/lib/dev/agent-connectors/claude-code.ts
 function configPath() {
-  return join26(homedir4(), ".claude.json");
+  return join27(homedir4(), ".claude.json");
 }
 function legacyConfigPath() {
-  return join26(homedir4(), ".claude", "mcp.json");
+  return join27(homedir4(), ".claude", "mcp.json");
 }
 function resolveConfigPath() {
-  if (existsSync30(configPath()))
+  if (existsSync33(configPath()))
     return configPath();
-  if (existsSync30(legacyConfigPath()))
+  if (existsSync33(legacyConfigPath()))
     return legacyConfigPath();
   return configPath();
 }
@@ -31925,8 +32475,8 @@ var claudeCodeConnector = {
   hotkey: "c",
   describeLocation: () => resolveConfigPath(),
   async detect() {
-    const claudeDir = join26(homedir4(), ".claude");
-    if (existsSync30(configPath()) || existsSync30(legacyConfigPath()) || existsSync30(claudeDir)) {
+    const claudeDir = join27(homedir4(), ".claude");
+    if (existsSync33(configPath()) || existsSync33(legacyConfigPath()) || existsSync33(claudeDir)) {
       return { installed: true, note: "Found Claude Code config" };
     }
     return { installed: false };
@@ -31964,7 +32514,7 @@ var claudeCodeConnector = {
       backupsDir: args.backupsDir,
       agentId: this.id
     });
-    if (!restored.restored && existsSync30(path)) {
+    if (!restored.restored && existsSync33(path)) {
       const after = readJsonFile(path);
       if (after.ok && after.value && typeof after.value === "object") {
         const root = after.value;
@@ -31986,16 +32536,16 @@ var claudeCodeConnector = {
 
 // src/lib/dev/agent-connectors/codex.ts
 import {
-  existsSync as existsSync31,
+  existsSync as existsSync34,
   mkdirSync as mkdirSync17,
-  readFileSync as readFileSync25,
+  readFileSync as readFileSync26,
   unlinkSync as unlinkSync3,
   writeFileSync as writeFileSync17
 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { dirname as dirname11, join as join27 } from "node:path";
+import { dirname as dirname11, join as join28 } from "node:path";
 function configPath2() {
-  return join27(homedir5(), ".codex", "config.toml");
+  return join28(homedir5(), ".codex", "config.toml");
 }
 var SECTION_PREFIX = "mcp_servers.";
 function buildSection(name, url) {
@@ -32033,7 +32583,7 @@ var codexConnector = {
   hotkey: "x",
   describeLocation: () => configPath2(),
   async detect() {
-    if (existsSync31(join27(homedir5(), ".codex")) || existsSync31(configPath2())) {
+    if (existsSync34(join28(homedir5(), ".codex")) || existsSync34(configPath2())) {
       return { installed: true, note: "Found ~/.codex/" };
     }
     return { installed: false };
@@ -32046,8 +32596,8 @@ var codexConnector = {
       agentId: this.id
     });
     let existing = "";
-    if (existsSync31(path)) {
-      existing = readFileSync25(path, "utf-8");
+    if (existsSync34(path)) {
+      existing = readFileSync26(path, "utf-8");
     }
     const conflict = findSectionRange(existing, args.name) !== null;
     let next = existing;
@@ -32068,8 +32618,8 @@ var codexConnector = {
   },
   async remove(args) {
     const path = configPath2();
-    if (existsSync31(path)) {
-      const existing = readFileSync25(path, "utf-8");
+    if (existsSync34(path)) {
+      const existing = readFileSync26(path, "utf-8");
       const range = findSectionRange(existing, args.name);
       if (range) {
         const next = existing.slice(0, range.start) + existing.slice(range.end);
@@ -32081,8 +32631,8 @@ var codexConnector = {
       backupsDir: args.backupsDir,
       agentId: this.id
     });
-    if (!restored.restored && existsSync31(path)) {
-      const after = readFileSync25(path, "utf-8");
+    if (!restored.restored && existsSync34(path)) {
+      const after = readFileSync26(path, "utf-8");
       if (!after.trim()) {
         try {
           unlinkSync3(path);
@@ -32094,11 +32644,11 @@ var codexConnector = {
 };
 
 // src/lib/dev/agent-connectors/continue.ts
-import { existsSync as existsSync32, unlinkSync as unlinkSync4, writeFileSync as writeFileSync18 } from "node:fs";
+import { existsSync as existsSync35, unlinkSync as unlinkSync4, writeFileSync as writeFileSync18 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { join as join28 } from "node:path";
+import { join as join29 } from "node:path";
 function configPath3() {
-  return join28(homedir6(), ".continue", "config.json");
+  return join29(homedir6(), ".continue", "config.json");
 }
 function isContinueServerEntry(value) {
   return Boolean(value && typeof value === "object" && typeof value.name === "string");
@@ -32109,8 +32659,8 @@ var continueConnector = {
   hotkey: "n",
   describeLocation: () => configPath3(),
   async detect() {
-    const dir = join28(homedir6(), ".continue");
-    if (existsSync32(dir) || existsSync32(configPath3())) {
+    const dir = join29(homedir6(), ".continue");
+    if (existsSync35(dir) || existsSync35(configPath3())) {
       return { installed: true, note: "Found ~/.continue/" };
     }
     return { installed: false };
@@ -32148,7 +32698,7 @@ var continueConnector = {
       backupsDir: args.backupsDir,
       agentId: this.id
     });
-    if (!restored.restored && existsSync32(path)) {
+    if (!restored.restored && existsSync35(path)) {
       const after = readJsonFile(path);
       if (after.ok && after.value && typeof after.value === "object") {
         const root = after.value;
@@ -32169,11 +32719,11 @@ var continueConnector = {
 };
 
 // src/lib/dev/agent-connectors/cursor.ts
-import { existsSync as existsSync33, unlinkSync as unlinkSync5, writeFileSync as writeFileSync19 } from "node:fs";
+import { existsSync as existsSync36, unlinkSync as unlinkSync5, writeFileSync as writeFileSync19 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
-import { join as join29 } from "node:path";
+import { join as join30 } from "node:path";
 function globalConfigPath() {
-  return join29(homedir7(), ".cursor", "mcp.json");
+  return join30(homedir7(), ".cursor", "mcp.json");
 }
 var cursorConnector = {
   id: "cursor",
@@ -32181,9 +32731,9 @@ var cursorConnector = {
   hotkey: "u",
   describeLocation: () => globalConfigPath(),
   async detect() {
-    const cursorDir = join29(homedir7(), ".cursor");
-    const macAppSupport = join29(homedir7(), "Library", "Application Support", "Cursor");
-    if (existsSync33(cursorDir) || existsSync33(macAppSupport)) {
+    const cursorDir = join30(homedir7(), ".cursor");
+    const macAppSupport = join30(homedir7(), "Library", "Application Support", "Cursor");
+    if (existsSync36(cursorDir) || existsSync36(macAppSupport)) {
       return { installed: true, note: "Found Cursor config dir" };
     }
     return { installed: false };
@@ -32221,7 +32771,7 @@ var cursorConnector = {
       backupsDir: args.backupsDir,
       agentId: this.id
     });
-    if (!restored.restored && existsSync33(path)) {
+    if (!restored.restored && existsSync36(path)) {
       const after = readJsonFile(path);
       if (after.ok && after.value && typeof after.value === "object") {
         const root = after.value;
@@ -32242,30 +32792,30 @@ var cursorConnector = {
 };
 
 // src/lib/dev/agent-connectors/vscode-copilot.ts
-import { existsSync as existsSync34, unlinkSync as unlinkSync6, writeFileSync as writeFileSync20 } from "node:fs";
+import { existsSync as existsSync37, unlinkSync as unlinkSync6, writeFileSync as writeFileSync20 } from "node:fs";
 import { homedir as homedir8, platform as platform4 } from "node:os";
-import { join as join30, resolve as resolve9 } from "node:path";
+import { join as join31, resolve as resolve10 } from "node:path";
 function userLevelConfigPath() {
   const home = homedir8();
   const p = platform4();
   if (p === "darwin")
-    return join30(home, "Library", "Application Support", "Code", "User", "mcp.json");
+    return join31(home, "Library", "Application Support", "Code", "User", "mcp.json");
   if (p === "win32") {
-    const appData = process.env["APPDATA"] ?? join30(home, "AppData", "Roaming");
-    return join30(appData, "Code", "User", "mcp.json");
+    const appData = process.env["APPDATA"] ?? join31(home, "AppData", "Roaming");
+    return join31(appData, "Code", "User", "mcp.json");
   }
-  const xdg = process.env["XDG_CONFIG_HOME"] ?? join30(home, ".config");
-  return join30(xdg, "Code", "User", "mcp.json");
+  const xdg = process.env["XDG_CONFIG_HOME"] ?? join31(home, ".config");
+  return join31(xdg, "Code", "User", "mcp.json");
 }
 function isHomeDir(cwd) {
-  return resolve9(cwd) === resolve9(homedir8());
+  return resolve10(cwd) === resolve10(homedir8());
 }
 function hasWorkspaceVscode(cwd) {
-  return existsSync34(join30(cwd, ".vscode"));
+  return existsSync37(join31(cwd, ".vscode"));
 }
 function configPath4(cwd) {
   if (!isHomeDir(cwd) && hasWorkspaceVscode(cwd)) {
-    return join30(cwd, ".vscode", "mcp.json");
+    return join31(cwd, ".vscode", "mcp.json");
   }
   return userLevelConfigPath();
 }
@@ -32279,7 +32829,7 @@ var vscodeCopilotConnector = {
     if (!isHomeDir(here) && hasWorkspaceVscode(here)) {
       return { installed: true, note: "Found .vscode/ in current dir" };
     }
-    if (existsSync34(userLevelConfigPath().replace(/mcp\.json$/, ""))) {
+    if (existsSync37(userLevelConfigPath().replace(/mcp\.json$/, ""))) {
       return { installed: true, note: "Found VS Code user profile" };
     }
     return { installed: false };
@@ -32317,7 +32867,7 @@ var vscodeCopilotConnector = {
       backupsDir: args.backupsDir,
       agentId: this.id
     });
-    if (!restored.restored && existsSync34(path)) {
+    if (!restored.restored && existsSync37(path)) {
       const after = readJsonFile(path);
       if (after.ok && after.value && typeof after.value === "object") {
         const root = after.value;
@@ -32471,7 +33021,7 @@ function parseGraceMs(value, fallbackMs) {
   return Math.round(n * 1000);
 }
 function resolveSpecPath(cwd, raw) {
-  return isAbsolute4(raw) ? raw : resolve10(cwd, raw);
+  return isAbsolute5(raw) ? raw : resolve11(cwd, raw);
 }
 function buildConnectionName(serverId) {
   const slug = serverId.toLowerCase().replace(/[^a-z0-9]+/g, "-").slice(0, 24) || "mcp-server";
@@ -32635,7 +33185,7 @@ async function runDev(opts) {
   let specPath = null;
   if (opts.spec) {
     const resolved = resolveSpecPath(cwd, opts.spec);
-    if (!existsSync35(resolved)) {
+    if (!existsSync38(resolved)) {
       printError(`Spec file not found: ${resolved}`);
       process.exit(1);
     }
@@ -32846,7 +33396,7 @@ async function runWithRuntime(args) {
           return;
         regenInFlight = true;
         try {
-          printStep(`Spec changed (${relative7(args.cwd, args.specPath)}) — regenerating…`);
+          printStep(`Spec changed (${relative9(args.cwd, args.specPath)}) — regenerating…`);
           const result = await regenerateDevBundle({
             organizationId: args.organizationId,
             serverId: args.serverId,
@@ -32912,9 +33462,9 @@ async function runWithRuntime(args) {
   if (args.inspector) {
     printInfo(`  ${c.dim("Inspector:   ")} ${c.cyan(`${baseUrl}/__inspect`)}`);
   }
-  printInfo(`  ${c.dim(`Edit files in ${relative7(args.cwd, args.prepared.destDir)}/ to hot-reload.`)}`);
+  printInfo(`  ${c.dim(`Edit files in ${relative9(args.cwd, args.prepared.destDir)}/ to hot-reload.`)}`);
   if (args.gitNative && args.prepared.repoDir) {
-    printInfo(`  ${c.dim(`Git-native: edit + commit + push in ${relative7(args.cwd, args.prepared.repoDir)}/ — the webhook reconciles src/**.`)}`);
+    printInfo(`  ${c.dim(`Git-native: edit + commit + push in ${relative9(args.cwd, args.prepared.repoDir)}/ — the webhook reconciles src/**.`)}`);
     printInfo(`  ${c.dim("Config under mcpcloud/ is read-only; change it in the dashboard. Deploy when ready (mcp servers deploy).")}`);
   }
   if (toolsWatcher) {
@@ -32924,7 +33474,7 @@ async function runWithRuntime(args) {
     printInfo(`  ${c.dim(`Edit tool handlers in .mcpcloud/server/src/tools/<slug>.ts (changes push to cloud on save).`)}`);
   }
   if (specWatcher) {
-    printInfo(`  ${c.dim(`Spec watch:    ${relative7(args.cwd, args.specPath)}`)}`);
+    printInfo(`  ${c.dim(`Spec watch:    ${relative9(args.cwd, args.specPath)}`)}`);
   }
   const gitPullPoller = args.gitNative ? startGitPullPoll({
     fetchStatus: () => resolveServerGitPullStatus({
@@ -33565,13 +34115,13 @@ async function confirmRollback(deploymentId) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync37, statSync as statSync6, readFileSync as readFileSync27 } from "node:fs";
+import { existsSync as existsSync40, statSync as statSync6, readFileSync as readFileSync28 } from "node:fs";
 import { homedir as homedir9, platform as platform6 } from "node:os";
-import { join as join32, delimiter as delimiter3 } from "node:path";
+import { join as join33, delimiter as delimiter3 } from "node:path";
 
 // src/lib/version-check.ts
-import { existsSync as existsSync36, mkdirSync as mkdirSync18, readFileSync as readFileSync26, writeFileSync as writeFileSync21 } from "node:fs";
-import { join as join31 } from "node:path";
+import { existsSync as existsSync39, mkdirSync as mkdirSync18, readFileSync as readFileSync27, writeFileSync as writeFileSync21 } from "node:fs";
+import { join as join32 } from "node:path";
 var CACHE_TTL_MS = 24 * 60 * 60 * 1000;
 var FETCH_TIMEOUT_MS2 = 2000;
 var REGISTRY_URL = "https://registry.npmjs.org/@mcpcloud/cli/latest";
@@ -33579,13 +34129,13 @@ function cacheDir() {
   return configDir();
 }
 function cacheFile() {
-  return join31(cacheDir(), "version-check.json");
+  return join32(cacheDir(), "version-check.json");
 }
 function readCache() {
-  if (!existsSync36(cacheFile()))
+  if (!existsSync39(cacheFile()))
     return null;
   try {
-    const raw = JSON.parse(readFileSync26(cacheFile(), "utf-8"));
+    const raw = JSON.parse(readFileSync27(cacheFile(), "utf-8"));
     if (typeof raw.latest !== "string" || typeof raw.fetchedAt !== "number")
       return null;
     return { latest: raw.latest, fetchedAt: raw.fetchedAt };
@@ -33595,7 +34145,7 @@ function readCache() {
 }
 function writeCache(entry) {
   try {
-    if (!existsSync36(cacheDir()))
+    if (!existsSync39(cacheDir()))
       mkdirSync18(cacheDir(), { recursive: true, mode: 448 });
     writeFileSync21(cacheFile(), JSON.stringify(entry, null, 2), { mode: 384 });
   } catch {}
@@ -33708,8 +34258,8 @@ function checkNode() {
 }
 function checkConfigFile() {
   const t0 = Date.now();
-  const path = join32(homedir9(), ".mcpcloud", "config.json");
-  if (!existsSync37(path)) {
+  const path = join33(homedir9(), ".mcpcloud", "config.json");
+  if (!existsSync40(path)) {
     return {
       name: "Config file",
       status: "warn",
@@ -33731,7 +34281,7 @@ function checkConfigFile() {
     } catch {}
   }
   try {
-    JSON.parse(readFileSync27(path, "utf-8"));
+    JSON.parse(readFileSync28(path, "utf-8"));
   } catch (err) {
     return {
       name: "Config file",
@@ -33862,8 +34412,8 @@ function checkClaudeCli() {
   for (const dir of PATH.split(delimiter3)) {
     if (!dir)
       continue;
-    const candidate = join32(dir, exe);
-    if (existsSync37(candidate)) {
+    const candidate = join33(dir, exe);
+    if (existsSync40(candidate)) {
       return {
         name: "claude CLI",
         status: "pass",
@@ -34144,6 +34694,7 @@ var TOPICS = {
       "  authentication_required    Run `mcp login` or set MCPCLOUD_API_KEY.",
       "  invalid_api_key            The key is invalid or revoked. Run `mcp login`.",
       "  organization_not_selected  Pass --org <id> or run `mcp config set-org <id>`.",
+      "  organization_access_denied Not a member of that org — pass --org <id>; `mcp orgs list` shows yours.",
       "  rate_limited               Honor the Retry-After header. The CLI auto-retries once.",
       "  deployment_failed          Check `error.details.findings` (--json) for release-gate context.",
       "  idempotency_key_conflict   Same key reused with a different body. Generate a fresh one.",
@@ -34613,8 +35164,8 @@ function registerInstallationCommands(program) {
 }
 
 // src/commands/invoke.ts
-import { existsSync as existsSync38, readFileSync as readFileSync28 } from "node:fs";
-import { join as join33 } from "node:path";
+import { existsSync as existsSync41, readFileSync as readFileSync29 } from "node:fs";
+import { join as join34 } from "node:path";
 
 // src/lib/dev/local-invoke.ts
 var READY_TIMEOUT_MS = 30000;
@@ -34706,9 +35257,9 @@ function selectCodeModeInvocation(args) {
 }
 function readCodeOption(raw) {
   if (raw === "@-")
-    return readFileSync28(0, "utf-8");
+    return readFileSync29(0, "utf-8");
   if (raw.startsWith("@"))
-    return readFileSync28(raw.slice(1), "utf-8");
+    return readFileSync29(raw.slice(1), "utf-8");
   return raw;
 }
 function parseTimeoutMs4(value, fallbackMs) {
@@ -34990,14 +35541,14 @@ async function runLocalInvoke(args) {
     throw new CliExitError(1);
   }
   const env = {
-    ...args.envFile ? parseEnvFile(readFileSync28(args.envFile, "utf-8")) : {},
+    ...args.envFile ? parseEnvFile(readFileSync29(args.envFile, "utf-8")) : {},
     ...parseEnvPairs(args.envPairs)
   };
   const port = await findAvailablePort({ range: 40, start: 43117 });
   const prepared = await prepareDev({
     cwd,
     inspector: false,
-    offline: existsSync38(join33(devRoot(cwd), "server")),
+    offline: existsSync41(join34(devRoot(cwd), "server")),
     organizationId: target.organizationId,
     port,
     serverId: target.serverId,
@@ -35979,38 +36530,38 @@ function registerConnectionsCommands(program) {
 // src/lib/plugins.ts
 import { spawn as spawn7 } from "node:child_process";
 import {
-  existsSync as existsSync39,
+  existsSync as existsSync42,
   mkdirSync as mkdirSync19,
   readdirSync as readdirSync5,
-  readFileSync as readFileSync29,
+  readFileSync as readFileSync30,
   rmSync as rmSync3,
   statSync as statSync7
 } from "node:fs";
-import { join as join34 } from "node:path";
+import { join as join35 } from "node:path";
 import { pathToFileURL } from "node:url";
 function pluginsDir() {
-  return join34(configDir(), "plugins");
+  return join35(configDir(), "plugins");
 }
 function ensureDir2() {
   const dir = pluginsDir();
-  if (!existsSync39(dir))
+  if (!existsSync42(dir))
     mkdirSync19(dir, { recursive: true, mode: 448 });
 }
 function readManifestFromPackageDir(packageDir) {
-  const pkgPath = join34(packageDir, "package.json");
-  if (!existsSync39(pkgPath))
+  const pkgPath = join35(packageDir, "package.json");
+  if (!existsSync42(pkgPath))
     return null;
   let pkg;
   try {
-    pkg = JSON.parse(readFileSync29(pkgPath, "utf-8"));
+    pkg = JSON.parse(readFileSync30(pkgPath, "utf-8"));
   } catch {
     return null;
   }
   if (!pkg.name)
     return null;
   const relEntry = pkg.mcpsh?.register ?? pkg.mcp?.register ?? pkg.main ?? "index.js";
-  const entry = join34(packageDir, relEntry);
-  if (!existsSync39(entry))
+  const entry = join35(packageDir, relEntry);
+  if (!existsSync42(entry))
     return null;
   return {
     name: pkg.name,
@@ -36021,11 +36572,11 @@ function readManifestFromPackageDir(packageDir) {
 }
 function listInstalledPlugins() {
   const dir = pluginsDir();
-  if (!existsSync39(dir))
+  if (!existsSync42(dir))
     return [];
   const out = [];
   for (const entry of readdirSync5(dir)) {
-    const full = join34(dir, entry);
+    const full = join35(dir, entry);
     let s;
     try {
       s = statSync7(full);
@@ -36036,7 +36587,7 @@ function listInstalledPlugins() {
       continue;
     if (entry.startsWith("@")) {
       for (const child of readdirSync5(full)) {
-        const m = readManifestFromPackageDir(join34(full, child));
+        const m = readManifestFromPackageDir(join35(full, child));
         if (m)
           out.push(m);
       }
@@ -36100,12 +36651,12 @@ async function installPlugin(packageSpec) {
   if (code !== 0) {
     throw new Error(`npm install ${packageSpec} exited with code ${code}.`);
   }
-  const nm = join34(dir, "node_modules");
-  if (!existsSync39(nm)) {
+  const nm = join35(dir, "node_modules");
+  if (!existsSync42(nm)) {
     throw new Error(`npm install ran but produced no node_modules under ${dir}.`);
   }
   const baseName = packageSpec.replace(/@[^@/]+$/, "");
-  const candidatePath = baseName.startsWith("@") ? join34(nm, baseName.split("/")[0], baseName.split("/")[1] ?? "") : join34(nm, baseName);
+  const candidatePath = baseName.startsWith("@") ? join35(nm, baseName.split("/")[0], baseName.split("/")[1] ?? "") : join35(nm, baseName);
   const manifest = readManifestFromPackageDir(candidatePath);
   if (!manifest) {
     throw new Error(`Installed but could not read plugin manifest at ${candidatePath}.`);
@@ -36113,26 +36664,26 @@ async function installPlugin(packageSpec) {
   return { name: manifest.name, entry: manifest.entry };
 }
 function removePlugin(name) {
-  const nm = join34(pluginsDir(), "node_modules");
-  if (!existsSync39(nm))
+  const nm = join35(pluginsDir(), "node_modules");
+  if (!existsSync42(nm))
     return false;
-  const target = name.startsWith("@") ? join34(nm, name.split("/")[0], name.split("/")[1] ?? "") : join34(nm, name);
-  if (!existsSync39(target))
+  const target = name.startsWith("@") ? join35(nm, name.split("/")[0], name.split("/")[1] ?? "") : join35(nm, name);
+  if (!existsSync42(target))
     return false;
   rmSync3(target, { recursive: true, force: true });
   return true;
 }
 function listInstalledPluginsCombined() {
   const direct = listInstalledPlugins();
-  const nm = join34(pluginsDir(), "node_modules");
-  if (!existsSync39(nm))
+  const nm = join35(pluginsDir(), "node_modules");
+  if (!existsSync42(nm))
     return direct;
   const seen = new Set(direct.map((p) => p.name));
   const out = [...direct];
   for (const entry of readdirSync5(nm)) {
     if (entry === ".bin" || entry === ".package-lock.json")
       continue;
-    const full = join34(nm, entry);
+    const full = join35(nm, entry);
     let s;
     try {
       s = statSync7(full);
@@ -36143,7 +36694,7 @@ function listInstalledPluginsCombined() {
       continue;
     if (entry.startsWith("@")) {
       for (const child of readdirSync5(full)) {
-        const m = readManifestFromPackageDir(join34(full, child));
+        const m = readManifestFromPackageDir(join35(full, child));
         if (m && !seen.has(m.name)) {
           seen.add(m.name);
           out.push(m);
@@ -36366,7 +36917,7 @@ async function runResume(selection, deps) {
     return mapMutationError(err, `resume ${selection.name}`);
   }
 }
-async function runDeploy(selection, deps) {
+async function runDeploy2(selection, deps) {
   try {
     await deps.api.post("/api/v1/server/deploy", {
       organizationId: deps.organizationId,
@@ -36736,8 +37287,13 @@ var CLI_EXAMPLES = {
   "servers pause": ["mcp servers pause srv_abc"],
   "servers resume": ["mcp servers resume srv_abc"],
   "servers push-spec": [
-    "mcp servers push-spec ./openapi.json --project proj_abc",
-    'mcp servers push-spec ./openapi.json --project proj_abc --name "Pages API"'
+    "mcp servers push-spec srv_abc --spec ./openapi.json",
+    "mcp servers push-spec srv_abc --spec ./openapi.json --apply --deploy --wait",
+    "mcp servers push-spec srv_abc --spec ./openapi.json --apply --rename-to-operation-ids"
+  ],
+  "servers regenerate": [
+    "mcp servers regenerate srv_abc --dry-run",
+    "mcp servers regenerate srv_abc && mcp servers deploy srv_abc --wait"
   ],
   "servers env list": ["mcp servers env list srv_abc"],
   "servers env set": [
@@ -36761,6 +37317,14 @@ var CLI_EXAMPLES = {
   "tools pull": ["mcp tools pull srv_abc"],
   "tools pull-handler": ["mcp tools pull-handler srv_abc query_users"],
   "tools reset-handler": ["mcp tools reset-handler srv_abc query_users"],
+  "tools rename": [
+    "mcp tools rename getrecording getRecording --server srv_abc",
+    "mcp tools rename --from-operation-ids --server srv_abc --dry-run",
+    "mcp tools rename --map @renames.json --server srv_abc"
+  ],
+  "tools delete": [
+    "mcp tools delete query_users --server srv_abc --confirm query_users"
+  ],
   invoke: ["mcp invoke srv_abc query_users @args.json"],
   "skills list": ["mcp skills list"],
   "skills connect": [
@@ -37735,12 +38299,12 @@ function displayValueFor(field, value) {
 
 // src/lib/tui/state-store.ts
 import {
-  existsSync as existsSync40,
+  existsSync as existsSync43,
   mkdirSync as mkdirSync20,
-  readFileSync as readFileSync30,
+  readFileSync as readFileSync31,
   writeFileSync as writeFileSync22
 } from "node:fs";
-import { join as join35 } from "node:path";
+import { join as join36 } from "node:path";
 var ALL_TABS = [
   "servers",
   "projects",
@@ -37750,7 +38314,7 @@ var ALL_TABS = [
   "devSessions"
 ];
 function tuiStateFile() {
-  return join35(configDir(), "tui-state.json");
+  return join36(configDir(), "tui-state.json");
 }
 function isTab(v) {
   return typeof v === "string" && ALL_TABS.includes(v);
@@ -37815,11 +38379,11 @@ function sanitizeTuiState(input) {
 }
 function readTuiState() {
   const path = tuiStateFile();
-  if (!existsSync40(path))
+  if (!existsSync43(path))
     return {};
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync30(path, "utf-8"));
+    parsed = JSON.parse(readFileSync31(path, "utf-8"));
   } catch {
     return {};
   }
@@ -37827,7 +38391,7 @@ function readTuiState() {
 }
 function writeTuiState(state) {
   try {
-    if (!existsSync40(configDir())) {
+    if (!existsSync43(configDir())) {
       mkdirSync20(configDir(), { recursive: true, mode: 448 });
     }
     writeFileSync22(tuiStateFile(), JSON.stringify(state, null, 2), {
@@ -39758,7 +40322,7 @@ function registerUiCommand(program) {
           openConfirmAction({
             prompt: `Deploy ${selection.name}?`,
             detail: "Triggers a workersDev build from the current bundle. Takes ~10–30s.",
-            run: () => runDeploy(selection, actionDeps)
+            run: () => runDeploy2(selection, actionDeps)
           });
           return true;
         }