@mcpcloud/cli 0.26.0 → 0.27.0

package/README.md

@@ -507,9 +507,12 @@ _Generated from the live command tree by `bun run docs:readme` — do not edit b
 | `mcp servers deps add <server> <child>` | Compose <child>'s tools into <server>. Both accept an id, name or slug. |
 | `mcp servers deps list [server]` | List the servers this one composes. |
 | `mcp servers deps rm <server> <dependencyId>` | Remove a composed dependency (id from `deps list`). |
-| `mcp servers end-user` | Read and set a server's end-user plane: the access switch and the tool allowlist customers may call. |
+| `mcp servers end-user` | Read and set a server's end-user plane: the access switch, the tool allowlist customers may call, and how they sign in. |
 | `mcp servers end-user get <server>` | Show the end-user access configuration: switch, connect page, allowed tools, branding, and how customers sign in. |
 | `mcp servers end-user set <server>` | Enable or disable end-user access, and/or replace the tool allowlist. |
+| `mcp servers end-user sign-in` | How customers sign in: the one mode, and the settings of the chosen one. |
+| `mcp servers end-user sign-in get <server>` | Show the chosen sign-in mode, the door customers actually meet, and each mode’s settings. |
+| `mcp servers end-user sign-in set <server>` | Choose how customers sign in and set its settings. Sends only what the flags name; choosing a mode turns the others off. |
 | `mcp servers env` | Manage server runtime environment bindings (encrypted secrets injected by the proxy). |
 | `mcp servers env get <server> <bindingName>` | Show metadata for one env binding. Plaintext is never returned — values are write-only. |
 | `mcp servers env list <server>` | List a server's env bindings (metadata only; values are never returned). |
@@ -531,6 +534,9 @@ _Generated from the live command tree by `bun run docs:readme` — do not edit b
 | `mcp servers ingest` | Create a server from an OpenAPI spec (file, URL, or @- stdin) or a GraphQL endpoint. Wraps POST /api/v1/server/ingest. |
 | `mcp servers list` | List servers |
 | `mcp servers logs <server>` | Show recent deployment events for a server's latest deployment |
+| `mcp servers oauth` | Read and set a server's OAuth provider: the endpoints, client credentials, scopes and tool coverage it uses for delegated authorization. |
+| `mcp servers oauth get <server>` | Show the OAuth provider: status, endpoints, client id, whether a secret is on file, scopes, tool coverage, and the callback URL to register. |
+| `mcp servers oauth set <server>` | Set the OAuth provider. Partial: a flag left off keeps what is stored. |
 | `mcp servers oauth-connections <server>` | List OAuth provider connections bound to this server |
 | `mcp servers pause <server>` | Pause the server's latest active deployment (traffic stops; worker is preserved) |
 | `mcp servers promote <server>` | Ship the bytes a lane is serving into another lane. Config, secrets and member credentials stay with the target. |

package/dist/index.js

@@ -6243,9 +6243,20 @@ function registerServerShapingCommands(servers) {
 }
 
 // src/commands/servers-end-user.ts
+import { readFileSync as readFileSync6 } from "node:fs";
+
+// src/commands/servers-end-user-sign-in.ts
 import { readFileSync as readFileSync5 } from "node:fs";
 var END_USER_PATH = "/api/v1/server/end-user-access";
-async function readEndUserAccess(serverRef, opts) {
+var CUSTOMER_SIGN_IN_PATH = "/api/v1/server/customer-sign-in";
+var MODES = ["account", "page", "upstream", "federation"];
+var MODE_LABEL = {
+  account: "an MCPCloud account",
+  page: "sign-in on your page",
+  upstream: "your OAuth provider",
+  federation: "your own sign-in (federation)"
+};
+async function readSignIn(serverRef, opts) {
   const orgId = await resolveOrgId(opts.org);
   const serverId = await resolveServerId(serverRef, orgId, undefined);
   return await api.get(END_USER_PATH, {
@@ -6253,6 +6264,164 @@ async function readEndUserAccess(serverRef, opts) {
     serverId
   });
 }
+function printSignIn(data) {
+  const chosen = data.customerSignIn;
+  if (!chosen) {
+    printKeyValue({
+      server: `${data.server.name} (${data.server.id})`,
+      "sign-in": "unknown — this deployment does not report the choice"
+    });
+    return;
+  }
+  const live = data.signInMode ?? "account";
+  const methods = Object.entries(chosen.page).filter(([, on]) => on).map(([name]) => name);
+  const identity = chosen.identity;
+  printKeyValue({
+    server: `${data.server.name} (${data.server.id})`,
+    "chosen mode": MODE_LABEL[chosen.mode],
+    "live door": live === chosen.mode || chosen.mode === "page" && live === "account" && methods.length > 0 ? "the chosen mode" : `${MODE_LABEL[live] ?? live} — the chosen mode is not finished`,
+    "page methods": methods.length > 0 ? methods.join(", ") : "none",
+    "identity source": identity.source === "idToken" ? `id_token${identity.endpoint ? ` (fallback ${identity.endpoint} → ${identity.userIdPath ?? "(no path)"})` : ""}` : identity.endpoint ? `${identity.endpoint} → ${identity.userIdPath ?? "(no path)"}` : "not configured",
+    provider: data.upstreamSignIn?.providerLabel ?? "—",
+    federation: data.signIn.configured ? `${data.signIn.status} (${data.signIn.issuer}, keys via ${data.signIn.keySource})` : "not configured",
+    "sign-in url": data.signIn.signInUrl ?? "—"
+  });
+}
+function onOff(value, flag) {
+  if (value === undefined)
+    return;
+  const normalized = value.trim().toLowerCase();
+  if (normalized === "on" || normalized === "true")
+    return true;
+  if (normalized === "off" || normalized === "false")
+    return false;
+  throw new Error(`${flag} must be on or off.`);
+}
+function textOrNull(value) {
+  if (value === undefined)
+    return;
+  const trimmed = value.trim();
+  if (trimmed.toLowerCase() === "none")
+    return null;
+  return trimmed.startsWith("@") ? readFileSync5(trimmed.slice(1), "utf8").trim() : trimmed;
+}
+function buildCustomerSignInBody(opts) {
+  const body = {};
+  if (opts.mode !== undefined) {
+    if (!MODES.includes(opts.mode)) {
+      throw new Error(`--mode must be one of ${MODES.join(", ")}.`);
+    }
+    body.mode = opts.mode;
+  }
+  const page = {};
+  for (const [flag, key] of [
+    ["--email-code", "emailCode"],
+    ["--google", "google"],
+    ["--github", "github"]
+  ]) {
+    const value = onOff(opts[key], flag);
+    if (value !== undefined)
+      page[key] = value;
+  }
+  if (Object.keys(page).length > 0)
+    body.page = page;
+  const identity = {};
+  if (opts.identitySource !== undefined) {
+    if (opts.identitySource !== "idToken" && opts.identitySource !== "userinfo") {
+      throw new Error("--identity-source must be idToken or userinfo.");
+    }
+    identity.source = opts.identitySource;
+  }
+  for (const [flag, key] of [
+    ["identityEndpoint", "endpoint"],
+    ["identityUserIdPath", "userIdPath"],
+    ["identityEmailPath", "emailPath"],
+    ["identityNamePath", "namePath"]
+  ]) {
+    const value = textOrNull(opts[flag]);
+    if (value !== undefined)
+      identity[key] = value;
+  }
+  if (Object.keys(identity).length > 0)
+    body.identity = identity;
+  const federationGiven = opts.federationIssuer !== undefined || opts.federationJwksUri !== undefined || opts.federationJwks !== undefined || opts.federationSignInUrl !== undefined;
+  if (federationGiven) {
+    if (!opts.federationIssuer?.trim()) {
+      throw new Error("--federation-issuer is required when setting federation.");
+    }
+    const federation = { issuer: opts.federationIssuer.trim() };
+    for (const [flag, key] of [
+      ["federationJwksUri", "jwksUri"],
+      ["federationJwks", "jwks"],
+      ["federationSignInUrl", "signInUrl"]
+    ]) {
+      const value = textOrNull(opts[flag]);
+      if (value !== undefined)
+        federation[key] = value;
+    }
+    body.federation = federation;
+  }
+  if (Object.keys(body).length === 0) {
+    throw new Error("Pass at least one of --mode, a page method, an identity flag, or the federation flags.");
+  }
+  return body;
+}
+function registerServerEndUserSignInCommands(endUser) {
+  const signIn = endUser.command("sign-in").description("How customers sign in: the one mode, and the settings of the chosen one.");
+  signIn.command("get <server>").description("Show the chosen sign-in mode, the door customers actually meet, and each mode’s settings.").option("--org <organizationId>", "Organization ID").action(runAction(async (serverRef, opts) => {
+    const data = await readSignIn(serverRef, opts);
+    if (isJsonMode()) {
+      printJson(data.customerSignIn ?? data);
+      return;
+    }
+    printSignIn(data);
+  }));
+  signIn.command("set <server>").description("Choose how customers sign in and set its settings. Sends only what the flags name; choosing a mode turns the others off.").option("--org <organizationId>", "Organization ID").option("--mode <mode>", `One of ${MODES.join(", ")}`).option("--email-code <on|off>", "Sign-in on your page: the emailed code").option("--google <on|off>", "Sign-in on your page: MCPCloud’s Google app").option("--github <on|off>", "Sign-in on your page: MCPCloud’s GitHub app").option("--identity-source <idToken|userinfo>", "Where MCPCloud reads the user id after an OAuth sign-in").option("--identity-endpoint <url>", "Identity endpoint (`none` clears it)").option("--identity-user-id-path <path>", "JSON path to the stable user id").option("--identity-email-path <path>", "JSON path to the email (display only)").option("--identity-name-path <path>", "JSON path to the name (display only)").option("--federation-issuer <iss>", "Federation: the issuer your assertions carry").option("--federation-jwks-uri <url>", "Federation: where your public keys are published").option("--federation-jwks <json|@path>", "Federation: your public keys inline").option("--federation-sign-in-url <url>", "Federation: where signed-out visitors are sent (`none` clears it)").addHelpText("after", [
+    "",
+    "One mode per server. Choosing one turns the others off and keeps their",
+    "settings. Federation cannot be chosen before its trust exists: pass the",
+    "--federation-* flags in the same call.",
+    "",
+    "Everything here applies on the next sign-in — no redeploy. The provider",
+    "itself is `mcp servers oauth set`.",
+    "",
+    "Examples:",
+    "  $ mcp servers end-user sign-in set srv_123 --mode upstream --identity-source idToken",
+    "  $ mcp servers end-user sign-in set srv_123 --mode upstream \\",
+    "      --identity-endpoint https://api.example.com/v1/me --identity-user-id-path userId",
+    "  $ mcp servers end-user sign-in set srv_123 --mode page --email-code on --github on",
+    "  $ mcp servers end-user sign-in set srv_123 --mode federation \\",
+    "      --federation-issuer https://ids.example.com --federation-jwks-uri https://ids.example.com/.well-known/jwks.json"
+  ].join(`
+`)).action(runAction(async (serverRef, opts) => {
+    const body = buildCustomerSignInBody(opts);
+    const orgId = await resolveOrgId(opts.org);
+    const serverId = await resolveServerId(serverRef, orgId, undefined);
+    await api.put(CUSTOMER_SIGN_IN_PATH, {
+      organizationId: orgId,
+      serverId,
+      ...body
+    });
+    const updated = await readSignIn(serverRef, opts);
+    if (isJsonMode()) {
+      printJson(updated.customerSignIn ?? updated);
+      return;
+    }
+    printSuccess(`Customers of ${updated.server.name} sign in with ${MODE_LABEL[updated.customerSignIn?.mode ?? "account"]}.`);
+    printSignIn(updated);
+  }));
+}
+
+// src/commands/servers-end-user.ts
+var END_USER_PATH2 = "/api/v1/server/end-user-access";
+async function readEndUserAccess(serverRef, opts) {
+  const orgId = await resolveOrgId(opts.org);
+  const serverId = await resolveServerId(serverRef, orgId, undefined);
+  return await api.get(END_USER_PATH2, {
+    organizationId: orgId,
+    serverId
+  });
+}
 function describeSignInMode(data) {
   const upstream = data.upstreamSignIn;
   const provider = upstream?.providerLabel ?? "the OAuth provider";
@@ -6272,6 +6441,7 @@ function printEndUserAccess(data) {
     server: `${data.server.name} (${data.server.id})`,
     access: data.endUserAccess,
     "sign-in mode": describeSignInMode(data),
+    "chosen mode": data.customerSignIn?.mode ?? "—",
     "connect page": data.connectPageUrl ?? "—",
     "allowed tools": data.allowedTools.length > 0 ? `${data.allowedTools.length}: ${data.allowedTools.join(", ")}` : "none — end users can call nothing",
     "display name": data.branding?.displayName ?? "—",
@@ -6284,7 +6454,7 @@ function printEndUserAccess(data) {
   });
 }
 function parseToolList(raw) {
-  const text = raw.startsWith("@") ? readFileSync5(raw.slice(1), "utf8") : raw;
+  const text = raw.startsWith("@") ? readFileSync6(raw.slice(1), "utf8") : raw;
   const trimmed = text.trim();
   if (trimmed.startsWith("[")) {
     const parsed = JSON.parse(trimmed);
@@ -6296,7 +6466,8 @@ function parseToolList(raw) {
   return trimmed.split(",").map((entry) => entry.trim()).filter(Boolean);
 }
 function registerServerEndUserCommands(servers) {
-  const endUser = servers.command("end-user").alias("end-users").description("Read and set a server's end-user plane: the access switch and the tool allowlist customers may call.");
+  const endUser = servers.command("end-user").alias("end-users").description("Read and set a server's end-user plane: the access switch, the tool allowlist customers may call, and how they sign in.");
+  registerServerEndUserSignInCommands(endUser);
   endUser.command("get <server>").description("Show the end-user access configuration: switch, connect page, allowed tools, branding, and how customers sign in.").option("--org <organizationId>", "Organization ID").addHelpText("after", [
     "",
     "End users are deny-by-default, so `allowed tools` is exhaustive — a",
@@ -6341,7 +6512,7 @@ function registerServerEndUserCommands(servers) {
     const orgId = await resolveOrgId(opts.org);
     const enabled = opts.enable ? true : opts.disable ? false : current.endUserAccess === "enabled";
     const allowedTools = opts.allowTools ? parseToolList(opts.allowTools) : null;
-    await api.put(END_USER_PATH, {
+    await api.put(END_USER_PATH2, {
       organizationId: orgId,
       projectId: current.server.projectId,
       serverId: current.server.id,
@@ -6362,8 +6533,168 @@ function registerServerEndUserCommands(servers) {
   }));
 }
 
+// src/commands/servers-oauth.ts
+import { readFileSync as readFileSync7 } from "node:fs";
+var OAUTH_PROVIDER_PATH = "/api/v1/server/oauth-provider";
+async function readProvider(serverRef, opts) {
+  const orgId = await resolveOrgId(opts.org);
+  const serverId = await resolveServerId(serverRef, orgId, undefined);
+  return await api.get(OAUTH_PROVIDER_PATH, {
+    organizationId: orgId,
+    serverId
+  });
+}
+function printProvider(data) {
+  const { oauth } = data;
+  printKeyValue({
+    server: `${data.server.name} (${data.server.id})`,
+    status: !oauth.enabled ? "disabled" : oauth.configured ? "enabled and configured" : "enabled — incomplete",
+    provider: oauth.providerKey ? `${oauth.providerLabel ?? oauth.providerKey} (${oauth.providerKey}, ${oauth.providerKind ?? "oauth2"})` : "not set up",
+    "authorization url": oauth.authorizationUrl ?? "—",
+    "token url": oauth.tokenUrl ?? "—",
+    "revocation url": oauth.revocationUrl ?? "—",
+    "client id": oauth.clientId ?? "—",
+    "client secret": oauth.hasClientSecret ? "on file (write-only)" : "none",
+    scopes: oauth.scopes.length > 0 ? oauth.scopes.join(" ") : "—",
+    "tool coverage": oauth.applyToAllTools ? "every tool (regenerate + deploy to apply a change)" : "only tools whose spec declares OAuth",
+    "callback url": oauth.callbackUrl ?? "—"
+  });
+}
+function urlOrNull(value) {
+  if (value === undefined)
+    return;
+  return value.trim().toLowerCase() === "none" ? null : value.trim();
+}
+function readClientSecret(opts) {
+  if (opts.clientSecretStdin && opts.clientSecretEnv) {
+    throw new Error("--client-secret-stdin and --client-secret-env are mutually exclusive.");
+  }
+  if (opts.clientSecretStdin) {
+    const secret = readFileSync7(0, "utf8").trim();
+    if (!secret)
+      throw new Error("No client secret was read from stdin.");
+    return secret;
+  }
+  if (opts.clientSecretEnv) {
+    const secret = process.env[opts.clientSecretEnv]?.trim();
+    if (!secret) {
+      throw new Error(`${opts.clientSecretEnv} is not set in the environment.`);
+    }
+    return secret;
+  }
+  return;
+}
+function buildOAuthProviderBody(opts) {
+  if (opts.enable && opts.disable) {
+    throw new Error("--enable and --disable are mutually exclusive.");
+  }
+  if (opts.kind !== undefined && opts.kind !== "oauth2" && opts.kind !== "openIdConnect") {
+    throw new Error("--kind must be oauth2 or openIdConnect.");
+  }
+  const clientSecret = readClientSecret(opts);
+  if (clientSecret !== undefined && opts.clearClientSecret) {
+    throw new Error("A new client secret and --clear-client-secret are mutually exclusive.");
+  }
+  const body = {};
+  if (opts.enable)
+    body.enabled = true;
+  if (opts.disable)
+    body.enabled = false;
+  if (opts.provider !== undefined)
+    body.providerKey = opts.provider.trim();
+  if (opts.label !== undefined)
+    body.providerLabel = opts.label.trim() || null;
+  if (opts.kind !== undefined)
+    body.providerKind = opts.kind;
+  for (const [flag, key] of [
+    ["authorizationUrl", "authorizationUrl"],
+    ["tokenUrl", "tokenUrl"],
+    ["revocationUrl", "revocationUrl"]
+  ]) {
+    const value = urlOrNull(opts[flag]);
+    if (value !== undefined)
+      body[key] = value;
+  }
+  if (opts.clientId !== undefined)
+    body.clientId = opts.clientId.trim() || null;
+  if (clientSecret !== undefined)
+    body.clientSecret = clientSecret;
+  if (opts.clearClientSecret)
+    body.clearClientSecret = true;
+  if (opts.scopes !== undefined) {
+    body.scopes = opts.scopes.split(/[\s,]+/).map((scope) => scope.trim()).filter(Boolean);
+  }
+  if (opts.applyToAllTools !== undefined)
+    body.applyToAllTools = opts.applyToAllTools;
+  if (Object.keys(body).length === 0) {
+    throw new Error("Pass at least one provider flag to change.");
+  }
+  return body;
+}
+function registerServerOAuthCommands(servers) {
+  const oauth = servers.command("oauth").description("Read and set a server's OAuth provider: the endpoints, client credentials, scopes and tool coverage it uses for delegated authorization.");
+  oauth.command("get <server>").description("Show the OAuth provider: status, endpoints, client id, whether a secret is on file, scopes, tool coverage, and the callback URL to register.").option("--org <organizationId>", "Organization ID").addHelpText("after", [
+    "",
+    "The client secret is write-only: this shows whether one is on file,",
+    "never the value.",
+    "",
+    "Examples:",
+    "  $ mcp servers oauth get srv_123",
+    "  $ mcp --json servers oauth get srv_123 | jq '.oauth.callbackUrl'"
+  ].join(`
+`)).action(runAction(async (serverRef, opts) => {
+    const data = await readProvider(serverRef, opts);
+    if (isJsonMode()) {
+      printJson(data);
+      return;
+    }
+    printProvider(data);
+  }));
+  oauth.command("set <server>").description("Set the OAuth provider. Partial: a flag left off keeps what is stored.").option("--org <organizationId>", "Organization ID").option("--enable", "Use this provider for delegated authorization").option("--disable", "Stop using it (settings are kept)").option("--provider <key>", "Preset key (github, google, slack, …) or any identifier for a custom provider").option("--label <label>", "Shown to customers: “Continue with <label>”").option("--kind <oauth2|openIdConnect>", "Provider kind").option("--authorization-url <url>", "Authorization endpoint (`none` clears it)").option("--token-url <url>", "Token endpoint (`none` clears it)").option("--revocation-url <url>", "Revocation endpoint (`none` clears it)").option("--client-id <id>", "OAuth client id").option("--client-secret-stdin", "Read the client secret from stdin").option("--client-secret-env <VAR>", "Read the client secret from this environment variable").option("--clear-client-secret", "Remove the stored client secret").option("--scopes <list>", "Replace the scopes (comma or space separated)").option("--apply-to-all-tools", "Use this provider for every tool").option("--no-apply-to-all-tools", "Only for tools whose spec declares OAuth").addHelpText("after", [
+    "",
+    "Provider, credentials and scopes apply to new sign-ins and token",
+    "refreshes immediately. --apply-to-all-tools is baked into the worker:",
+    "regenerate and deploy to apply it.",
+    "",
+    "The secret never goes on the command line. Pipe it in, or name a",
+    "variable:",
+    '  $ printf %s "$SECRET" | mcp servers oauth set srv_123 --client-secret-stdin',
+    "  $ mcp servers oauth set srv_123 --client-secret-env GATHERD_OAUTH_SECRET",
+    "",
+    "Examples:",
+    "  $ mcp servers oauth set srv_123 --provider custom --label Gatherd \\",
+    "      --authorization-url https://gatherd.dev/oauth/authorize \\",
+    "      --token-url https://gatherd.dev/oauth/token --client-id abc \\",
+    "      --scopes read,write --enable --apply-to-all-tools",
+    "  $ mcp servers oauth set srv_123 --disable"
+  ].join(`
+`)).action(runAction(async (serverRef, opts) => {
+    const body = buildOAuthProviderBody(opts);
+    const orgId = await resolveOrgId(opts.org);
+    const serverId = await resolveServerId(serverRef, orgId, undefined);
+    await api.put(OAUTH_PROVIDER_PATH, {
+      organizationId: orgId,
+      serverId,
+      ...body
+    });
+    const updated = await readProvider(serverRef, opts);
+    if (isJsonMode()) {
+      printJson(updated);
+      return;
+    }
+    printSuccess(`OAuth provider saved for ${updated.server.name}.`);
+    printProvider(updated);
+    if (updated.oauth.callbackUrl) {
+      printInfo(`  Register ${updated.oauth.callbackUrl} with the provider.`);
+    }
+    if (body.applyToAllTools !== undefined) {
+      printInfo("  Tool coverage changed: regenerate and deploy to apply it.");
+    }
+  }));
+}
+
 // src/commands/servers-env.ts
-import { existsSync as existsSync3, readFileSync as readFileSync6 } from "node:fs";
+import { existsSync as existsSync3, readFileSync as readFileSync8 } from "node:fs";
 import { resolve } from "node:path";
 function registerServerEnvCommands(servers) {
   const env = servers.command("env").description("Manage server runtime environment bindings (encrypted secrets injected by the proxy).");
@@ -6512,7 +6843,7 @@ async function resolveSetValue(args) {
       printError(`--from-file path not found: ${path}`);
       throw new CliExitError(1);
     }
-    return readFileSync6(path, "utf-8");
+    return readFileSync8(path, "utf-8");
   }
   return await readStdin();
 }
@@ -6991,7 +7322,7 @@ function registerServerSandboxVariableCommands(servers) {
 }
 
 // src/lib/mcp-invoke.ts
-import { existsSync as existsSync4, readFileSync as readFileSync7 } from "node:fs";
+import { existsSync as existsSync4, readFileSync as readFileSync9 } from "node:fs";
 import { resolve as resolve2 } from "node:path";
 var DEFAULT_TIMEOUT_MS3 = 60000;
 var invokeRequestId = 1;
@@ -7213,7 +7544,7 @@ async function parseToolArguments(opts) {
     if (!existsSync4(filePath)) {
       return { ok: false, reason: "file-not-found", path: filePath };
     }
-    source = readFileSync7(filePath, "utf-8");
+    source = readFileSync9(filePath, "utf-8");
   } else {
     source = raw;
   }
@@ -7876,7 +8207,7 @@ import { isAbsolute as isAbsolute2, resolve as resolve4 } from "node:path";
 import { createHash as createHash2 } from "node:crypto";
 import {
   existsSync as existsSync5,
-  readFileSync as readFileSync8,
+  readFileSync as readFileSync10,
   watch as fsWatch
 } from "node:fs";
 import { dirname as dirname3 } from "node:path";
@@ -7931,7 +8262,7 @@ function summarizeDiff(diff) {
 `) };
 }
 function readSpecFile(specPath) {
-  const content = readFileSync8(specPath, "utf-8");
+  const content = readFileSync10(specPath, "utf-8");
   return { content, hash: hashSpecContent(content) };
 }
 function watchSpecFile(options) {
@@ -7951,7 +8282,7 @@ function watchSpecFile(options) {
       return;
     let content;
     try {
-      content = readFileSync8(options.specPath, "utf-8");
+      content = readFileSync10(options.specPath, "utf-8");
     } catch {
       return;
     }
@@ -8796,8 +9127,9 @@ function registerServerUpdateCommand(servers) {
   servers.command("update <server>").description("Update a server (name, description, tool surface, upstream key mode, runtime token TTL, spec source URL)").option("--org <organizationId>", "Organization ID").option("--name <name>", "New display name").option("--description <text>", "New description").option("--discovery-mode <all|wrapper>", 'Tool surface: "all" registers every operation; "wrapper" registers searchTools/getToolDefinition/useTool INSTEAD (operations are called through useTool).').option("--code-mode <off|opt-in|default>", "Code Mode: expose codemode_execute so an agent can script several calls in one sandboxed run. Served by the edge, so it takes effect on the next deploy.").option("--upstream-api-key-mode <shared|perMember>", "Whose upstream credential the server uses: one shared key, or each member their own (Pro and above). perMember needs a protected access mode (privateOrg or unlisted) — refused while the active deployment is public.").option("--runtime-token-ttl <seconds|default>", 'Runtime token lifetime in seconds (60-86400; the default AND cap for minted tokens). Pass "default" to restore the 300s platform default.').option("--source-url <url>", "Read this server’s spec from a different URL from now on. The URL is fetched and parsed as the server’s source type first, and the report shows what a regenerate from it would change. Tools are not touched until you regenerate.").option("--dry-run", "With --source-url: fetch, parse and report without storing anything").addHelpText("after", [
     "",
     "Notes:",
-    "  Runtime defaults (oauth, deploymentDefaults, runtime bindings) are not",
-    "  v1 PATCH-able. Change them via `mcp servers deploy --upstream-*`.",
+    "  The OAuth provider is `mcp servers oauth set`; how customers sign in is",
+    "  `mcp servers end-user sign-in set`. Other runtime defaults (deployment",
+    "  defaults, runtime bindings) are set via `mcp servers deploy --upstream-*`.",
     "  --discovery-mode and --code-mode change the server's TOOL SURFACE and",
     "  reach clients on the next `mcp servers deploy`. Check what is live with",
     "  `mcp servers get <server> --probe`.",
@@ -9085,7 +9417,7 @@ function registerServerMutationCommands(servers) {
 }
 
 // src/lib/spec-pipeline.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync9, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync11, writeFileSync as writeFileSync3 } from "node:fs";
 import { dirname as dirname4, join as join5, resolve as resolve5 } from "node:path";
 var SOURCE_TYPES = ["openapi", "graphql", "url"];
 function isHttpUrl(value) {
@@ -9118,7 +9450,7 @@ async function readSpecSource(spec, override, options = {}) {
     if (!existsSync7(filePath)) {
       throw new Error(`Spec file not found: ${filePath}`);
     }
-    content = readFileSync9(filePath, "utf-8");
+    content = readFileSync11(filePath, "utf-8");
     pathHint = filePath;
   }
   if (!content.trim()) {
@@ -9301,7 +9633,7 @@ function registerServerSpecCommands(servers) {
 }
 
 // src/commands/servers-test-authoring.ts
-import { readFileSync as readFileSync10 } from "node:fs";
+import { readFileSync as readFileSync12 } from "node:fs";
 var EXECUTION_PROFILES = [
   "mockBindings",
   "previewBindings",
@@ -9319,9 +9651,9 @@ function parseTimeoutMs(value, fallbackMs) {
 }
 function readValueOption(raw) {
   if (raw === "@-")
-    return readFileSync10(0, "utf8");
+    return readFileSync12(0, "utf8");
   if (raw.startsWith("@"))
-    return readFileSync10(raw.slice(1), "utf8");
+    return readFileSync12(raw.slice(1), "utf8");
   return raw;
 }
 async function resolveServerAndProject(serverRef, org) {
@@ -9683,6 +10015,7 @@ function registerServerCommands(program) {
   const servers = program.command("servers").description("Manage MCP servers");
   registerServerDepsCommands(servers);
   registerServerEndUserCommands(servers);
+  registerServerOAuthCommands(servers);
   registerServerTraceCommands(servers);
   registerServerGitCommands(servers);
   registerServerCommitCommand(servers);
@@ -9867,7 +10200,7 @@ import { existsSync as existsSync10 } from "node:fs";
 import { join as join8, relative } from "node:path";
 
 // src/lib/dev/state.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync11, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync13, writeFileSync as writeFileSync4 } from "node:fs";
 import { join as join6, resolve as resolve6 } from "node:path";
 function cachedStateMatchesTarget(cached, target) {
   return cached !== null && cached.serverId === target.serverId && cached.organizationId === target.organizationId;
@@ -9896,7 +10229,7 @@ function readState(cwd) {
   if (!existsSync8(path))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync11(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync13(path, "utf-8"));
     if (!parsed || typeof parsed !== "object")
       return null;
     const s = parsed;
@@ -9937,7 +10270,7 @@ function ensureGitignore(cwd) {
 import {
   existsSync as existsSync9,
   mkdirSync as mkdirSync6,
-  readFileSync as readFileSync12,
+  readFileSync as readFileSync14,
   readdirSync,
   rmSync,
   writeFileSync as writeFileSync5
@@ -10151,7 +10484,7 @@ function readToolsState(devRootDir, serverId) {
   if (!existsSync9(file))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync12(file, "utf-8"));
+    const parsed = JSON.parse(readFileSync14(file, "utf-8"));
     if (!parsed || typeof parsed !== "object")
       return null;
     const s = parsed;
@@ -10231,7 +10564,7 @@ function readLocalTool(devRootDir, serverId, toolName) {
   const stateEntry = state?.tools[toolName];
   if (!stateEntry)
     return null;
-  const view = parseToolMarkdown(readFileSync12(filePath, "utf-8"));
+  const view = parseToolMarkdown(readFileSync14(filePath, "utf-8"));
   return {
     view,
     cloudId: stateEntry.id,
@@ -10436,14 +10769,14 @@ async function runToolsDelete(toolName, opts) {
 }
 
 // src/commands/tools-diff.ts
-import { existsSync as existsSync12, readFileSync as readFileSync14 } from "node:fs";
+import { existsSync as existsSync12, readFileSync as readFileSync16 } from "node:fs";
 import { relative as relative2 } from "node:path";
 
 // src/lib/dev/handlers-sync.ts
 import {
   existsSync as existsSync11,
   mkdirSync as mkdirSync7,
-  readFileSync as readFileSync13,
+  readFileSync as readFileSync15,
   statSync,
   writeFileSync as writeFileSync6
 } from "node:fs";
@@ -10490,7 +10823,7 @@ async function pushLocalHandlerEdit(args) {
   if (!resolved) {
     return { kind: "unknown-tool", slug: args.slug };
   }
-  const source = readFileSync13(filePath, "utf-8");
+  const source = readFileSync15(filePath, "utf-8");
   const hash = hashSource(source);
   if (lastPushedHash.get(filePath) === hash) {
     return { kind: "noop" };
@@ -10649,7 +10982,7 @@ function inspectLocalHandler(args) {
   if (!existsSync11(filePath))
     return { kind: "no-local-file" };
   const cached = lastPushedHash.get(filePath);
-  const onDisk = hashSource(readFileSync13(filePath, "utf-8"));
+  const onDisk = hashSource(readFileSync15(filePath, "utf-8"));
   if (cached !== undefined) {
     return cached === onDisk ? { kind: "matches-cache" } : { kind: "differs-from-cache" };
   }
@@ -10770,7 +11103,7 @@ function buildMetadataDiff(args) {
   let local = null;
   let parseError = null;
   try {
-    local = parseToolMarkdown(readFileSync14(filePath, "utf-8"));
+    local = parseToolMarkdown(readFileSync16(filePath, "utf-8"));
   } catch (err) {
     parseError = err instanceof Error ? err.message : String(err);
   }
@@ -10813,7 +11146,7 @@ async function buildHandlerDiff(args) {
   const slug = handlerSlugFromToolName(args.toolName);
   const filePath = `${serverBundleHandlersDir(args.devRootDir)}/${slug}.ts`;
   const hasLocal = existsSync12(filePath);
-  const localContent = hasLocal ? readFileSync14(filePath, "utf-8") : null;
+  const localContent = hasLocal ? readFileSync16(filePath, "utf-8") : null;
   const localPath = hasLocal ? relative2(args.cwd, filePath) || filePath : null;
   const changed = hasLocal ? localContent !== cloudResult.snapshot.content : true;
   return {
@@ -10928,7 +11261,7 @@ import { join as join11, relative as relative3 } from "node:path";
 
 // src/lib/editor-shell.ts
 import { spawn as spawn2 } from "node:child_process";
-import { existsSync as existsSync13, readFileSync as readFileSync15 } from "node:fs";
+import { existsSync as existsSync13, readFileSync as readFileSync17 } from "node:fs";
 import { platform as platform2 } from "node:os";
 import { delimiter, join as join10 } from "node:path";
 var DEFAULT_FALLBACKS = ["vi"];
@@ -11014,7 +11347,7 @@ async function runEditor(args) {
       message: `${command} exited with code ${exitCode}. The file may be unsaved; re-run after fixing.`
     };
   }
-  const contents = readFileSync15(args.filePath, "utf-8");
+  const contents = readFileSync17(args.filePath, "utf-8");
   return { ok: true, contents, command };
 }
 
@@ -11818,7 +12151,7 @@ import { existsSync as existsSync16 } from "node:fs";
 import { relative as relative6 } from "node:path";
 
 // src/commands/tools-rename-input.ts
-import { existsSync as existsSync15, readFileSync as readFileSync16 } from "node:fs";
+import { existsSync as existsSync15, readFileSync as readFileSync18 } from "node:fs";
 import { isAbsolute as isAbsolute3, resolve as resolve7 } from "node:path";
 var MODES_HINT = "Pass exactly one of: <old> <new>, --from-operation-ids, or --map @renames.json.";
 function resolveRenameSelection(args) {
@@ -11853,7 +12186,7 @@ function readRenameMap(ref, cwd) {
     throw new CliExitError(1, `--map file not found: ${path}`);
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync16(path, "utf-8"));
+    parsed = JSON.parse(readFileSync18(path, "utf-8"));
   } catch (err) {
     throw new CliExitError(1, `--map file is not valid JSON (${path}): ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -12531,13 +12864,13 @@ function isAgentKey(value) {
 }
 
 // src/commands/skills-lifecycle.ts
-import { readFileSync as readFileSync17 } from "node:fs";
+import { readFileSync as readFileSync19 } from "node:fs";
 function readValueOption2(raw) {
   if (raw === "@-") {
-    return readFileSync17(0, "utf8");
+    return readFileSync19(0, "utf8");
   }
   if (raw.startsWith("@")) {
-    return readFileSync17(raw.slice(1), "utf8");
+    return readFileSync19(raw.slice(1), "utf8");
   }
   return raw;
 }
@@ -12887,7 +13220,7 @@ function registerSkillMutationCommands(skills) {
 }
 
 // src/commands/skills-test-authoring.ts
-import { readFileSync as readFileSync18 } from "node:fs";
+import { readFileSync as readFileSync20 } from "node:fs";
 var FIXTURE_MODES = [
   "baseline",
   "validationFailure",
@@ -12896,9 +13229,9 @@ var FIXTURE_MODES = [
 ];
 function readValueOption3(raw) {
   if (raw === "@-")
-    return readFileSync18(0, "utf8");
+    return readFileSync20(0, "utf8");
   if (raw.startsWith("@"))
-    return readFileSync18(raw.slice(1), "utf8");
+    return readFileSync20(raw.slice(1), "utf8");
   return raw;
 }
 function parseAssertionsOption(raw) {
@@ -13951,14 +14284,14 @@ function registerSkillCommands(program) {
 }
 
 // src/lib/dev/prepare.ts
-import { existsSync as existsSync24, readFileSync as readFileSync22, writeFileSync as writeFileSync12 } from "node:fs";
+import { existsSync as existsSync24, readFileSync as readFileSync24, writeFileSync as writeFileSync12 } from "node:fs";
 import { join as join19, relative as relative8, resolve as resolve9 } from "node:path";
 
 // src/lib/dev/bundle-sync.ts
 import {
   existsSync as existsSync18,
   mkdirSync as mkdirSync9,
-  readFileSync as readFileSync19,
+  readFileSync as readFileSync21,
   rmSync as rmSync2,
   writeFileSync as writeFileSync8
 } from "node:fs";
@@ -14095,7 +14428,7 @@ import { spawnSync } from "node:child_process";
 import {
   existsSync as existsSync19,
   mkdirSync as mkdirSync10,
-  readFileSync as readFileSync20,
+  readFileSync as readFileSync22,
   writeFileSync as writeFileSync9
 } from "node:fs";
 import { dirname as dirname8, join as join14 } from "node:path";
@@ -14190,7 +14523,7 @@ function isGitAvailable() {
 }
 function applyLocalExcludes(repoDir) {
   const excludePath = join14(repoDir, ".git", "info", "exclude");
-  const existing = existsSync19(excludePath) ? readFileSync20(excludePath, "utf-8") : "";
+  const existing = existsSync19(excludePath) ? readFileSync22(excludePath, "utf-8") : "";
   const next = mergeLocalExcludes(existing);
   if (next === null)
     return;
@@ -29576,7 +29909,7 @@ import {
   appendFileSync as appendFileSync2,
   existsSync as existsSync22,
   mkdirSync as mkdirSync13,
-  readFileSync as readFileSync21,
+  readFileSync as readFileSync23,
   readdirSync as readdirSync2,
   renameSync,
   statSync as statSync2
@@ -29628,7 +29961,7 @@ function readAll(dir) {
   for (const path of [...listRotatedFiles(dir), activeFilePath(dir)]) {
     if (!existsSync22(path))
       continue;
-    out.push(...parseLines(readFileSync21(path, "utf-8")));
+    out.push(...parseLines(readFileSync23(path, "utf-8")));
   }
   return out;
 }
@@ -29780,9 +30113,9 @@ function printEnvBindingHint(dest, envPath, cwd) {
   let example = "";
   let envJson = "{}";
   try {
-    example = readFileSync22(examplePath, "utf-8");
+    example = readFileSync24(examplePath, "utf-8");
     if (existsSync24(envPath))
-      envJson = readFileSync22(envPath, "utf-8");
+      envJson = readFileSync24(envPath, "utf-8");
   } catch {
     return;
   }
@@ -29955,7 +30288,7 @@ async function prepareDev(opts) {
 
 // src/lib/dev/tree-sync.ts
 import { createHash as createHash4 } from "node:crypto";
-import { existsSync as existsSync25, mkdirSync as mkdirSync14, readdirSync as readdirSync3, readFileSync as readFileSync23, writeFileSync as writeFileSync13 } from "node:fs";
+import { existsSync as existsSync25, mkdirSync as mkdirSync14, readdirSync as readdirSync3, readFileSync as readFileSync25, writeFileSync as writeFileSync13 } from "node:fs";
 import { join as join20 } from "node:path";
 var AUTHORING_GUIDE_FILE = "AGENTS.md";
 var STRUCTURAL_FRONTMATTER_KEYS = [
@@ -29977,7 +30310,7 @@ function listToolFiles(devRootDir, serverId) {
 }
 function readToolFile(devRootDir, serverId, toolName) {
   const file = join20(serverToolsDir(devRootDir, serverId), `${toolName}.md`);
-  const raw = readFileSync23(file, "utf-8");
+  const raw = readFileSync25(file, "utf-8");
   try {
     return { raw, view: parseToolMarkdown(raw) };
   } catch (err) {
@@ -30105,7 +30438,7 @@ function listHandlerFiles(devRootDir) {
     return [];
   return readdirSync3(dir).filter((entry) => entry.endsWith(".ts") && !entry.endsWith(".definition.ts")).sort().map((entry) => ({
     slug: entry.slice(0, -3),
-    source: readFileSync23(join20(dir, entry), "utf-8")
+    source: readFileSync25(join20(dir, entry), "utf-8")
   }));
 }
 function writeHandlerManifest(args) {
@@ -30133,7 +30466,7 @@ function recordHandlerPushed(args) {
     serverId: args.serverId,
     version: 1
   };
-  manifest.handlers[args.slug] = hashSource2(readFileSync23(file, "utf-8"));
+  manifest.handlers[args.slug] = hashSource2(readFileSync25(file, "utf-8"));
   writeFileSync13(handlerManifestPath(args.devRootDir, args.serverId), JSON.stringify(manifest, null, 2), "utf-8");
 }
 function readHandlerManifest(devRootDir, serverId) {
@@ -30141,7 +30474,7 @@ function readHandlerManifest(devRootDir, serverId) {
   if (!existsSync25(file))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync23(file, "utf-8"));
+    const parsed = JSON.parse(readFileSync25(file, "utf-8"));
     return parsed.version === 1 && parsed.handlers ? parsed : null;
   } catch {
     return null;
@@ -31165,7 +31498,7 @@ import { isAbsolute as isAbsolute5, relative as relative9, resolve as resolve11
 import {
   existsSync as existsSync26,
   mkdirSync as mkdirSync15,
-  readFileSync as readFileSync24,
+  readFileSync as readFileSync26,
   readdirSync as readdirSync4,
   unlinkSync,
   writeFileSync as writeFileSync14
@@ -31209,7 +31542,7 @@ function listSessions() {
       continue;
     const path = join22(dir, entry);
     try {
-      const parsed = JSON.parse(readFileSync24(path, "utf-8"));
+      const parsed = JSON.parse(readFileSync26(path, "utf-8"));
       if (typeof parsed.pid !== "number") {
         unlinkSync(path);
         continue;
@@ -32581,19 +32914,19 @@ import { homedir as homedir4 } from "node:os";
 import { join as join27 } from "node:path";
 
 // src/lib/dev/agent-connectors/json-config-utils.ts
-import { existsSync as existsSync32, mkdirSync as mkdirSync16, readFileSync as readFileSync25, writeFileSync as writeFileSync15 } from "node:fs";
+import { existsSync as existsSync32, mkdirSync as mkdirSync16, readFileSync as readFileSync27, writeFileSync as writeFileSync15 } from "node:fs";
 import { dirname as dirname10, join as join26, basename } from "node:path";
 function readJsonFile(path) {
   if (!existsSync32(path))
     return { ok: true, value: {} };
   try {
-    const raw = readFileSync25(path, "utf-8");
+    const raw = readFileSync27(path, "utf-8");
     if (!raw.trim())
       return { ok: true, value: {} };
     return { ok: true, value: JSON.parse(raw) };
   } catch {
     try {
-      return { ok: false, raw: readFileSync25(path, "utf-8") };
+      return { ok: false, raw: readFileSync27(path, "utf-8") };
     } catch {
       return { ok: false };
     }
@@ -32615,7 +32948,7 @@ function backupConfig(args) {
   const filename = `${args.agentId}__${basename(args.configPath)}.bak`;
   const backupPath = join26(args.backupsDir, filename);
   if (!existsSync32(backupPath)) {
-    const raw = readFileSync25(args.configPath, "utf-8");
+    const raw = readFileSync27(args.configPath, "utf-8");
     writeFileSync15(backupPath, raw, "utf-8");
   }
   return { backupPath, existed: true };
@@ -32626,7 +32959,7 @@ function restoreFromBackup(args) {
   if (!existsSync32(backupPath)) {
     return { restored: false };
   }
-  const raw = readFileSync25(backupPath, "utf-8");
+  const raw = readFileSync27(backupPath, "utf-8");
   mkdirSync16(dirname10(args.configPath), { recursive: true });
   writeFileSync15(args.configPath, raw, "utf-8");
   return { restored: true };
@@ -32715,7 +33048,7 @@ var claudeCodeConnector = {
 import {
   existsSync as existsSync34,
   mkdirSync as mkdirSync17,
-  readFileSync as readFileSync26,
+  readFileSync as readFileSync28,
   unlinkSync as unlinkSync3,
   writeFileSync as writeFileSync17
 } from "node:fs";
@@ -32774,7 +33107,7 @@ var codexConnector = {
     });
     let existing = "";
     if (existsSync34(path)) {
-      existing = readFileSync26(path, "utf-8");
+      existing = readFileSync28(path, "utf-8");
     }
     const conflict = findSectionRange(existing, args.name) !== null;
     let next = existing;
@@ -32796,7 +33129,7 @@ var codexConnector = {
   async remove(args) {
     const path = configPath2();
     if (existsSync34(path)) {
-      const existing = readFileSync26(path, "utf-8");
+      const existing = readFileSync28(path, "utf-8");
       const range = findSectionRange(existing, args.name);
       if (range) {
         const next = existing.slice(0, range.start) + existing.slice(range.end);
@@ -32809,7 +33142,7 @@ var codexConnector = {
       agentId: this.id
     });
     if (!restored.restored && existsSync34(path)) {
-      const after = readFileSync26(path, "utf-8");
+      const after = readFileSync28(path, "utf-8");
       if (!after.trim()) {
         try {
           unlinkSync3(path);
@@ -34292,12 +34625,12 @@ async function confirmRollback(deploymentId) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync40, statSync as statSync6, readFileSync as readFileSync28 } from "node:fs";
+import { existsSync as existsSync40, statSync as statSync6, readFileSync as readFileSync30 } from "node:fs";
 import { homedir as homedir9, platform as platform6 } from "node:os";
 import { join as join33, delimiter as delimiter3 } from "node:path";
 
 // src/lib/version-check.ts
-import { existsSync as existsSync39, mkdirSync as mkdirSync18, readFileSync as readFileSync27, writeFileSync as writeFileSync21 } from "node:fs";
+import { existsSync as existsSync39, mkdirSync as mkdirSync18, readFileSync as readFileSync29, writeFileSync as writeFileSync21 } from "node:fs";
 import { join as join32 } from "node:path";
 var CACHE_TTL_MS = 24 * 60 * 60 * 1000;
 var FETCH_TIMEOUT_MS2 = 2000;
@@ -34312,7 +34645,7 @@ function readCache() {
   if (!existsSync39(cacheFile()))
     return null;
   try {
-    const raw = JSON.parse(readFileSync27(cacheFile(), "utf-8"));
+    const raw = JSON.parse(readFileSync29(cacheFile(), "utf-8"));
     if (typeof raw.latest !== "string" || typeof raw.fetchedAt !== "number")
       return null;
     return { latest: raw.latest, fetchedAt: raw.fetchedAt };
@@ -34458,7 +34791,7 @@ function checkConfigFile() {
     } catch {}
   }
   try {
-    JSON.parse(readFileSync28(path, "utf-8"));
+    JSON.parse(readFileSync30(path, "utf-8"));
   } catch (err) {
     return {
       name: "Config file",
@@ -35341,7 +35674,7 @@ function registerInstallationCommands(program) {
 }
 
 // src/commands/invoke.ts
-import { existsSync as existsSync41, readFileSync as readFileSync29 } from "node:fs";
+import { existsSync as existsSync41, readFileSync as readFileSync31 } from "node:fs";
 import { join as join34 } from "node:path";
 
 // src/lib/dev/local-invoke.ts
@@ -35434,9 +35767,9 @@ function selectCodeModeInvocation(args) {
 }
 function readCodeOption(raw) {
   if (raw === "@-")
-    return readFileSync29(0, "utf-8");
+    return readFileSync31(0, "utf-8");
   if (raw.startsWith("@"))
-    return readFileSync29(raw.slice(1), "utf-8");
+    return readFileSync31(raw.slice(1), "utf-8");
   return raw;
 }
 function parseTimeoutMs4(value, fallbackMs) {
@@ -35718,7 +36051,7 @@ async function runLocalInvoke(args) {
     throw new CliExitError(1);
   }
   const env = {
-    ...args.envFile ? parseEnvFile(readFileSync29(args.envFile, "utf-8")) : {},
+    ...args.envFile ? parseEnvFile(readFileSync31(args.envFile, "utf-8")) : {},
     ...parseEnvPairs(args.envPairs)
   };
   const port = await findAvailablePort({ range: 40, start: 43117 });
@@ -36710,7 +37043,7 @@ import {
   existsSync as existsSync42,
   mkdirSync as mkdirSync19,
   readdirSync as readdirSync5,
-  readFileSync as readFileSync30,
+  readFileSync as readFileSync32,
   rmSync as rmSync3,
   statSync as statSync7
 } from "node:fs";
@@ -36730,7 +37063,7 @@ function readManifestFromPackageDir(packageDir) {
     return null;
   let pkg;
   try {
-    pkg = JSON.parse(readFileSync30(pkgPath, "utf-8"));
+    pkg = JSON.parse(readFileSync32(pkgPath, "utf-8"));
   } catch {
     return null;
   }
@@ -38483,7 +38816,7 @@ function displayValueFor(field, value) {
 import {
   existsSync as existsSync43,
   mkdirSync as mkdirSync20,
-  readFileSync as readFileSync31,
+  readFileSync as readFileSync33,
   writeFileSync as writeFileSync22
 } from "node:fs";
 import { join as join36 } from "node:path";
@@ -38565,7 +38898,7 @@ function readTuiState() {
     return {};
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync31(path, "utf-8"));
+    parsed = JSON.parse(readFileSync33(path, "utf-8"));
   } catch {
     return {};
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcpcloud/cli",
-  "version": "0.26.0",
+  "version": "0.27.0",
   "description": "The official CLI for MCPCloud — manage projects, servers, skills, and API keys from the terminal",
   "type": "module",
   "bin": {