@mcpcloud/cli 0.4.0 → 0.5.0

package/dist/index.js

@@ -2548,8 +2548,31 @@ function isJsonMode() {
   return jsonMode;
 }
 var ciMode = false;
+var nonInteractive = false;
+var quiet = false;
 var warningsAsErrors = false;
 var warningCount = 0;
+
+class CliExitError extends Error {
+  code;
+  constructor(code, message) {
+    super(message ?? "");
+    this.code = code;
+    this.name = "CliExitError";
+  }
+}
+function setNonInteractive(enabled) {
+  nonInteractive = enabled;
+}
+function isNonInteractive() {
+  return nonInteractive || ciMode;
+}
+function setQuiet(enabled) {
+  quiet = enabled;
+}
+function isQuiet() {
+  return quiet;
+}
 function setCiMode(enabled) {
   ciMode = enabled;
 }
@@ -2680,6 +2703,12 @@ var c = {
 function printJson(data) {
   console.log(JSON.stringify(data, null, 2));
 }
+function printJsonLine(data) {
+  console.log(JSON.stringify(data));
+}
+function printLine(text) {
+  console.log(text);
+}
 function printTable(rows, columns) {
   if (rows.length === 0) {
     console.log("No results.");
@@ -2756,11 +2785,11 @@ function printKeyValue(record) {
   }
 }
 function printSuccess(msg) {
-  if (!jsonMode)
+  if (!jsonMode && !quiet)
     console.log(`${c.green(glyph("ok"))} ${msg}`);
 }
 function printInfo(msg) {
-  if (!jsonMode)
+  if (!jsonMode && !quiet)
     console.log(msg);
 }
 function printError(msg) {
@@ -2772,7 +2801,7 @@ function printWarn(msg) {
     console.log(`${c.yellow(glyph("warn"))} ${msg}`);
 }
 function printStep(msg) {
-  if (!jsonMode)
+  if (!jsonMode && !quiet)
     console.log(`${c.cyan(glyph("step"))} ${msg}`);
 }
 function formatDate(ms) {
@@ -2786,6 +2815,7 @@ var ERROR_REMEDIATION = {
   api_key_invalid: "The supplied key is invalid or revoked. Run `mcp login`.",
   revoked_api_key: "This key was revoked. Run `mcp login` to mint a new one.",
   expired_token: "Your session expired. Re-run the command (the CLI will refresh it).",
+  expired_api_key: "This API key expired. Run `mcp api-keys rotate <id>` (or `mcp login`) to mint a fresh one.",
   api_key_name_required: "Pass --name <…> when creating an API key.",
   api_key_id_required: "Pass an apiKeyId. List existing keys with `mcp api-keys list`.",
   api_key_not_found: "No such API key for this user. Run `mcp api-keys list` to see live IDs.",
@@ -2868,6 +2898,11 @@ function describeError(err) {
   return { message: String(err) };
 }
 function handleError(err) {
+  if (err instanceof CliExitError) {
+    if (err.message)
+      printError(err.message);
+    process.exit(err.code);
+  }
   const info = describeError(err);
   if (jsonMode) {
     printJson({ error: info });
@@ -3518,6 +3553,17 @@ function registerAuthCommands(program2) {
   }));
 }
 
+// src/lib/delete-confirm.ts
+function assertConfirmMatches(args) {
+  const provided = args.confirm?.trim();
+  if (!provided) {
+    throw new Error(`Refusing to delete ${args.entityKind} "${args.entityName}". Re-run with --confirm "${args.entityName}" to proceed.`);
+  }
+  if (provided !== args.entityName) {
+    throw new Error(`--confirm "${provided}" does not match the ${args.entityKind} name "${args.entityName}". Deletion aborted.`);
+  }
+}
+
 // src/lib/org.ts
 class NoOrganizationError extends Error {
   constructor() {
@@ -3734,6 +3780,29 @@ function registerProjectCommands(program2) {
       updated: formatDate(s.updatedAt)
     });
   }));
+  projects.command("delete <projectId>").description('Permanently delete a project. Requires --confirm "<exact name>" and that the project is empty of servers/skills.').requiredOption("--confirm <name>", "The exact project name, typed to confirm the destructive action").option("--org <organizationId>", "Organization ID").addHelpText("after", [
+    "",
+    "Examples:",
+    '  $ mcp projects delete proj_123 --confirm "Acme APIs"'
+  ].join(`
+`)).action(runAction(async (projectId, opts) => {
+    const orgId = await resolveOrgId(opts.org);
+    const detail = await api.get("/api/v1/project", {
+      organizationId: orgId,
+      projectId
+    });
+    assertConfirmMatches({
+      entityKind: "project",
+      entityName: detail.project.name,
+      confirm: opts.confirm
+    });
+    const data = await api.delete("/api/v1/project", { organizationId: orgId, projectId });
+    if (isJsonMode()) {
+      printJson(data);
+      return;
+    }
+    printSuccess(`Deleted project ${data.deleted.name} (${data.deleted.id}).`);
+  }));
 }
 
 // src/lib/duration.ts
@@ -3761,6 +3830,12 @@ function parseSince(raw, now = Date.now) {
 }
 
 // src/lib/deployment-events.ts
+function emitEvent(event) {
+  if (isJsonMode())
+    printJsonLine(event);
+  else
+    printLine(formatEventLine(event));
+}
 var TERMINAL_STAGES = new Set([
   "active",
   "failed",
@@ -3841,18 +3916,14 @@ async function tailDeploymentLogs(args) {
       return;
     }
     for (const event of initial.events)
-      console.log(formatEventLine(event));
+      printLine(formatEventLine(event));
     return;
   }
   if (!isJsonMode() && initial.events.length > 0) {
     printStep(`Tailing ${c.bold(args.deploymentId)} (Ctrl-C to stop)…`);
   }
-  for (const event of initial.events) {
-    if (isJsonMode())
-      console.log(JSON.stringify(event));
-    else
-      console.log(formatEventLine(event));
-  }
+  for (const event of initial.events)
+    emitEvent(event);
   const lastTimestamp = initial.events[initial.events.length - 1]?.timestamp ?? initial.nextCursor ?? sinceMs ?? Date.now();
   const controller = new AbortController;
   const onSigint = () => controller.abort();
@@ -3865,12 +3936,7 @@ async function tailDeploymentLogs(args) {
       since: lastTimestamp,
       isDone: () => false,
       totalTimeoutMs,
-      onEvent: (event) => {
-        if (isJsonMode())
-          console.log(JSON.stringify(event));
-        else
-          console.log(formatEventLine(event));
-      },
+      onEvent: emitEvent,
       signal: controller.signal
     });
   } finally {
@@ -4063,7 +4129,7 @@ async function resolveSetValue(args) {
   const decision = decideSetValueSource(args);
   if (decision.kind === "error") {
     printError(decision.message);
-    process.exit(1);
+    throw new CliExitError(1);
   }
   if (decision.kind === "positional")
     return decision.value;
@@ -4071,7 +4137,7 @@ async function resolveSetValue(args) {
     const path = resolve(process.cwd(), decision.path);
     if (!existsSync3(path)) {
       printError(`--from-file path not found: ${path}`);
-      process.exit(1);
+      throw new CliExitError(1);
     }
     return readFileSync3(path, "utf-8");
   }
@@ -4116,7 +4182,7 @@ async function runUnsetEnv(args) {
     const ok = await confirmUnset(args.bindingName, args.serverId);
     if (!ok) {
       printInfo(c.dim("Aborted."));
-      process.exit(1);
+      throw new CliExitError(1);
     }
   }
   const orgId = await resolveOrgId(args.orgOverride);
@@ -4439,7 +4505,7 @@ function registerServerLifecycleCommands(servers) {
     if (isJsonMode()) {
       printJson({ deployment: dep, waitDone, terminalEvent });
       if (opts.wait && !waitDone)
-        process.exit(1);
+        throw new CliExitError(1);
       return;
     }
     printSuccess(`Deployment ${c.bold(dep.deploymentId)} created.`);
@@ -4456,7 +4522,7 @@ function registerServerLifecycleCommands(servers) {
       } : {}
     });
     if (opts.wait && !waitDone)
-      process.exit(1);
+      throw new CliExitError(1);
   }));
   servers.command("push-spec <serverId>").description("Push a local OpenAPI spec to the cloud (regenerates the bundle; optionally deploys)").option("--org <organizationId>", "Organization ID").option("--spec <path>", "Path to the OpenAPI/Swagger spec file", "./openapi.yaml").option("--enrich-on-change", "Preserve per-tool enrichment when the spec changes").option("--deploy", "Immediately deploy the regenerated bundle to Cloudflare Workers").option("--target <target>", `Deploy target (with --deploy): ${DEPLOY_TARGETS.join(" | ")}`, "workersDev").option("--access-mode <mode>", `Access mode (with --deploy): ${ACCESS_MODES.join(" | ")}`, "public").option("--wait", "With --deploy: tail deployment events until terminal state").option("--wait-timeout <seconds>", "Maximum seconds to wait for terminal state (default 300)", "300").addHelpText("after", [
     "",
@@ -4575,7 +4641,7 @@ function registerServerLifecycleCommands(servers) {
         terminalEvent
       });
       if (opts.wait && !waitDone)
-        process.exit(1);
+        throw new CliExitError(1);
       return;
     }
     printSuccess(`Deployment ${c.bold(dep.deploymentId)} created.`);
@@ -4592,7 +4658,7 @@ function registerServerLifecycleCommands(servers) {
       } : {}
     });
     if (opts.wait && !waitDone)
-      process.exit(1);
+      throw new CliExitError(1);
   }));
 }
 
@@ -4759,6 +4825,212 @@ function registerServerMutationCommands(servers) {
       "resumed at": formatDate(d.resumedAt)
     });
   }));
+  servers.command("delete <serverId>").description('Permanently delete a server and all its data. Requires --confirm "<exact name>".').requiredOption("--confirm <name>", "The exact server name, typed to confirm the destructive action").option("--org <organizationId>", "Organization ID").option("--force", "Delete even if a Worker is still live (skips the active-deployment guard)").addHelpText("after", [
+    "",
+    "This cascades: tools, versions, deployments, events, OAuth connections,",
+    "test runs, rollups, and the dispatch KV / dedicated-container instance.",
+    "",
+    "Examples:",
+    '  $ mcp servers delete srv_123 --confirm "Stripe MCP"',
+    '  $ mcp servers delete srv_123 --confirm "Stripe MCP" --force'
+  ].join(`
+`)).action(runAction(async (serverId, opts) => {
+    const orgId = await resolveOrgId(opts.org);
+    const detail = await api.get("/api/v1/server", {
+      organizationId: orgId,
+      serverId
+    });
+    assertConfirmMatches({
+      entityKind: "server",
+      entityName: detail.server.name,
+      confirm: opts.confirm
+    });
+    const data = await api.delete("/api/v1/server", {
+      organizationId: orgId,
+      serverId,
+      ...opts.force ? { force: true } : {}
+    });
+    if (isJsonMode()) {
+      printJson(data);
+      return;
+    }
+    printSuccess(`Deleted server ${c.bold(data.deleted.name)} (${data.deleted.id}).`);
+  }));
+}
+
+// src/lib/spec-pipeline.ts
+import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname4, join as join5, resolve as resolve4 } from "node:path";
+var SOURCE_TYPES = ["openapi", "graphql", "url"];
+function isHttpUrl(value) {
+  return /^https?:\/\//i.test(value.trim());
+}
+function looksLikeGraphql(spec) {
+  return /\b(type\s+Query|type\s+Mutation|schema\s*\{|extend\s+type)\b/.test(spec);
+}
+async function readSpecSource(spec, override, options = {}) {
+  const trimmedSpec = spec.trim();
+  if (override === "url" || !override && isHttpUrl(trimmedSpec)) {
+    if (!isHttpUrl(trimmedSpec)) {
+      throw new Error(`--source-type url requires an http(s) --spec URL, got: ${spec}`);
+    }
+    return { sourceType: "url", sourceUrl: trimmedSpec };
+  }
+  let content;
+  let pathHint = "";
+  if (trimmedSpec === "@-" || trimmedSpec === "-") {
+    const reader = options.readStdin ?? defaultStdinReader;
+    content = await reader();
+  } else {
+    const filePath = resolve4(options.cwd ?? process.cwd(), trimmedSpec);
+    if (!existsSync6(filePath)) {
+      throw new Error(`Spec file not found: ${filePath}`);
+    }
+    content = readFileSync5(filePath, "utf-8");
+    pathHint = filePath;
+  }
+  if (!content.trim()) {
+    throw new Error("The spec is empty — nothing to ingest.");
+  }
+  let sourceType;
+  if (override === "openapi" || override === "graphql") {
+    sourceType = override;
+  } else if (/\.(graphql|gql)$/i.test(pathHint) || looksLikeGraphql(content)) {
+    sourceType = "graphql";
+  } else {
+    sourceType = "openapi";
+  }
+  return { sourceType, rawSpec: content };
+}
+function buildIngestBody(args) {
+  const body = {
+    organizationId: args.organizationId,
+    projectId: args.projectId,
+    sourceType: args.payload.sourceType
+  };
+  if (args.payload.sourceType === "url") {
+    body["sourceUrl"] = args.payload.sourceUrl;
+  } else {
+    body["rawSpec"] = args.payload.rawSpec;
+  }
+  return body;
+}
+function writeBundleToDisk(bundle, outDir, cwd = process.cwd()) {
+  const root = resolve4(cwd, outDir);
+  const written = [];
+  for (const file of bundle.files) {
+    const dest = join5(root, file.path);
+    mkdirSync4(dirname4(dest), { recursive: true });
+    writeFileSync3(dest, file.content, "utf-8");
+    written.push(dest);
+  }
+  return written;
+}
+async function defaultStdinReader() {
+  const chunks = [];
+  return new Promise((res, rej) => {
+    process.stdin.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
+    process.stdin.on("end", () => res(Buffer.concat(chunks).toString("utf-8")));
+    process.stdin.on("error", rej);
+  });
+}
+
+// src/commands/servers-spec.ts
+function validateSourceType(value) {
+  if (value === undefined)
+    return;
+  const v = value.trim().toLowerCase();
+  if (!SOURCE_TYPES.includes(v)) {
+    throw new Error(`Invalid --source-type: ${value}. Expected one of: ${SOURCE_TYPES.join(", ")}.`);
+  }
+  return v;
+}
+function registerServerSpecCommands(servers) {
+  servers.command("ingest").description("Create a server from an OpenAPI/GraphQL spec (file, URL, or @- stdin). Wraps POST /api/v1/server/ingest.").requiredOption("--project <projectId>", "Project to create the server in").requiredOption("--spec <file|url>", "Spec source: a local file, an http(s) URL (fetched server-side), or @- for stdin").option("--org <organizationId>", "Organization ID").option("--source-type <type>", `Override spec classification: ${SOURCE_TYPES.join(" | ")} (auto-detected by default)`).addHelpText("after", [
+    "",
+    "Examples:",
+    "  $ mcp servers ingest --project proj_123 --spec ./openapi.yaml",
+    "  $ mcp servers ingest --project proj_123 --spec https://api.example.com/openapi.json",
+    "  $ cat schema.graphql | mcp servers ingest --project proj_123 --spec @-"
+  ].join(`
+`)).action(runAction(async (opts) => {
+    const orgId = await resolveOrgId(opts.org);
+    const sourceType = validateSourceType(opts.sourceType);
+    const payload = await readSpecSource(opts.spec, sourceType);
+    if (!isJsonMode()) {
+      printStep(`Importing ${c.bold(payload.sourceType)} spec into project ${c.dim(opts.project)}…`);
+    }
+    const data = await api.post("/api/v1/server/ingest", buildIngestBody({
+      organizationId: orgId,
+      projectId: opts.project,
+      payload
+    }));
+    if (isJsonMode()) {
+      printJson(data);
+      return;
+    }
+    printSuccess(`Server ${c.bold(data.server.id)} created from spec.`);
+    printKeyValue({
+      "server id": data.server.id,
+      "server name": data.server.name,
+      "api source": data.apiSource.id ?? "—",
+      project: opts.project
+    });
+    printStep(`Next: \`mcp servers generate ${data.server.id} --out ./out\` or \`mcp servers deploy ${data.server.id} --wait\`.`);
+  }));
+  servers.command("generate <serverId>").description("Generate the server's TypeScript bundle (the exact code `deploy` ships) and optionally write it to disk — a dry-run for the codegen path. Wraps POST /api/v1/server/generate.").option("--org <organizationId>", "Organization ID").option("--project <projectId>", "Project ID (looked up from the server when omitted)").option("--out <dir>", "Write the generated files to this directory instead of just summarizing").addHelpText("after", [
+    "",
+    "Notes:",
+    "  Codegen runs on the builder Worker (arch-evolution P7f). If generate",
+    "  fails with a builder error, the environment’s builder Worker is down.",
+    "",
+    "Examples:",
+    "  $ mcp servers generate srv_123                 # summarize the bundle",
+    "  $ mcp servers generate srv_123 --out ./build   # write files to disk",
+    "  $ mcp --json servers generate srv_123 | jq '.bundle.files[].path'"
+  ].join(`
+`)).action(runAction(async (serverId, opts) => {
+    const orgId = await resolveOrgId(opts.org);
+    let projectId = opts.project;
+    if (!projectId) {
+      const detail = await api.get("/api/v1/server", { organizationId: orgId, serverId });
+      projectId = detail.server.projectId;
+    }
+    if (!isJsonMode()) {
+      printStep(`Generating bundle for ${c.bold(serverId)}…`);
+    }
+    const data = await api.post("/api/v1/server/generate", { organizationId: orgId, projectId, serverId });
+    if (opts.out) {
+      const written = writeBundleToDisk(data.bundle, opts.out);
+      if (isJsonMode()) {
+        printJson({
+          server: data.server,
+          outDir: opts.out,
+          files: written
+        });
+        return;
+      }
+      printSuccess(`Wrote ${written.length} file(s) to ${c.bold(opts.out)}.`);
+      for (const file of data.bundle.files) {
+        printStep(file.path);
+      }
+      return;
+    }
+    if (isJsonMode()) {
+      printJson(data);
+      return;
+    }
+    printSuccess(`Generated ${data.bundle.files.length} file(s) for ${c.bold(data.server.name)} (not written — pass --out <dir>).`);
+    printKeyValue({
+      "entry file": data.bundle.entryFile,
+      "schema version": data.bundle.schemaVersion,
+      version: data.server.version,
+      files: data.bundle.files.length
+    });
+    for (const file of data.bundle.files) {
+      printStep(`${file.path}  ${c.dim(`(${file.content.length} bytes)`)}`);
+    }
+  }));
 }
 
 // src/commands/servers-tests.ts
@@ -4981,6 +5253,7 @@ function registerServerCommands(program2) {
   registerServerExportCommands(servers);
   registerServerLifecycleCommands(servers);
   registerServerMutationCommands(servers);
+  registerServerSpecCommands(servers);
   registerServerTestCommands(servers);
   servers.command("list").description("List servers").option("--org <organizationId>", "Organization ID").option("--project <projectId>", "Filter by project ID").option("--limit <n>", "Maximum results (default 25)", parsePositiveIntOption("limit"), "25").addHelpText("after", [
     "",
@@ -5162,48 +5435,48 @@ function registerServerCommands(program2) {
 }
 
 // src/commands/tools-diff.ts
-import { existsSync as existsSync9, readFileSync as readFileSync8 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync9 } from "node:fs";
 import { relative } from "node:path";
 
 // src/lib/dev/handlers-sync.ts
 import {
-  existsSync as existsSync8,
-  mkdirSync as mkdirSync6,
-  readFileSync as readFileSync7,
+  existsSync as existsSync9,
+  mkdirSync as mkdirSync7,
+  readFileSync as readFileSync8,
   statSync,
-  writeFileSync as writeFileSync5
+  writeFileSync as writeFileSync6
 } from "node:fs";
 import { createHash as createHash3 } from "node:crypto";
-import { dirname as dirname4, join as join7 } from "node:path";
+import { dirname as dirname5, join as join8 } from "node:path";
 
 // src/lib/dev/state.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "node:fs";
-import { join as join5, resolve as resolve4 } from "node:path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join6, resolve as resolve5 } from "node:path";
 function devRoot(cwd) {
-  return join5(cwd, ".mcpcloud");
+  return join6(cwd, ".mcpcloud");
 }
 function stateFile(cwd) {
-  return join5(devRoot(cwd), "state.json");
+  return join6(devRoot(cwd), "state.json");
 }
 function serverDir(cwd) {
-  return join5(devRoot(cwd), "server");
+  return join6(devRoot(cwd), "server");
 }
 function gitCloneDir(cwd, owner, name) {
   const safe = `${owner}__${name}`.replace(/[^a-zA-Z0-9._-]/g, "-");
-  return join5(devRoot(cwd), "git", safe);
+  return join6(devRoot(cwd), "git", safe);
 }
 function envFile(cwd) {
-  return join5(devRoot(cwd), "env.json");
+  return join6(devRoot(cwd), "env.json");
 }
 function backupsDir(cwd) {
-  return join5(devRoot(cwd), "agent-backups");
+  return join6(devRoot(cwd), "agent-backups");
 }
 function readState(cwd) {
   const path = stateFile(cwd);
-  if (!existsSync6(path))
+  if (!existsSync7(path))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync5(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync6(path, "utf-8"));
     if (!parsed || typeof parsed !== "object")
       return null;
     const s = parsed;
@@ -5216,19 +5489,19 @@ function readState(cwd) {
   }
 }
 function writeState(cwd, state) {
-  if (!existsSync6(devRoot(cwd))) {
-    mkdirSync4(devRoot(cwd), { recursive: true });
+  if (!existsSync7(devRoot(cwd))) {
+    mkdirSync5(devRoot(cwd), { recursive: true });
   }
-  writeFileSync3(stateFile(cwd), JSON.stringify(state, null, 2), "utf-8");
+  writeFileSync4(stateFile(cwd), JSON.stringify(state, null, 2), "utf-8");
 }
 function ensureGitignore(cwd) {
-  const ignoreFile = join5(devRoot(cwd), ".gitignore");
-  if (existsSync6(ignoreFile))
+  const ignoreFile = join6(devRoot(cwd), ".gitignore");
+  if (existsSync7(ignoreFile))
     return;
-  if (!existsSync6(devRoot(cwd))) {
-    mkdirSync4(devRoot(cwd), { recursive: true });
+  if (!existsSync7(devRoot(cwd))) {
+    mkdirSync5(devRoot(cwd), { recursive: true });
   }
-  writeFileSync3(ignoreFile, [
+  writeFileSync4(ignoreFile, [
     "# generated by `mcp dev`",
     "server/",
     "git/",
@@ -5242,14 +5515,14 @@ function ensureGitignore(cwd) {
 
 // src/lib/dev/tools-sync.ts
 import {
-  existsSync as existsSync7,
-  mkdirSync as mkdirSync5,
-  readFileSync as readFileSync6,
+  existsSync as existsSync8,
+  mkdirSync as mkdirSync6,
+  readFileSync as readFileSync7,
   readdirSync,
   rmSync,
-  writeFileSync as writeFileSync4
+  writeFileSync as writeFileSync5
 } from "node:fs";
-import { join as join6 } from "node:path";
+import { join as join7 } from "node:path";
 var TOOLS_DIR_NAME = "tools";
 var RISK_CLASSES = [
   "read",
@@ -5258,10 +5531,10 @@ var RISK_CLASSES = [
   "external_effect"
 ];
 function toolsDir(devRootDir) {
-  return join6(devRootDir, TOOLS_DIR_NAME);
+  return join7(devRootDir, TOOLS_DIR_NAME);
 }
 function serverToolsDir(devRootDir, serverId) {
-  return join6(toolsDir(devRootDir), serverId);
+  return join7(toolsDir(devRootDir), serverId);
 }
 function escapeFrontmatterScalar(raw) {
   if (raw === "")
@@ -5451,14 +5724,14 @@ function arraysEqual(a, b) {
 }
 var STATE_FILE = ".tools-state.json";
 function toolsStateFile(devRootDir, serverId) {
-  return join6(serverToolsDir(devRootDir, serverId), STATE_FILE);
+  return join7(serverToolsDir(devRootDir, serverId), STATE_FILE);
 }
 function readToolsState(devRootDir, serverId) {
   const file = toolsStateFile(devRootDir, serverId);
-  if (!existsSync7(file))
+  if (!existsSync8(file))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync6(file, "utf-8"));
+    const parsed = JSON.parse(readFileSync7(file, "utf-8"));
     if (!parsed || typeof parsed !== "object")
       return null;
     const s = parsed;
@@ -5472,9 +5745,9 @@ function readToolsState(devRootDir, serverId) {
 }
 function writeToolsState(devRootDir, state) {
   const dir = serverToolsDir(devRootDir, state.serverId);
-  if (!existsSync7(dir))
-    mkdirSync5(dir, { recursive: true });
-  writeFileSync4(toolsStateFile(devRootDir, state.serverId), JSON.stringify(state, null, 2), "utf-8");
+  if (!existsSync8(dir))
+    mkdirSync6(dir, { recursive: true });
+  writeFileSync5(toolsStateFile(devRootDir, state.serverId), JSON.stringify(state, null, 2), "utf-8");
 }
 function hashLocalView(view) {
   return JSON.stringify({
@@ -5486,14 +5759,14 @@ function hashLocalView(view) {
 }
 function materializeTools(args) {
   const dir = serverToolsDir(args.devRootDir, args.serverId);
-  if (!existsSync7(dir))
-    mkdirSync5(dir, { recursive: true });
+  if (!existsSync8(dir))
+    mkdirSync6(dir, { recursive: true });
   const kept = new Set;
   let filesWritten = 0;
   for (const tool of args.tools) {
     const filename = `${tool.name}.md`;
     kept.add(filename);
-    writeFileSync4(join6(dir, filename), renderToolMarkdown(tool), "utf-8");
+    writeFileSync5(join7(dir, filename), renderToolMarkdown(tool), "utf-8");
     filesWritten += 1;
   }
   let filesRemoved = 0;
@@ -5505,7 +5778,7 @@ function materializeTools(args) {
     if (kept.has(entry))
       continue;
     try {
-      rmSync(join6(dir, entry), { force: true });
+      rmSync(join7(dir, entry), { force: true });
       filesRemoved += 1;
     } catch {}
   }
@@ -5531,14 +5804,14 @@ function materializeTools(args) {
   return { filesWritten, filesRemoved };
 }
 function readLocalTool(devRootDir, serverId, toolName) {
-  const filePath = join6(serverToolsDir(devRootDir, serverId), `${toolName}.md`);
-  if (!existsSync7(filePath))
+  const filePath = join7(serverToolsDir(devRootDir, serverId), `${toolName}.md`);
+  if (!existsSync8(filePath))
     return null;
   const state = readToolsState(devRootDir, serverId);
   const stateEntry = state?.tools[toolName];
   if (!stateEntry)
     return null;
-  const view = parseToolMarkdown(readFileSync6(filePath, "utf-8"));
+  const view = parseToolMarkdown(readFileSync7(filePath, "utf-8"));
   return {
     view,
     cloudId: stateEntry.id,
@@ -5568,8 +5841,8 @@ async function pushLocalToolEdit(args) {
     };
   }
   if (!local) {
-    const filePath = join6(serverToolsDir(args.devRootDir, args.serverId), `${args.toolName}.md`);
-    if (!existsSync7(filePath))
+    const filePath = join7(serverToolsDir(args.devRootDir, args.serverId), `${args.toolName}.md`);
+    if (!existsSync8(filePath))
       return { kind: "missing-file" };
     return { kind: "unknown-tool" };
   }
@@ -5652,7 +5925,7 @@ function toKebabSlug(value) {
   return value.replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/[^a-zA-Z0-9]+/g, "-").replace(/^-+|-+$/g, "").toLowerCase() || "generated-mcp-server";
 }
 function serverBundleHandlersDir(devRootDir) {
-  return join7(devRootDir, "server", "src", "tools");
+  return join8(devRootDir, "server", "src", "tools");
 }
 function handlerSlugFromWatcherPath(rel) {
   if (!rel)
@@ -5681,15 +5954,15 @@ function hashSource(source) {
 }
 var lastPushedHash = new Map;
 async function pushLocalHandlerEdit(args) {
-  const filePath = join7(serverBundleHandlersDir(args.devRootDir), `${args.slug}.ts`);
-  if (!existsSync8(filePath)) {
+  const filePath = join8(serverBundleHandlersDir(args.devRootDir), `${args.slug}.ts`);
+  if (!existsSync9(filePath)) {
     return { kind: "missing-file" };
   }
   const resolved = resolveToolFromSlug(args.devRootDir, args.serverId, args.slug);
   if (!resolved) {
     return { kind: "unknown-tool", slug: args.slug };
   }
-  const source = readFileSync7(filePath, "utf-8");
+  const source = readFileSync8(filePath, "utf-8");
   const hash = hashSource(source);
   if (lastPushedHash.get(filePath) === hash) {
     return { kind: "noop" };
@@ -5833,9 +6106,9 @@ async function resetCloudHandler(args) {
   }
 }
 function writeLocalHandlerFromCloud(args) {
-  const filePath = join7(serverBundleHandlersDir(args.devRootDir), `${args.slug}.ts`);
-  mkdirSync6(dirname4(filePath), { recursive: true });
-  writeFileSync5(filePath, args.content, "utf-8");
+  const filePath = join8(serverBundleHandlersDir(args.devRootDir), `${args.slug}.ts`);
+  mkdirSync7(dirname5(filePath), { recursive: true });
+  writeFileSync6(filePath, args.content, "utf-8");
   lastPushedHash.set(filePath, hashSource(args.content));
   return filePath;
 }
@@ -5844,11 +6117,11 @@ function handlerSlugFromToolName(toolName) {
 }
 var RECENT_EDIT_WINDOW_MS = 5 * 60 * 1000;
 function inspectLocalHandler(args) {
-  const filePath = join7(serverBundleHandlersDir(args.devRootDir), `${args.slug}.ts`);
-  if (!existsSync8(filePath))
+  const filePath = join8(serverBundleHandlersDir(args.devRootDir), `${args.slug}.ts`);
+  if (!existsSync9(filePath))
     return { kind: "no-local-file" };
   const cached2 = lastPushedHash.get(filePath);
-  const onDisk = hashSource(readFileSync7(filePath, "utf-8"));
+  const onDisk = hashSource(readFileSync8(filePath, "utf-8"));
   if (cached2 !== undefined) {
     return cached2 === onDisk ? { kind: "matches-cache" } : { kind: "differs-from-cache" };
   }
@@ -5886,7 +6159,7 @@ async function resolveToolsContext(opts = {}) {
     if (opts.requireServer === false)
       return null;
     printError("No server selected. Pass --server <serverId> or run from a directory with .mcpcloud/state.json.");
-    process.exit(1);
+    throw new CliExitError(1);
   }
   const organizationId = opts.orgOverride ?? cached2?.organizationId ?? await resolveOrgId(undefined);
   let projectId = cached2?.projectId;
@@ -5916,7 +6189,7 @@ function registerToolsDiffCommand(tools) {
 `)).action(runAction(async (name, opts) => {
     if (opts.metadataOnly && opts.handlerOnly) {
       printError("Pass at most one of --metadata-only or --handler-only.");
-      process.exit(1);
+      throw new CliExitError(1);
     }
     await runToolsDiff({
       toolName: name,
@@ -5944,7 +6217,7 @@ async function runToolsDiff(args) {
       const sample = tools.slice(0, 5).map((t) => t.name).join(", ");
       printInfo(`  ${c.dim("Available:")} ${sample}${tools.length > 5 ? c.dim(`, +${tools.length - 5} more`) : ""}`);
     }
-    process.exit(1);
+    throw new CliExitError(1);
   }
   const metadata = args.includeMetadata ? buildMetadataDiff({ devRootDir: dev, cwd, serverId: ctx.serverId, cloud }) : null;
   const handler = args.includeHandler ? await buildHandlerDiff({
@@ -5978,7 +6251,7 @@ async function runToolsDiff(args) {
 }
 function buildMetadataDiff(args) {
   const filePath = `${serverToolsDir(args.devRootDir, args.serverId)}/${args.cloud.name}.md`;
-  if (!existsSync9(filePath)) {
+  if (!existsSync10(filePath)) {
     return {
       hasLocal: false,
       localPath: null,
@@ -5992,7 +6265,7 @@ function buildMetadataDiff(args) {
   let local = null;
   let parseError = null;
   try {
-    local = parseToolMarkdown(readFileSync8(filePath, "utf-8"));
+    local = parseToolMarkdown(readFileSync9(filePath, "utf-8"));
   } catch (err) {
     parseError = err instanceof Error ? err.message : String(err);
   }
@@ -6034,8 +6307,8 @@ async function buildHandlerDiff(args) {
   }
   const slug = handlerSlugFromToolName(args.toolName);
   const filePath = `${serverBundleHandlersDir(args.devRootDir)}/${slug}.ts`;
-  const hasLocal = existsSync9(filePath);
-  const localContent = hasLocal ? readFileSync8(filePath, "utf-8") : null;
+  const hasLocal = existsSync10(filePath);
+  const localContent = hasLocal ? readFileSync9(filePath, "utf-8") : null;
   const localPath = hasLocal ? relative(args.cwd, filePath) || filePath : null;
   const changed = hasLocal ? localContent !== cloudResult.snapshot.content : true;
   return {
@@ -6145,18 +6418,18 @@ function renderBool(value) {
 }
 
 // src/commands/tools-edit.ts
-import { existsSync as existsSync11 } from "node:fs";
-import { join as join9, relative as relative2 } from "node:path";
+import { existsSync as existsSync12 } from "node:fs";
+import { join as join10, relative as relative2 } from "node:path";
 
 // src/lib/editor-shell.ts
 import { spawn as spawn2 } from "node:child_process";
-import { existsSync as existsSync10, readFileSync as readFileSync9 } from "node:fs";
+import { existsSync as existsSync11, readFileSync as readFileSync10 } from "node:fs";
 import { platform as platform2 } from "node:os";
-import { delimiter, join as join8 } from "node:path";
+import { delimiter, join as join9 } from "node:path";
 var DEFAULT_FALLBACKS = ["vi"];
 function isExecutableFile(path) {
   try {
-    return existsSync10(path);
+    return existsSync11(path);
   } catch {
     return false;
   }
@@ -6173,7 +6446,7 @@ function findOnPath(command) {
     if (!dir)
       continue;
     for (const ext of exts) {
-      const candidate = join8(dir, command + ext);
+      const candidate = join9(dir, command + ext);
       if (isExecutableFile(candidate))
         return candidate;
     }
@@ -6194,14 +6467,14 @@ function resolveEditorCommand(args) {
   return { command: DEFAULT_FALLBACKS[0], source: "fallback" };
 }
 function defaultRun(cmd, args) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     const child = spawn2(cmd, args, { stdio: "inherit" });
     child.on("error", (err) => reject(err));
-    child.on("exit", (code) => resolve5(code ?? 0));
+    child.on("exit", (code) => resolve6(code ?? 0));
   });
 }
 async function runEditor(args) {
-  if (!existsSync10(args.filePath)) {
+  if (!existsSync11(args.filePath)) {
     return {
       ok: false,
       reason: "file-missing",
@@ -6209,8 +6482,8 @@ async function runEditor(args) {
     };
   }
   const { command } = resolveEditorCommand({ command: args.command });
-  const resolve5 = args.resolveCommand ?? findOnPath;
-  const resolved = resolve5(command);
+  const resolve6 = args.resolveCommand ?? findOnPath;
+  const resolved = resolve6(command);
   if (!resolved) {
     return {
       ok: false,
@@ -6236,7 +6509,7 @@ async function runEditor(args) {
       message: `${command} exited with code ${exitCode}. The file may be unsaved; re-run after fixing.`
     };
   }
-  const contents = readFileSync9(args.filePath, "utf-8");
+  const contents = readFileSync10(args.filePath, "utf-8");
   return { ok: true, contents, command };
 }
 
@@ -6260,7 +6533,7 @@ function registerToolsEditCommand(tools) {
 async function runToolsEdit(args) {
   if (isJsonMode()) {
     printError("`mcp tools edit` is interactive and cannot be used with --json.");
-    process.exit(1);
+    throw new CliExitError(1);
   }
   const ctx = await resolveToolsContext({
     orgOverride: args.orgOverride,
@@ -6269,11 +6542,11 @@ async function runToolsEdit(args) {
   if (!ctx)
     return;
   const cwd = process.cwd();
-  const filePath = join9(serverToolsDir(devRoot(cwd), ctx.serverId), `${args.toolName}.md`);
-  if (!existsSync11(filePath)) {
+  const filePath = join10(serverToolsDir(devRoot(cwd), ctx.serverId), `${args.toolName}.md`);
+  if (!existsSync12(filePath)) {
     printError(`Tool file not found: ${relative2(cwd, filePath)}`);
     printInfo(`  ${c.dim("Run")} ${c.bold(`mcp tools pull ${args.toolName}`)} ${c.dim("first to materialize it, or check the name is spelled correctly.")}`);
-    process.exit(1);
+    throw new CliExitError(1);
   }
   printStep(`Opening ${c.bold(relative2(cwd, filePath))} in editor…`);
   const editorResult = await runEditor({
@@ -6282,7 +6555,7 @@ async function runToolsEdit(args) {
   });
   if (!editorResult.ok) {
     printError(editorResult.message);
-    process.exit(1);
+    throw new CliExitError(1);
   }
   printStep(`Pushing edit: ${c.bold(args.toolName)}…`);
   const push = await pushLocalToolEdit({
@@ -6298,7 +6571,7 @@ async function runToolsEdit(args) {
       return;
     case "missing-file":
       printError(`${args.toolName}.md disappeared after the editor exited.`);
-      process.exit(1);
+      throw new CliExitError(1);
       return;
     case "unknown-tool":
       printWarn(`${args.toolName}.md is not tracked in .tools-state.json — restart \`mcp dev\` or \`mcp tools pull\` to re-materialize.`);
@@ -6306,7 +6579,7 @@ async function runToolsEdit(args) {
     case "parse-error":
       printError(`Couldn't parse ${args.toolName}.md: ${push.message}`);
       printInfo(`  ${c.dim("Re-open and fix the file, or run")} ${c.bold(`mcp tools pull ${args.toolName}`)} ${c.dim("to reset.")}`);
-      process.exit(1);
+      throw new CliExitError(1);
       return;
     case "patched":
       if (isJsonMode()) {
@@ -6319,11 +6592,11 @@ async function runToolsEdit(args) {
     case "conflict":
       printError(`Conflict on ${c.bold(args.toolName)}: the cloud was updated by someone else since you read it.`);
       printInfo(`  ${c.dim("Run:")} ${c.bold(`mcp tools pull ${args.toolName}`)} ${c.dim("to refresh, then re-apply your changes via")} ${c.bold(`mcp tools edit ${args.toolName}`)}${c.dim(".")}`);
-      process.exit(1);
+      throw new CliExitError(1);
       return;
     case "api-error":
       printError(`Failed to save ${args.toolName} (HTTP ${push.status}): ${push.message}`);
-      process.exit(1);
+      throw new CliExitError(1);
       return;
     default: {
       const _exhaustive = push;
@@ -6426,7 +6699,7 @@ async function runToolsEnrich(args) {
       const sample = list.slice(0, 5).map((t) => t.name).join(", ");
       printInfo(`  ${c.dim("Available:")} ${sample}${list.length > 5 ? c.dim(`, +${list.length - 5} more`) : ""}`);
     }
-    process.exit(1);
+    throw new CliExitError(1);
   }
   if (!isJsonMode()) {
     printStep(`Running AI enrichment for ${c.bold(args.toolName)}${args.modelId ? c.dim(` (model ${args.modelId})`) : ""}…`);
@@ -6446,7 +6719,7 @@ async function runToolsEnrich(args) {
     } else {
       printError(`Enrichment failed: ${err instanceof Error ? err.message : String(err)}`);
     }
-    process.exit(1);
+    throw new CliExitError(1);
   }
   const detailed = await fetchEnrichedToolByName({
     organizationId: ctx.organizationId,
@@ -6456,11 +6729,11 @@ async function runToolsEnrich(args) {
   });
   if (!detailed) {
     printError("Enrichment ran, but the tool record could not be re-fetched. Try `mcp tools show` manually.");
-    process.exit(1);
+    throw new CliExitError(1);
   }
   if (!detailed.enrichment) {
     printError("Enrichment ran without producing a suggestion. The AI may have failed silently — check `mcp tools show` or the dashboard.");
-    process.exit(1);
+    throw new CliExitError(1);
   }
   if (isJsonMode()) {
     const json = {
@@ -6499,7 +6772,7 @@ async function runToolsEnrich(args) {
   const applyResult = await applySuggestion(detailed, ctx);
   if (!applyResult.ok) {
     printError(applyResult.message);
-    process.exit(1);
+    throw new CliExitError(1);
   }
   printSuccess(`Applied ${c.bold(args.toolName)} ${c.dim(`(${applyResult.changedFields.length} field${applyResult.changedFields.length === 1 ? "" : "s"} patched)`)}`);
   printInfo(`  ${c.dim("Run")} ${c.bold(`mcp tools pull ${args.toolName}`)} ${c.dim("to refresh your local copy.")}`);
@@ -6702,7 +6975,7 @@ async function runToolsPull(args) {
       const sample = forServer.slice(0, 5).map((t) => t.name).join(", ");
       printInfo(`  ${c.dim("Available:")} ${sample}${forServer.length > 5 ? c.dim(`, +${forServer.length - 5} more`) : ""}`);
     }
-    process.exit(1);
+    throw new CliExitError(1);
   }
   if (forServer.length === 0) {
     if (isJsonMode()) {
@@ -6777,13 +7050,13 @@ async function runPullHandler(args) {
     if (state.kind === "differs-from-cache") {
       printError(`${c.bold(slug2)}.ts has unsaved local edits (content differs from the last push). Pull would overwrite them.`);
       printInfo(`  ${c.dim("Save the file (the watcher pushes to cloud), or re-run with")} ${c.bold("--force")} ${c.dim("to discard local edits.")}`);
-      process.exit(1);
+      throw new CliExitError(1);
     }
     if (state.kind === "no-cache-entry" && state.recentlyModified) {
       const ageSec = Math.floor(state.ageMs / 1000);
       printError(`${c.bold(slug2)}.ts was modified ${ageSec}s ago and this CLI session has no record of pushing it (likely a fresh dev start). Pull would overwrite recent edits.`);
       printInfo(`  ${c.dim("Save in the watcher session you edited from, or re-run with")} ${c.bold("--force")} ${c.dim("to discard local edits.")}`);
-      process.exit(1);
+      throw new CliExitError(1);
     }
   }
   if (!isJsonMode())
@@ -6797,15 +7070,15 @@ async function runPullHandler(args) {
   });
   if (result.kind === "unknown-tool") {
     printError(`Tool ${c.bold(args.toolName)} not found in local .tools-state.json. ` + `Run \`mcp dev\` first to hydrate the bundle, or check the spelling (use the tool name, not the file slug).`);
-    process.exit(1);
+    throw new CliExitError(1);
   }
   if (result.kind === "handler-row-not-hydrated") {
     printError(`No generated bundle exists for this server yet — codegen has never been run. ` + `Run \`mcp servers generate\` (or use the dashboard) to produce a bundle, then retry.`);
-    process.exit(1);
+    throw new CliExitError(1);
   }
   if (result.kind === "api-error") {
     printError(`Failed to fetch handler (${result.status}${result.code ? ` ${result.code}` : ""}): ${result.message}`);
-    process.exit(1);
+    throw new CliExitError(1);
   }
   const slug = handlerSlugFromToolName(result.snapshot.toolName);
   const written = writeLocalHandlerFromCloud({
@@ -6889,13 +7162,13 @@ async function runResetHandler(args) {
     if (state.kind === "differs-from-cache") {
       printError(`${c.bold(slug2)}.ts has unsaved local edits. Reset would overwrite them.`);
       printInfo(`  ${c.dim("Save first (the watcher pushes to cloud), or re-run with")} ${c.bold("--force")} ${c.dim("to discard local edits.")}`);
-      process.exit(1);
+      throw new CliExitError(1);
     }
     if (state.kind === "no-cache-entry" && state.recentlyModified) {
       const ageSec = Math.floor(state.ageMs / 1000);
       printError(`${c.bold(slug2)}.ts was modified ${ageSec}s ago and this CLI session has no record of pushing it. Reset would overwrite recent edits.`);
       printInfo(`  ${c.dim("Save in the watcher session you edited from, or re-run with")} ${c.bold("--force")} ${c.dim("to discard local edits.")}`);
-      process.exit(1);
+      throw new CliExitError(1);
     }
   }
   if (!args.assumeYes && !isJsonMode()) {
@@ -6916,20 +7189,20 @@ async function runResetHandler(args) {
   });
   if (result.kind === "unknown-tool") {
     printError(`Tool ${c.bold(args.toolName)} not found in local .tools-state.json. ` + `Run \`mcp dev\` first to hydrate, or check the spelling (use the tool name, not the file slug).`);
-    process.exit(1);
+    throw new CliExitError(1);
   }
   if (result.kind === "handler-row-not-hydrated") {
     printError(`No generated bundle exists for this server yet — codegen has never been run. ` + `Run \`mcp servers generate\` (or use the dashboard) to produce a bundle, then retry.`);
-    process.exit(1);
+    throw new CliExitError(1);
   }
   if (result.kind === "conflict") {
     printError(`Conflict resetting ${c.bold(result.toolName)} (cloud now at version ${result.currentVersion ?? "?"}).`);
     printInfo(`  ${c.dim("Re-run `mcp tools pull-handler " + result.toolName + "` then retry.")}`);
-    process.exit(1);
+    throw new CliExitError(1);
   }
   if (result.kind === "api-error") {
     printError(`Failed to reset handler (${result.status}${result.code ? ` ${result.code}` : ""}): ${result.message}`);
-    process.exit(1);
+    throw new CliExitError(1);
   }
   const slug = handlerSlugFromToolName(result.snapshot.toolName);
   const written = writeLocalHandlerFromCloud({
@@ -6986,7 +7259,7 @@ async function runToolsShow(args) {
       const sample = tools.slice(0, 5).map((t) => t.name).join(", ");
       printInfo(`  ${c.dim("Available:")} ${sample}${tools.length > 5 ? c.dim(`, +${tools.length - 5} more`) : ""}`);
     }
-    process.exit(1);
+    throw new CliExitError(1);
   }
   const [detailed, handlerResult] = await Promise.all([
     fetchEnrichedToolDetail({
@@ -7399,6 +7672,29 @@ function registerSkillMutationCommands(skills) {
       "archived at": s.archivedAt ? formatDate(s.archivedAt) : "—"
     });
   }));
+  skills.command("delete <skillId>").description('Permanently delete a draft skill. Requires --confirm "<exact name>". Published skills with versions/installs are rejected (archive instead).').requiredOption("--confirm <name>", "The exact skill name, typed to confirm the destructive action").option("--org <organizationId>", "Organization ID").addHelpText("after", [
+    "",
+    "Examples:",
+    '  $ mcp skills delete skill_123 --confirm "Weather Reporter"'
+  ].join(`
+`)).action(runAction(async (skillId, opts) => {
+    const orgId = await resolveOrgId(opts.org);
+    const detail = await api.get("/api/v1/skill", {
+      organizationId: orgId,
+      skillId
+    });
+    assertConfirmMatches({
+      entityKind: "skill",
+      entityName: detail.skill.name,
+      confirm: opts.confirm
+    });
+    const data = await api.delete("/api/v1/skill", { organizationId: orgId, skillId });
+    if (isJsonMode()) {
+      printJson(data);
+      return;
+    }
+    printSuccess(`Deleted skill ${data.deleted.name} (${data.deleted.id}).`);
+  }));
   skills.command("install <skillId>").description("Install a skill into the caller's project").option("--org <organizationId>", "Organization ID").option("--project <projectId>", "Project ID (defaults to the skill's project)").option("--pin <semver>", "Pin a specific skill version (sent as `version` on the wire)").option("--config <json>", "Per-installation runtime config (passed verbatim to the skill)").action(runAction(async (skillId, opts) => {
     const orgId = await resolveOrgId(opts.org);
     const { projectId } = await resolveSkillProject(orgId, skillId, opts.project);
@@ -7609,42 +7905,471 @@ function registerSkillTestCommands(skills) {
   }));
 }
 
-// src/commands/skills.ts
-async function runClaudeMcpAdd(connectionName, mcpUrl) {
-  return new Promise((resolve5) => {
-    const child = spawn3("claude", ["mcp", "add", "--transport", "http", connectionName, mcpUrl], {
-      stdio: "inherit",
-      shell: false
-    });
-    child.on("error", () => resolve5(127));
-    child.on("exit", (code) => resolve5(code ?? 1));
+// src/lib/mcp-invoke.ts
+import { existsSync as existsSync13, readFileSync as readFileSync11 } from "node:fs";
+import { resolve as resolve6 } from "node:path";
+var DEFAULT_TIMEOUT_MS3 = 60000;
+var invokeRequestId = 1;
+async function invokeMcpTool(args) {
+  const startedAt = Date.now();
+  const controller = new AbortController;
+  const timer = setTimeout(() => controller.abort(), args.timeoutMs ?? DEFAULT_TIMEOUT_MS3);
+  const headers = {
+    "content-type": "application/json",
+    accept: "application/json, text/event-stream",
+    ...args.headers
+  };
+  const body = JSON.stringify({
+    jsonrpc: "2.0",
+    id: `mcp-cli-invoke-${invokeRequestId++}`,
+    method: "tools/call",
+    params: { name: args.toolName, arguments: args.toolArguments }
   });
-}
-function registerSkillCommands(program2) {
-  const skills = program2.command("skills").description("Manage skills");
-  registerSkillMutationCommands(skills);
-  registerSkillTestCommands(skills);
-  skills.command("list").description("List skills in an organization").option("--org <organizationId>", "Organization ID").option("--project <projectId>", "Filter by project ID").option("--limit <n>", "Maximum results (default 25)", parsePositiveIntOption("limit"), "25").addHelpText("after", [
-    "",
-    "Examples:",
-    "  $ mcp skills list",
-    "  $ mcp skills list --filter status=published",
-    "  $ mcp skills list --field id,name --format jsonl"
-  ].join(`
-`)).action(runAction(async (opts) => {
-    const orgId = await resolveOrgId(opts.org);
-    const params = {
-      organizationId: orgId,
-      limit: opts.limit
-    };
-    if (opts.project)
-      params["projectId"] = opts.project;
-    const data = await api.get("/api/v1/skills", params);
-    printList(data.skills.map((s) => ({
-      id: s.id,
-      name: s.name,
-      project: s.projectName,
-      status: s.status,
+  try {
+    const res = await fetch(args.url, {
+      method: "POST",
+      headers,
+      body,
+      signal: controller.signal
+    });
+    const rawText = await res.text();
+    const contentType = (res.headers.get("content-type") || "").toLowerCase();
+    const jsonText = contentType.includes("text/event-stream") ? unwrapEventStream(rawText) : rawText;
+    const parsed = parseJsonRpc(jsonText);
+    const durationMs = Date.now() - startedAt;
+    if (!parsed.ok) {
+      if (!res.ok) {
+        return {
+          ok: false,
+          reason: "http-error",
+          status: res.status,
+          message: parsed.error?.message ?? (rawText.slice(0, 200) || res.statusText),
+          durationMs
+        };
+      }
+      return {
+        ok: false,
+        reason: "rpc-error",
+        error: parsed.error ?? {
+          code: -32603,
+          message: "Malformed JSON-RPC response.",
+          data: rawText
+        },
+        durationMs
+      };
+    }
+    return {
+      ok: true,
+      result: parsed.result,
+      durationMs
+    };
+  } catch (err) {
+    const durationMs = Date.now() - startedAt;
+    const aborted = err instanceof Error && (err.name === "AbortError" || /abort/i.test(err.message));
+    return {
+      ok: false,
+      reason: "http-error",
+      status: 0,
+      message: aborted ? `Request timed out after ${args.timeoutMs ?? DEFAULT_TIMEOUT_MS3}ms.` : err instanceof Error ? err.message : String(err),
+      durationMs
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function listMcpTools(args) {
+  const startedAt = Date.now();
+  const controller = new AbortController;
+  const timer = setTimeout(() => controller.abort(), args.timeoutMs ?? DEFAULT_TIMEOUT_MS3);
+  const headers = {
+    "content-type": "application/json",
+    accept: "application/json, text/event-stream",
+    ...args.headers
+  };
+  const body = JSON.stringify({
+    jsonrpc: "2.0",
+    id: `mcp-cli-list-${invokeRequestId++}`,
+    method: "tools/list",
+    params: {}
+  });
+  try {
+    const res = await fetch(args.url, {
+      method: "POST",
+      headers,
+      body,
+      signal: controller.signal
+    });
+    const rawText = await res.text();
+    const contentType = (res.headers.get("content-type") || "").toLowerCase();
+    const jsonText = contentType.includes("text/event-stream") ? unwrapEventStream(rawText) : rawText;
+    const parsed = parseJsonRpc(jsonText);
+    const durationMs = Date.now() - startedAt;
+    if (!parsed.ok) {
+      if (!res.ok) {
+        return {
+          ok: false,
+          reason: "http-error",
+          status: res.status,
+          message: parsed.error?.message ?? (rawText.slice(0, 200) || res.statusText),
+          durationMs
+        };
+      }
+      return {
+        ok: false,
+        reason: "rpc-error",
+        error: parsed.error ?? {
+          code: -32603,
+          message: "Malformed JSON-RPC response.",
+          data: rawText
+        },
+        durationMs
+      };
+    }
+    const rawTools = parsed.result.tools;
+    const tools = Array.isArray(rawTools) ? rawTools.flatMap((entry) => {
+      if (!entry || typeof entry !== "object")
+        return [];
+      const name = entry.name;
+      if (typeof name !== "string" || !name)
+        return [];
+      const description = entry.description;
+      return [
+        {
+          name,
+          ...typeof description === "string" ? { description } : {}
+        }
+      ];
+    }) : [];
+    return { ok: true, tools, durationMs };
+  } catch (err) {
+    const durationMs = Date.now() - startedAt;
+    const aborted = err instanceof Error && (err.name === "AbortError" || /abort/i.test(err.message));
+    return {
+      ok: false,
+      reason: "http-error",
+      status: 0,
+      message: aborted ? `Request timed out after ${args.timeoutMs ?? DEFAULT_TIMEOUT_MS3}ms.` : err instanceof Error ? err.message : String(err),
+      durationMs
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function parseJsonRpc(text) {
+  if (!text.trim()) {
+    return {
+      ok: false,
+      result: {},
+      error: { code: -32700, message: "Response body was empty." }
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (err) {
+    return {
+      ok: false,
+      result: {},
+      error: {
+        code: -32700,
+        message: `Response was not JSON: ${err instanceof Error ? err.message : String(err)}`
+      }
+    };
+  }
+  if (!parsed || typeof parsed !== "object") {
+    return {
+      ok: false,
+      result: {},
+      error: { code: -32603, message: "Malformed JSON-RPC response.", data: parsed }
+    };
+  }
+  const obj = parsed;
+  if ("result" in obj && obj.result && typeof obj.result === "object") {
+    return { ok: true, result: obj.result };
+  }
+  if ("error" in obj && obj.error && typeof obj.error === "object") {
+    const errObj = obj.error;
+    return {
+      ok: false,
+      result: {},
+      error: {
+        code: typeof errObj.code === "number" ? errObj.code : -32603,
+        message: typeof errObj.message === "string" ? errObj.message : "RPC error.",
+        data: errObj.data
+      }
+    };
+  }
+  return {
+    ok: false,
+    result: {},
+    error: { code: -32603, message: "Response had no result or error field." }
+  };
+}
+function unwrapEventStream(text) {
+  const parts = [];
+  for (const line of text.split(/\r?\n/)) {
+    if (line.startsWith("data:"))
+      parts.push(line.slice(5).replace(/^ /, ""));
+  }
+  return parts.join("");
+}
+async function parseToolArguments(opts) {
+  const raw = opts.raw?.trim();
+  if (!raw)
+    return { ok: true, value: {} };
+  let source;
+  if (raw === "@-" || raw === "-") {
+    const reader = opts.readStdin ?? defaultStdinReader2;
+    source = await reader();
+  } else if (raw.startsWith("@")) {
+    const filePath = resolve6(opts.cwd ?? process.cwd(), raw.slice(1));
+    if (!existsSync13(filePath)) {
+      return { ok: false, reason: "file-not-found", path: filePath };
+    }
+    source = readFileSync11(filePath, "utf-8");
+  } else {
+    source = raw;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(source);
+  } catch (err) {
+    return {
+      ok: false,
+      reason: "parse-error",
+      message: err instanceof Error ? err.message : String(err)
+    };
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return { ok: false, reason: "not-an-object" };
+  }
+  return { ok: true, value: parsed };
+}
+async function defaultStdinReader2() {
+  const chunks = [];
+  return new Promise((res, rej) => {
+    process.stdin.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
+    process.stdin.on("end", () => res(Buffer.concat(chunks).toString("utf-8")));
+    process.stdin.on("error", rej);
+  });
+}
+function formatToolCallResult(result) {
+  const lines = [];
+  const blocks = result.content ?? [];
+  for (const block of blocks) {
+    if (block.type === "text" && typeof block.text === "string") {
+      lines.push(block.text);
+      continue;
+    }
+    if (block.type === "image") {
+      const sized = typeof block.data === "string" ? `${block.data.length} bytes` : "?";
+      lines.push(`[image ${block.mimeType ?? "application/octet-stream"} · ${sized} base64]`);
+      continue;
+    }
+    if (block.type === "audio") {
+      const sized = typeof block.data === "string" ? `${block.data.length} bytes` : "?";
+      lines.push(`[audio ${block.mimeType ?? "application/octet-stream"} · ${sized} base64]`);
+      continue;
+    }
+    if (block.type === "resource") {
+      const r = block.resource ?? {};
+      const inlineText = typeof r.text === "string" ? `
+${r.text}` : "";
+      lines.push(`[resource ${r.uri ?? "<no uri>"}${r.mimeType ? " · " + r.mimeType : ""}]${inlineText}`);
+      continue;
+    }
+    lines.push(`[${block.type} block: ${truncateJsonPreview(block)}]`);
+  }
+  if (lines.length === 0 && result.structuredContent !== undefined) {
+    lines.push(`[structured]`);
+    lines.push(JSON.stringify(result.structuredContent, null, 2));
+  }
+  if (lines.length === 0) {
+    lines.push("(no content)");
+  }
+  return { lines, isToolError: result.isError === true };
+}
+function truncateJsonPreview(value) {
+  const json = (() => {
+    try {
+      return JSON.stringify(value);
+    } catch {
+      return "<unserializable>";
+    }
+  })();
+  return json.length > 100 ? json.slice(0, 97) + "…" : json;
+}
+
+// src/commands/skills-invoke.ts
+function parseTimeoutMs(value, fallbackMs) {
+  if (!value)
+    return fallbackMs;
+  const n = Number(value);
+  if (!Number.isFinite(n) || n <= 0 || n > 600) {
+    throw new Error(`Invalid --timeout: ${value} (expected seconds, 1–600)`);
+  }
+  return Math.round(n * 1000);
+}
+function registerSkillInvokeCommand(skills) {
+  skills.command("invoke <skillId>").description("Run a deployed skill from the terminal. Resolves the skill’s MCP endpoint, auto-discovers its single tool, and calls it.").option("--org <organizationId>", "Organization ID (overrides default)").option("--input <json>", "Skill input as inline JSON, `@path/to/input.json`, or `@-` for stdin. Defaults to `{}`.").option("--tool <name>", "Override the auto-discovered tool name (a deployed skill normally exposes exactly one)").option("--timeout <seconds>", "Request timeout in seconds (default 60, max 600)").option("--raw", "Print the raw JSON-RPC `result` envelope").addHelpText("after", [
+    "",
+    "Examples:",
+    `  $ mcp skills invoke skill_123 --input '{"topic":"weather"}'`,
+    "  $ mcp skills invoke skill_123 --input @./input.json",
+    `  $ echo '{"q":"hi"}' | mcp skills invoke skill_123 --input @-`,
+    "  $ mcp --json skills invoke skill_123",
+    "",
+    "Exit codes:",
+    "  0   the call succeeded (the skill may still report isError=true)",
+    "  1   the skill has no active deployment, the input was malformed,",
+    "      or the HTTP/JSON-RPC layer errored"
+  ].join(`
+`)).action(runAction(async (skillId, opts) => {
+    await runSkillInvoke(skillId, opts);
+  }));
+}
+async function runSkillInvoke(skillId, opts) {
+  const orgId = await resolveOrgId(opts.org);
+  const parsedInput = await parseToolArguments({ raw: opts.input });
+  if (!parsedInput.ok) {
+    failOnInputError(parsedInput);
+  }
+  const data = await api.get("/api/v1/skill", {
+    organizationId: orgId,
+    skillId
+  });
+  const active = data.skill.activeDeployment;
+  if (!active || !active.mcpUrl) {
+    printError(`Skill ${c.bold(data.skill.name)} has no active deployment. Deploy it first, then retry.`);
+    throw new CliExitError(1);
+  }
+  if (active.status !== "active") {
+    printWarn(`Skill deployment is ${active.status}, not active — the call may be refused.`);
+  }
+  const timeoutMs = parseTimeoutMs(opts.timeout, 60000);
+  const toolName = opts.tool ?? await discoverSkillTool(active.mcpUrl, timeoutMs);
+  const result = await invokeMcpTool({
+    url: active.mcpUrl,
+    toolName,
+    toolArguments: parsedInput.ok ? parsedInput.value : {},
+    timeoutMs
+  });
+  if (isJsonMode()) {
+    printJson({
+      skillId: data.skill.id,
+      slug: data.skill.slug,
+      deploymentId: active.id,
+      toolName,
+      ...invokeResultToJson(result)
+    });
+    if (!result.ok)
+      throw new CliExitError(1);
+    return;
+  }
+  if (!result.ok) {
+    if (result.reason === "rpc-error") {
+      printError(`RPC error from ${c.bold(toolName)}: ${result.error.message}` + (result.error.code ? c.dim(` (code ${result.error.code})`) : ""));
+    } else {
+      const statusLine = result.status > 0 ? `HTTP ${result.status}` : "network error";
+      printError(`${statusLine} from skill runtime: ${result.message}`);
+    }
+    throw new CliExitError(1);
+  }
+  if (opts.raw) {
+    printInfo(JSON.stringify(result.result, null, 2));
+    return;
+  }
+  const formatted = formatToolCallResult(result.result);
+  for (const line of formatted.lines)
+    printInfo(line);
+  if (formatted.isToolError) {
+    printWarn(`Skill reported isError=true. Inspect ${c.bold("--json")} or ${c.bold("--raw")} for the full envelope.`);
+  }
+}
+async function discoverSkillTool(mcpUrl, timeoutMs) {
+  const listed = await listMcpTools({ url: mcpUrl, timeoutMs });
+  if (!listed.ok) {
+    const detail = listed.reason === "rpc-error" ? listed.error.message : `${listed.status > 0 ? `HTTP ${listed.status}` : "network error"}: ${listed.message}`;
+    printError(`Could not list the skill's tools to auto-discover the entry point (${detail}). Pass --tool <name> to call it directly.`);
+    throw new CliExitError(1);
+  }
+  if (listed.tools.length === 0) {
+    printError("The skill deployment advertises no tools. It may still be warming up — retry shortly.");
+    throw new CliExitError(1);
+  }
+  if (listed.tools.length > 1) {
+    printError(`The skill exposes ${listed.tools.length} tools (${listed.tools.map((tool) => tool.name).join(", ")}). Pass --tool <name> to choose one.`);
+    throw new CliExitError(1);
+  }
+  return listed.tools[0].name;
+}
+function failOnInputError(parsed) {
+  if (parsed.ok)
+    throw new Error("unreachable");
+  if (parsed.reason === "parse-error") {
+    printError(`Failed to parse --input JSON: ${parsed.message}`);
+  } else if (parsed.reason === "file-not-found") {
+    printError(`--input file not found: ${parsed.path}`);
+  } else if (parsed.reason === "not-an-object") {
+    printError("--input must decode to a JSON object (not array / scalar).");
+  }
+  throw new CliExitError(1);
+}
+function invokeResultToJson(result) {
+  if (result.ok) {
+    return { ok: true, durationMs: result.durationMs, result: result.result };
+  }
+  if (result.reason === "rpc-error") {
+    return {
+      ok: false,
+      durationMs: result.durationMs,
+      error: { kind: "rpc-error", ...result.error }
+    };
+  }
+  return {
+    ok: false,
+    durationMs: result.durationMs,
+    error: { kind: "http-error", status: result.status, message: result.message }
+  };
+}
+
+// src/commands/skills.ts
+async function runClaudeMcpAdd(connectionName, mcpUrl) {
+  return new Promise((resolve7) => {
+    const child = spawn3("claude", ["mcp", "add", "--transport", "http", connectionName, mcpUrl], {
+      stdio: "inherit",
+      shell: false
+    });
+    child.on("error", () => resolve7(127));
+    child.on("exit", (code) => resolve7(code ?? 1));
+  });
+}
+function registerSkillCommands(program2) {
+  const skills = program2.command("skills").description("Manage skills");
+  registerSkillMutationCommands(skills);
+  registerSkillTestCommands(skills);
+  registerSkillInvokeCommand(skills);
+  skills.command("list").description("List skills in an organization").option("--org <organizationId>", "Organization ID").option("--project <projectId>", "Filter by project ID").option("--limit <n>", "Maximum results (default 25)", parsePositiveIntOption("limit"), "25").addHelpText("after", [
+    "",
+    "Examples:",
+    "  $ mcp skills list",
+    "  $ mcp skills list --filter status=published",
+    "  $ mcp skills list --field id,name --format jsonl"
+  ].join(`
+`)).action(runAction(async (opts) => {
+    const orgId = await resolveOrgId(opts.org);
+    const params = {
+      organizationId: orgId,
+      limit: opts.limit
+    };
+    if (opts.project)
+      params["projectId"] = opts.project;
+    const data = await api.get("/api/v1/skills", params);
+    printList(data.skills.map((s) => ({
+      id: s.id,
+      name: s.name,
+      project: s.projectName,
+      status: s.status,
       version: s.version,
       updated: formatDate(s.updatedAt)
     })), [
@@ -7686,7 +8411,7 @@ function registerSkillCommands(program2) {
   skills.command("connect <skillId>").description("Print (or apply) the MCP configuration that connects this skill to your coding agent").option("--org <organizationId>", "Organization ID").option("--agent <agent>", `Agent preset: ${AGENT_KEYS.join(", ")}`, "claude-code").option("--name <name>", "Override the connection name shown in the agent (defaults to the skill slug)").option("--apply", 'For claude-code: invoke "claude mcp add" automatically. Other agents print only.').action(runAction(async (skillId, opts) => {
     if (!isAgentKey(opts.agent)) {
       printError(`Unknown --agent '${opts.agent}'. Valid values: ${AGENT_KEYS.join(", ")}.`);
-      process.exit(1);
+      throw new CliExitError(1);
     }
     const agent = opts.agent;
     const orgId = await resolveOrgId(opts.org);
@@ -7707,7 +8432,7 @@ function registerSkillCommands(program2) {
       } else {
         printError(`Skill '${s.name}' has no active deployment. Deploy it first, then re-run "mcp skills connect".`);
       }
-      process.exit(1);
+      throw new CliExitError(1);
     }
     const connectionName = opts.name?.trim() || s.slug || s.name;
     const preset = getAgentPreset({
@@ -7726,7 +8451,7 @@ function registerSkillCommands(program2) {
         } else {
           printError(`--apply is only supported for --agent claude-code right now. For ${preset.label}, copy the snippet into ${preset.location}.`);
         }
-        process.exit(1);
+        throw new CliExitError(1);
       }
       if (!isJsonMode()) {
         printInfo(`Applying via "claude mcp add --transport http ${connectionName} ${deployment.mcpUrl}"…`);
@@ -7742,7 +8467,7 @@ function registerSkillCommands(program2) {
         } else {
           printError('Could not find the "claude" CLI on PATH. Install Claude Code or rerun without --apply.');
         }
-        process.exit(1);
+        throw new CliExitError(1);
       }
       if (code !== 0) {
         if (isJsonMode()) {
@@ -7754,7 +8479,7 @@ function registerSkillCommands(program2) {
         } else {
           printError(`"claude mcp add" exited with code ${code}.`);
         }
-        process.exit(code || 1);
+        throw new CliExitError(code || 1);
       }
       if (isJsonMode()) {
         printJson({
@@ -7878,6 +8603,29 @@ function registerSkillCommands(program2) {
 }
 
 // src/commands/api-keys.ts
+var MAX_EXPIRY_DAYS = 365;
+function parseExpiresInDays(raw) {
+  if (raw === undefined)
+    return;
+  const trimmed = raw.trim().toLowerCase();
+  const match = /^(\d+)\s*(d|w|m)?$/.exec(trimmed);
+  if (!match) {
+    throw new Error(`Invalid --expires-in: ${raw}. Expected a duration like 90d, 12w, 6m, or a day count.`);
+  }
+  const value = Number.parseInt(match[1], 10);
+  const unit = match[2] ?? "d";
+  let days;
+  if (unit === "w")
+    days = value * 7;
+  else if (unit === "m")
+    days = value * 30;
+  else
+    days = value;
+  if (days < 1 || days > MAX_EXPIRY_DAYS) {
+    throw new Error(`--expires-in must resolve to between 1 and ${MAX_EXPIRY_DAYS} days (got ${days}).`);
+  }
+  return days;
+}
 function formatPreview(key) {
   return `${key.keyPrefix}…${key.lastFour}`;
 }
@@ -7890,37 +8638,92 @@ function registerApiKeyCommands(program2) {
       name: k.name,
       preview: formatPreview(k),
       created: formatDate(k.createdAt),
-      "last used": k.lastUsedAt ? formatDate(k.lastUsedAt) : "—"
-    })), [
-      { key: "id", label: "ID", width: 20 },
-      { key: "name", label: "Name", width: 24 },
-      { key: "preview", label: "Preview", width: 18 },
-      { key: "created", label: "Created", width: 22 },
-      { key: "last used", label: "Last Used", width: 22 }
-    ], data);
+      "last used": k.lastUsedAt ? formatDate(k.lastUsedAt) : "—",
+      expires: k.expiresAt ? formatDate(k.expiresAt) : "never"
+    })), [
+      { key: "id", label: "ID", width: 20 },
+      { key: "name", label: "Name", width: 24 },
+      { key: "preview", label: "Preview", width: 18 },
+      { key: "created", label: "Created", width: 22 },
+      { key: "last used", label: "Last Used", width: 22 },
+      { key: "expires", label: "Expires", width: 22 }
+    ], data);
+  }));
+  apiKeys.command("create").description("Create a new API key (the secret is shown once)").requiredOption("--name <name>", "Display name for the key").option("--expires-in <duration>", "Auto-expire the key after this long: 90d, 12w, 6m, or a day count (1–365). Default: never.").action(runAction(async (opts) => {
+    const name = opts.name.trim();
+    if (!name)
+      throw new Error("--name must not be empty.");
+    const expiresInDays = parseExpiresInDays(opts.expiresIn);
+    const data = await api.post("/api/v1/api-keys", {
+      name,
+      ...expiresInDays !== undefined ? { expiresInDays } : {}
+    });
+    if (isJsonMode()) {
+      printJson(data);
+      return;
+    }
+    printSuccess("API key created — copy the secret below now, it will not be shown again.");
+    console.log("");
+    printKeyValue({
+      id: data.apiKeyId,
+      name: data.name,
+      key: data.apiKey,
+      "key prefix": data.keyPrefix,
+      "last four": data.lastFour,
+      expires: data.expiresAt ? formatDate(data.expiresAt) : "never"
+    });
+    console.log("");
+    printInfo("Save it via `mcp login --key <secret>` or export MCPCLOUD_API_KEY=<secret>.");
+  }));
+  apiKeys.command("describe <apiKeyId>").description("Show one API key (status, expiry, last used) — never the secret").action(runAction(async (apiKeyId) => {
+    const data = await api.get("/api/v1/api-keys", { apiKeyId });
+    if (isJsonMode()) {
+      printJson(data);
+      return;
+    }
+    const k = data.apiKey;
+    printKeyValue({
+      id: k.id,
+      name: k.name,
+      preview: formatPreview(k),
+      status: k.status,
+      created: formatDate(k.createdAt),
+      "last used": k.lastUsedAt ? formatDate(k.lastUsedAt) : "—",
+      expires: k.expiresAt ? formatDate(k.expiresAt) : "never",
+      revoked: k.revokedAt ? formatDate(k.revokedAt) : "—"
+    });
   }));
-  apiKeys.command("create").description("Create a new API key (the secret is shown once)").requiredOption("--name <name>", "Display name for the key").action(runAction(async (opts) => {
-    const name = opts.name.trim();
-    if (!name)
-      throw new Error("--name must not be empty.");
-    const data = await api.post("/api/v1/api-keys", {
-      name
+  apiKeys.command("rotate <apiKeyId>").description("Mint a replacement key and grace-expire the old one (24h window). The new secret is shown once.").option("--expires-in <duration>", "Expiry for the NEW key: 90d, 12w, 6m, or a day count (1–365). Default: never.").addHelpText("after", [
+    "",
+    "The old key keeps working for 24h so running automation can swap to the",
+    "new secret before the old one stops. Update your secrets within that window.",
+    "",
+    "Examples:",
+    "  $ mcp api-keys rotate key_123",
+    "  $ mcp api-keys rotate key_123 --expires-in 90d"
+  ].join(`
+`)).action(runAction(async (apiKeyId, opts) => {
+    const expiresInDays = parseExpiresInDays(opts.expiresIn);
+    const data = await api.patch("/api/v1/api-keys", {
+      apiKeyId,
+      ...expiresInDays !== undefined ? { expiresInDays } : {}
     });
     if (isJsonMode()) {
       printJson(data);
       return;
     }
-    printSuccess("API key created — copy the secret below now, it will not be shown again.");
+    printSuccess("API key rotated — copy the new secret below now, it will not be shown again.");
     console.log("");
     printKeyValue({
-      id: data.apiKeyId,
+      "new id": data.apiKeyId,
       name: data.name,
       key: data.apiKey,
       "key prefix": data.keyPrefix,
-      "last four": data.lastFour
+      "last four": data.lastFour,
+      expires: data.expiresAt ? formatDate(data.expiresAt) : "never",
+      "old key": data.rotatedFrom?.apiKeyId ?? "—",
+      "old key valid until": data.rotatedFrom ? formatDate(data.rotatedFrom.gracePeriodEndsAt) : "—"
     });
-    console.log("");
-    printInfo("Save it via `mcp login --key <secret>` or export MCPCLOUD_API_KEY=<secret>.");
   }));
   apiKeys.command("revoke <apiKeyId>").description("Permanently revoke an API key").action(runAction(async (apiKeyId) => {
     const data = await api.delete("/api/v1/api-keys", { apiKeyId });
@@ -7934,9 +8737,9 @@ function registerApiKeyCommands(program2) {
 
 // src/commands/config.ts
 import { homedir as homedir2 } from "node:os";
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 function configFilePath() {
-  return join10(homedir2(), ".mcpcloud", "config.json");
+  return join11(homedir2(), ".mcpcloud", "config.json");
 }
 function previewKey2(key) {
   if (!key)
@@ -8083,353 +8886,136 @@ function registerConfigCommands(program2) {
       cleared.push("open preference");
     if (hadCmd)
       cleared.push("editor command");
-    if (hadTarget)
-      cleared.push("open target");
-    const what = cleared.length === 0 ? "nothing (already empty)" : cleared.join(" + ");
-    printSuccess(`Cleared ${what}. \`mcp dev\` will re-detect editors and prompt next session.`);
-  }));
-  config.command("set-editor-command <command>").description("Override the editor launch command (default: code; e.g. cursor, code-insiders)").action(runAction((command) => {
-    const cfg = readConfig();
-    cfg.editorCommand = command.trim();
-    writeConfig(cfg);
-    if (isJsonMode()) {
-      printJson({ editorCommand: cfg.editorCommand });
-      return;
-    }
-    printSuccess(`Saved editor command: ${cfg.editorCommand}`);
-  }));
-  config.command("use <name>").description("Switch the active profile (e.g. staging, prod)").action(runAction((name) => {
-    setCurrentProfile(name);
-    if (isJsonMode()) {
-      printJson({ currentProfile: name });
-      return;
-    }
-    printSuccess(`Switched to profile: ${name}`);
-  }));
-  const profile = config.command("profile").description("Manage named config profiles (apiKey + baseUrl + defaultOrganizationId)");
-  profile.command("list").description("List all configured profiles").action(runAction(() => {
-    const profiles = listProfiles();
-    if (isJsonMode()) {
-      printJson({ profiles, currentProfile: getActiveProfileName() });
-      return;
-    }
-    if (profiles.length === 0) {
-      console.log("No profiles configured. Run `mcp config profile add <name>` to create one.");
-      return;
-    }
-    printTable(profiles.map((p) => ({
-      current: p.isCurrent ? c.green("✓") : "",
-      name: p.name,
-      baseUrl: p.baseUrl ?? "—",
-      "default org": p.defaultOrganizationId ?? "—",
-      "api key": p.hasApiKey ? c.dim("saved") : c.dim("—")
-    })), [
-      { key: "current", label: "", width: 3 },
-      { key: "name", label: "Name", width: 18 },
-      { key: "baseUrl", label: "Base URL", width: 36 },
-      { key: "default org", label: "Default org", width: 22 },
-      { key: "api key", label: "API key", width: 10 }
-    ]);
-  }));
-  profile.command("add <name>").description("Create a new profile (use --url / --key / --app / --org to seed values)").option("--url <url>", "API base URL for the new profile").option("--key <apiKey>", "API key for the new profile (writes to config.json mode 0600)").option("--app <url>", "Dashboard origin override for the new profile").option("--org <organizationId>", "Default organization ID for the new profile").action(runAction((name, opts) => {
-    if (opts.url) {
-      try {
-        new URL(opts.url);
-      } catch {
-        throw new Error(`Invalid --url: ${opts.url}`);
-      }
-    }
-    if (opts.app) {
-      try {
-        new URL(opts.app);
-      } catch {
-        throw new Error(`Invalid --app: ${opts.app}`);
-      }
-    }
-    const seed = {};
-    if (opts.url)
-      seed.baseUrl = opts.url;
-    if (opts.key)
-      seed.apiKey = opts.key;
-    if (opts.app)
-      seed.appUrl = opts.app.replace(/\/+$/, "");
-    if (opts.org)
-      seed.defaultOrganizationId = opts.org;
-    addProfile(name, seed);
-    if (isJsonMode()) {
-      printJson({ added: name.trim(), seeded: Object.keys(seed) });
-      return;
-    }
-    printSuccess(`Created profile: ${name.trim()}`);
-    if (opts.key) {
-      console.log(c.dim("  Tip: passing --key writes the secret to your shell history. Prefer `mcp --profile <name> login` for interactive setup."));
-    }
-    console.log(c.dim(`  Switch to it with \`mcp config use ${name.trim()}\`.`));
-  }));
-  profile.command("remove <name>").description("Delete a profile (cannot remove the active or only-remaining profile)").action(runAction((name) => {
-    removeProfile(name);
-    if (isJsonMode()) {
-      printJson({ removed: name });
-      return;
-    }
-    printSuccess(`Removed profile: ${name}`);
-  }));
-}
-
-// src/commands/dev.ts
-import { existsSync as existsSync32 } from "node:fs";
-import { isAbsolute as isAbsolute3, relative as relative7, resolve as resolve7 } from "node:path";
-
-// src/lib/mcp-invoke.ts
-import { existsSync as existsSync12, readFileSync as readFileSync10 } from "node:fs";
-import { resolve as resolve5 } from "node:path";
-var DEFAULT_TIMEOUT_MS3 = 60000;
-var invokeRequestId = 1;
-async function invokeMcpTool(args) {
-  const startedAt = Date.now();
-  const controller = new AbortController;
-  const timer = setTimeout(() => controller.abort(), args.timeoutMs ?? DEFAULT_TIMEOUT_MS3);
-  const headers = {
-    "content-type": "application/json",
-    accept: "application/json, text/event-stream",
-    ...args.headers
-  };
-  const body = JSON.stringify({
-    jsonrpc: "2.0",
-    id: `mcp-cli-invoke-${invokeRequestId++}`,
-    method: "tools/call",
-    params: { name: args.toolName, arguments: args.toolArguments }
-  });
-  try {
-    const res = await fetch(args.url, {
-      method: "POST",
-      headers,
-      body,
-      signal: controller.signal
-    });
-    const rawText = await res.text();
-    const contentType = (res.headers.get("content-type") || "").toLowerCase();
-    const jsonText = contentType.includes("text/event-stream") ? unwrapEventStream(rawText) : rawText;
-    const parsed = parseJsonRpc(jsonText);
-    const durationMs = Date.now() - startedAt;
-    if (!parsed.ok) {
-      if (!res.ok) {
-        return {
-          ok: false,
-          reason: "http-error",
-          status: res.status,
-          message: parsed.error?.message ?? (rawText.slice(0, 200) || res.statusText),
-          durationMs
-        };
-      }
-      return {
-        ok: false,
-        reason: "rpc-error",
-        error: parsed.error ?? {
-          code: -32603,
-          message: "Malformed JSON-RPC response.",
-          data: rawText
-        },
-        durationMs
-      };
-    }
-    return {
-      ok: true,
-      result: parsed.result,
-      durationMs
-    };
-  } catch (err) {
-    const durationMs = Date.now() - startedAt;
-    const aborted = err instanceof Error && (err.name === "AbortError" || /abort/i.test(err.message));
-    return {
-      ok: false,
-      reason: "http-error",
-      status: 0,
-      message: aborted ? `Request timed out after ${args.timeoutMs ?? DEFAULT_TIMEOUT_MS3}ms.` : err instanceof Error ? err.message : String(err),
-      durationMs
-    };
-  } finally {
-    clearTimeout(timer);
-  }
-}
-function parseJsonRpc(text) {
-  if (!text.trim()) {
-    return {
-      ok: false,
-      result: {},
-      error: { code: -32700, message: "Response body was empty." }
-    };
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(text);
-  } catch (err) {
-    return {
-      ok: false,
-      result: {},
-      error: {
-        code: -32700,
-        message: `Response was not JSON: ${err instanceof Error ? err.message : String(err)}`
-      }
-    };
-  }
-  if (!parsed || typeof parsed !== "object") {
-    return {
-      ok: false,
-      result: {},
-      error: { code: -32603, message: "Malformed JSON-RPC response.", data: parsed }
-    };
-  }
-  const obj = parsed;
-  if ("result" in obj && obj.result && typeof obj.result === "object") {
-    return { ok: true, result: obj.result };
-  }
-  if ("error" in obj && obj.error && typeof obj.error === "object") {
-    const errObj = obj.error;
-    return {
-      ok: false,
-      result: {},
-      error: {
-        code: typeof errObj.code === "number" ? errObj.code : -32603,
-        message: typeof errObj.message === "string" ? errObj.message : "RPC error.",
-        data: errObj.data
-      }
-    };
-  }
-  return {
-    ok: false,
-    result: {},
-    error: { code: -32603, message: "Response had no result or error field." }
-  };
-}
-function unwrapEventStream(text) {
-  const parts = [];
-  for (const line of text.split(/\r?\n/)) {
-    if (line.startsWith("data:"))
-      parts.push(line.slice(5).replace(/^ /, ""));
-  }
-  return parts.join("");
-}
-async function parseToolArguments(opts) {
-  const raw = opts.raw?.trim();
-  if (!raw)
-    return { ok: true, value: {} };
-  let source;
-  if (raw === "@-" || raw === "-") {
-    const reader = opts.readStdin ?? defaultStdinReader;
-    source = await reader();
-  } else if (raw.startsWith("@")) {
-    const filePath = resolve5(opts.cwd ?? process.cwd(), raw.slice(1));
-    if (!existsSync12(filePath)) {
-      return { ok: false, reason: "file-not-found", path: filePath };
+    if (hadTarget)
+      cleared.push("open target");
+    const what = cleared.length === 0 ? "nothing (already empty)" : cleared.join(" + ");
+    printSuccess(`Cleared ${what}. \`mcp dev\` will re-detect editors and prompt next session.`);
+  }));
+  config.command("set-editor-command <command>").description("Override the editor launch command (default: code; e.g. cursor, code-insiders)").action(runAction((command) => {
+    const cfg = readConfig();
+    cfg.editorCommand = command.trim();
+    writeConfig(cfg);
+    if (isJsonMode()) {
+      printJson({ editorCommand: cfg.editorCommand });
+      return;
     }
-    source = readFileSync10(filePath, "utf-8");
-  } else {
-    source = raw;
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(source);
-  } catch (err) {
-    return {
-      ok: false,
-      reason: "parse-error",
-      message: err instanceof Error ? err.message : String(err)
-    };
-  }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    return { ok: false, reason: "not-an-object" };
-  }
-  return { ok: true, value: parsed };
-}
-async function defaultStdinReader() {
-  const chunks = [];
-  return new Promise((res, rej) => {
-    process.stdin.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
-    process.stdin.on("end", () => res(Buffer.concat(chunks).toString("utf-8")));
-    process.stdin.on("error", rej);
-  });
-}
-function formatToolCallResult(result) {
-  const lines = [];
-  const blocks = result.content ?? [];
-  for (const block of blocks) {
-    if (block.type === "text" && typeof block.text === "string") {
-      lines.push(block.text);
-      continue;
+    printSuccess(`Saved editor command: ${cfg.editorCommand}`);
+  }));
+  config.command("use <name>").description("Switch the active profile (e.g. staging, prod)").action(runAction((name) => {
+    setCurrentProfile(name);
+    if (isJsonMode()) {
+      printJson({ currentProfile: name });
+      return;
     }
-    if (block.type === "image") {
-      const sized = typeof block.data === "string" ? `${block.data.length} bytes` : "?";
-      lines.push(`[image ${block.mimeType ?? "application/octet-stream"} · ${sized} base64]`);
-      continue;
+    printSuccess(`Switched to profile: ${name}`);
+  }));
+  const profile = config.command("profile").description("Manage named config profiles (apiKey + baseUrl + defaultOrganizationId)");
+  profile.command("list").description("List all configured profiles").action(runAction(() => {
+    const profiles = listProfiles();
+    if (isJsonMode()) {
+      printJson({ profiles, currentProfile: getActiveProfileName() });
+      return;
     }
-    if (block.type === "audio") {
-      const sized = typeof block.data === "string" ? `${block.data.length} bytes` : "?";
-      lines.push(`[audio ${block.mimeType ?? "application/octet-stream"} · ${sized} base64]`);
-      continue;
+    if (profiles.length === 0) {
+      console.log("No profiles configured. Run `mcp config profile add <name>` to create one.");
+      return;
     }
-    if (block.type === "resource") {
-      const r = block.resource ?? {};
-      const inlineText = typeof r.text === "string" ? `
-${r.text}` : "";
-      lines.push(`[resource ${r.uri ?? "<no uri>"}${r.mimeType ? " · " + r.mimeType : ""}]${inlineText}`);
-      continue;
+    printTable(profiles.map((p) => ({
+      current: p.isCurrent ? c.green("✓") : "",
+      name: p.name,
+      baseUrl: p.baseUrl ?? "—",
+      "default org": p.defaultOrganizationId ?? "—",
+      "api key": p.hasApiKey ? c.dim("saved") : c.dim("—")
+    })), [
+      { key: "current", label: "", width: 3 },
+      { key: "name", label: "Name", width: 18 },
+      { key: "baseUrl", label: "Base URL", width: 36 },
+      { key: "default org", label: "Default org", width: 22 },
+      { key: "api key", label: "API key", width: 10 }
+    ]);
+  }));
+  profile.command("add <name>").description("Create a new profile (use --url / --key / --app / --org to seed values)").option("--url <url>", "API base URL for the new profile").option("--key <apiKey>", "API key for the new profile (writes to config.json mode 0600)").option("--app <url>", "Dashboard origin override for the new profile").option("--org <organizationId>", "Default organization ID for the new profile").action(runAction((name, opts) => {
+    if (opts.url) {
+      try {
+        new URL(opts.url);
+      } catch {
+        throw new Error(`Invalid --url: ${opts.url}`);
+      }
     }
-    lines.push(`[${block.type} block: ${truncateJsonPreview(block)}]`);
-  }
-  if (lines.length === 0 && result.structuredContent !== undefined) {
-    lines.push(`[structured]`);
-    lines.push(JSON.stringify(result.structuredContent, null, 2));
-  }
-  if (lines.length === 0) {
-    lines.push("(no content)");
-  }
-  return { lines, isToolError: result.isError === true };
-}
-function truncateJsonPreview(value) {
-  const json = (() => {
-    try {
-      return JSON.stringify(value);
-    } catch {
-      return "<unserializable>";
+    if (opts.app) {
+      try {
+        new URL(opts.app);
+      } catch {
+        throw new Error(`Invalid --app: ${opts.app}`);
+      }
     }
-  })();
-  return json.length > 100 ? json.slice(0, 97) + "…" : json;
+    const seed = {};
+    if (opts.url)
+      seed.baseUrl = opts.url;
+    if (opts.key)
+      seed.apiKey = opts.key;
+    if (opts.app)
+      seed.appUrl = opts.app.replace(/\/+$/, "");
+    if (opts.org)
+      seed.defaultOrganizationId = opts.org;
+    addProfile(name, seed);
+    if (isJsonMode()) {
+      printJson({ added: name.trim(), seeded: Object.keys(seed) });
+      return;
+    }
+    printSuccess(`Created profile: ${name.trim()}`);
+    if (opts.key) {
+      console.log(c.dim("  Tip: passing --key writes the secret to your shell history. Prefer `mcp --profile <name> login` for interactive setup."));
+    }
+    console.log(c.dim(`  Switch to it with \`mcp config use ${name.trim()}\`.`));
+  }));
+  profile.command("remove <name>").description("Delete a profile (cannot remove the active or only-remaining profile)").action(runAction((name) => {
+    removeProfile(name);
+    if (isJsonMode()) {
+      printJson({ removed: name });
+      return;
+    }
+    printSuccess(`Removed profile: ${name}`);
+  }));
 }
 
+// src/commands/dev.ts
+import { existsSync as existsSync33 } from "node:fs";
+import { isAbsolute as isAbsolute3, relative as relative7, resolve as resolve8 } from "node:path";
+
 // src/lib/dev/sessions.ts
 import {
-  existsSync as existsSync13,
-  mkdirSync as mkdirSync7,
-  readFileSync as readFileSync11,
+  existsSync as existsSync14,
+  mkdirSync as mkdirSync8,
+  readFileSync as readFileSync12,
   readdirSync as readdirSync2,
   unlinkSync,
-  writeFileSync as writeFileSync6
+  writeFileSync as writeFileSync7
 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 var SESSIONS_DIR_NAME = "dev-sessions";
 function sessionsDir() {
-  return join11(homedir3(), ".mcpcloud", SESSIONS_DIR_NAME);
+  return join12(homedir3(), ".mcpcloud", SESSIONS_DIR_NAME);
 }
 function sessionFile(pid) {
-  return join11(sessionsDir(), `${pid}.json`);
+  return join12(sessionsDir(), `${pid}.json`);
 }
 function ensureDir() {
   const dir = sessionsDir();
-  if (!existsSync13(dir))
-    mkdirSync7(dir, { recursive: true, mode: 448 });
+  if (!existsSync14(dir))
+    mkdirSync8(dir, { recursive: true, mode: 448 });
 }
 function recordSession(record) {
   ensureDir();
-  writeFileSync6(sessionFile(record.pid), JSON.stringify(record, null, 2), {
+  writeFileSync7(sessionFile(record.pid), JSON.stringify(record, null, 2), {
     encoding: "utf-8",
     mode: 384
   });
 }
 function removeSession(pid) {
   const path = sessionFile(pid);
-  if (existsSync13(path)) {
+  if (existsSync14(path)) {
     try {
       unlinkSync(path);
     } catch {}
@@ -8437,15 +9023,15 @@ function removeSession(pid) {
 }
 function listSessions() {
   const dir = sessionsDir();
-  if (!existsSync13(dir))
+  if (!existsSync14(dir))
     return [];
   const live = [];
   for (const entry of readdirSync2(dir)) {
     if (!entry.endsWith(".json"))
       continue;
-    const path = join11(dir, entry);
+    const path = join12(dir, entry);
     try {
-      const parsed = JSON.parse(readFileSync11(path, "utf-8"));
+      const parsed = JSON.parse(readFileSync12(path, "utf-8"));
       if (typeof parsed.pid !== "number") {
         unlinkSync(path);
         continue;
@@ -8505,7 +9091,7 @@ async function killSession(pid, timeoutMs = 3000) {
 }
 
 // src/commands/dev-invoke.ts
-function parseTimeoutMs(value, fallbackMs) {
+function parseTimeoutMs2(value, fallbackMs) {
   if (!value)
     return fallbackMs;
   const n = Number(value);
@@ -8532,7 +9118,7 @@ function registerDevInvokeCommand(dev) {
       toolName: tool,
       argsRaw: opts.args,
       urlOverride: opts.url,
-      timeoutMs: parseTimeoutMs(opts.timeout, 60000),
+      timeoutMs: parseTimeoutMs2(opts.timeout, 60000),
       raw: Boolean(opts.raw)
     });
   }));
@@ -8548,12 +9134,12 @@ async function runDevInvoke(args) {
     } else if (parsedArgs.reason === "not-an-object") {
       printError("--args must decode to a JSON object (not array / scalar).");
     }
-    process.exit(1);
+    throw new CliExitError(1);
   }
   const baseUrl = args.urlOverride ?? resolveDevBaseUrl(cwd);
   if (!baseUrl) {
     printError("No running `mcp dev` session in this directory. Start one, or pass --url <baseUrl>.");
-    process.exit(1);
+    throw new CliExitError(1);
   }
   const mcpUrl = baseUrl.endsWith("/mcp") ? baseUrl : `${baseUrl.replace(/\/$/, "")}/mcp`;
   const result = await invokeMcpTool({
@@ -8581,10 +9167,10 @@ function renderDevInvokeResult(args) {
     printJson({
       toolName: args.toolName,
       url: args.url,
-      ...invokeResultToJson(args.result)
+      ...invokeResultToJson2(args.result)
     });
     if (!args.result.ok)
-      process.exit(1);
+      throw new CliExitError(1);
     return;
   }
   if (!args.result.ok) {
@@ -8598,7 +9184,7 @@ function renderDevInvokeResult(args) {
       const statusLine = args.result.status > 0 ? `HTTP ${args.result.status}` : "network error";
       printError(`${statusLine} from local runtime: ${args.result.message}`);
     }
-    process.exit(1);
+    throw new CliExitError(1);
   }
   if (args.raw) {
     printInfo(JSON.stringify(args.result.result, null, 2));
@@ -8612,7 +9198,7 @@ function renderDevInvokeResult(args) {
     printWarn(`Tool reported isError=true. Inspect ${c.bold("--json")} or ${c.bold("--raw")} for the full envelope.`);
   }
 }
-function invokeResultToJson(result) {
+function invokeResultToJson2(result) {
   if (result.ok) {
     return { ok: true, durationMs: result.durationMs, result: result.result };
   }
@@ -8637,38 +9223,38 @@ function invokeResultToJson(result) {
 // src/lib/dev/inspector-store.ts
 import {
   appendFileSync as appendFileSync2,
-  existsSync as existsSync14,
-  mkdirSync as mkdirSync8,
-  readFileSync as readFileSync12,
+  existsSync as existsSync15,
+  mkdirSync as mkdirSync9,
+  readFileSync as readFileSync13,
   readdirSync as readdirSync3,
   renameSync,
   statSync as statSync2
 } from "node:fs";
-import { join as join12 } from "node:path";
+import { join as join13 } from "node:path";
 var INSPECTOR_DIRNAME = "inspector";
 var ACTIVE_FILE = "calls.ndjson";
 var ROTATED_PREFIX = "calls.";
 var ROTATED_SUFFIX = ".ndjson";
 var ROTATION_LIMIT_BYTES = 50 * 1024 * 1024;
 function inspectorDir(cwd) {
-  return join12(devRoot(cwd), INSPECTOR_DIRNAME);
+  return join13(devRoot(cwd), INSPECTOR_DIRNAME);
 }
 function ensureInspectorDir(dir) {
-  if (!existsSync14(dir))
-    mkdirSync8(dir, { recursive: true });
+  if (!existsSync15(dir))
+    mkdirSync9(dir, { recursive: true });
 }
 function activeFilePath(dir) {
-  return join12(dir, ACTIVE_FILE);
+  return join13(dir, ACTIVE_FILE);
 }
 function isRotatedName(name) {
   return name !== ACTIVE_FILE && name.startsWith(ROTATED_PREFIX) && name.endsWith(ROTATED_SUFFIX);
 }
 function listRotatedFiles(dir) {
-  if (!existsSync14(dir))
+  if (!existsSync15(dir))
     return [];
   const rotated = readdirSync3(dir).filter(isRotatedName);
   rotated.sort();
-  return rotated.map((n) => join12(dir, n));
+  return rotated.map((n) => join13(dir, n));
 }
 function parseLines(text) {
   if (!text)
@@ -8685,13 +9271,13 @@ function parseLines(text) {
   return out;
 }
 function readAll(dir) {
-  if (!existsSync14(dir))
+  if (!existsSync15(dir))
     return [];
   const out = [];
   for (const path of [...listRotatedFiles(dir), activeFilePath(dir)]) {
-    if (!existsSync14(path))
+    if (!existsSync15(path))
       continue;
-    out.push(...parseLines(readFileSync12(path, "utf-8")));
+    out.push(...parseLines(readFileSync13(path, "utf-8")));
   }
   return out;
 }
@@ -8759,7 +9345,7 @@ async function runDevReplay(opts) {
   const baseUrl = opts.url ?? resolveBaseUrl(cwd);
   if (!opts.dryRun && !baseUrl) {
     printError("No running mcp dev session in this directory. Start `mcp dev`, or pass --url <baseUrl>.");
-    process.exit(1);
+    throw new CliExitError(1);
   }
   const results = [];
   for (const record of records) {
@@ -8887,13 +9473,13 @@ function formatSummary(record) {
 
 // src/commands/dev-tail.ts
 import {
-  existsSync as existsSync15,
+  existsSync as existsSync16,
   openSync,
   readSync,
   closeSync,
   statSync as statSync3
 } from "node:fs";
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 var DEFAULT_INTERVAL_MS = 250;
 var MAX_READ_CHUNK = 64 * 1024;
 function registerDevTailCommand(dev) {
@@ -8902,14 +9488,14 @@ function registerDevTailCommand(dev) {
 async function runDevTail(opts) {
   const cwd = process.cwd();
   const dir = inspectorDir(cwd);
-  const activePath = join13(dir, ACTIVE_FILE);
+  const activePath = join14(dir, ACTIVE_FILE);
   const intervalMs = parseInterval(opts.intervalMs);
-  if (!existsSync15(dir)) {
+  if (!existsSync16(dir)) {
     printInfo(`No inspector history yet at ${dir}. Run \`mcp dev\` to start capturing.`);
-    process.exit(0);
+    throw new CliExitError(0);
   }
   let cursor = 0;
-  if (existsSync15(activePath)) {
+  if (existsSync16(activePath)) {
     try {
       cursor = opts.fromStart ? 0 : statSync3(activePath).size;
     } catch {
@@ -8925,7 +9511,7 @@ async function runDevTail(opts) {
   process.on("SIGTERM", stop);
   while (!stopped) {
     let size = 0;
-    if (existsSync15(activePath)) {
+    if (existsSync16(activePath)) {
       try {
         size = statSync3(activePath).size;
       } catch {
@@ -9010,7 +9596,7 @@ function emitLines(text, filter) {
   }
 }
 function sleep(ms) {
-  return new Promise((resolve6) => setTimeout(resolve6, ms));
+  return new Promise((resolve7) => setTimeout(resolve7, ms));
 }
 
 // ../../node_modules/.bun/@clack+core@1.3.1/node_modules/@clack/core/dist/index.mjs
@@ -10296,13 +10882,13 @@ async function runInteractiveBootstrap() {
 
 // src/lib/dev/bundle-sync.ts
 import {
-  existsSync as existsSync16,
-  mkdirSync as mkdirSync9,
-  readFileSync as readFileSync13,
+  existsSync as existsSync17,
+  mkdirSync as mkdirSync10,
+  readFileSync as readFileSync14,
   rmSync as rmSync2,
-  writeFileSync as writeFileSync7
+  writeFileSync as writeFileSync8
 } from "node:fs";
-import { dirname as dirname5, join as join14 } from "node:path";
+import { dirname as dirname6, join as join15 } from "node:path";
 async function resolveServerProject(args) {
   const data = await api.get("/api/v1/server", {
     organizationId: args.organizationId,
@@ -10358,8 +10944,8 @@ async function fetchBundle(args) {
   return parsed;
 }
 function materializeBundle(destDir, bundle, options = {}) {
-  if (!existsSync16(destDir)) {
-    mkdirSync9(destDir, { recursive: true });
+  if (!existsSync17(destDir)) {
+    mkdirSync10(destDir, { recursive: true });
   }
   const preserve = options.preservePaths;
   const kept = new Set;
@@ -10374,9 +10960,9 @@ function materializeBundle(destDir, bundle, options = {}) {
       preservedCount += 1;
       continue;
     }
-    const target = join14(destDir, safePath);
-    mkdirSync9(dirname5(target), { recursive: true });
-    writeFileSync7(target, file.content, "utf-8");
+    const target = join15(destDir, safePath);
+    mkdirSync10(dirname6(target), { recursive: true });
+    writeFileSync8(target, file.content, "utf-8");
     writtenCount += 1;
   }
   let removed = 0;
@@ -10404,7 +10990,7 @@ function pruneStaleFiles(rootDir, currentDir, kept) {
   const { relative: relative6 } = __require("node:path");
   let removed = 0;
   for (const entry of readdirSync4(currentDir)) {
-    const abs = join14(currentDir, entry);
+    const abs = join15(currentDir, entry);
     const stat = statSync4(abs);
     if (stat.isDirectory()) {
       removed += pruneStaleFiles(rootDir, abs, kept);
@@ -10470,8 +11056,8 @@ function startGitPullPoll(args) {
 
 // src/lib/dev/editor.ts
 import { spawn as spawn4 } from "node:child_process";
-import { existsSync as existsSync17, statSync as statSync4 } from "node:fs";
-import { delimiter as delimiter2, join as join15 } from "node:path";
+import { existsSync as existsSync18, statSync as statSync4 } from "node:fs";
+import { delimiter as delimiter2, join as join16 } from "node:path";
 import { platform as platform3 } from "node:os";
 var TARGET_LABEL = {
   tools: "tool metadata",
@@ -10507,8 +11093,8 @@ function findOnPath2(command) {
     if (!dir)
       continue;
     for (const ext of exts) {
-      const candidate = join15(dir, command + ext);
-      if (existsSync17(candidate) && isExecutable(candidate))
+      const candidate = join16(dir, command + ext);
+      if (existsSync18(candidate) && isExecutable(candidate))
         return candidate;
     }
   }
@@ -10788,11 +11374,11 @@ function parseOpenChoice(raw) {
 }
 
 // src/lib/dev/file-watcher.ts
-import { existsSync as existsSync18, statSync as statSync5, watch as fsWatch2 } from "node:fs";
-import { join as join16 } from "node:path";
+import { existsSync as existsSync19, statSync as statSync5, watch as fsWatch2 } from "node:fs";
+import { join as join17 } from "node:path";
 var DEFAULT_IGNORE = ["node_modules", ".git", "_mcpsh_host.mjs"];
 function watchDir(options) {
-  if (!existsSync18(options.rootDir)) {
+  if (!existsSync19(options.rootDir)) {
     throw new Error(`watchDir: directory does not exist: ${options.rootDir}`);
   }
   const ignore = new Set([...DEFAULT_IGNORE, ...options.ignore ?? []]);
@@ -10828,7 +11414,7 @@ function watchDir(options) {
       for (const entry of readdirSync4(options.rootDir)) {
         if (ignore.has(entry))
           continue;
-        const sub = join16(options.rootDir, entry);
+        const sub = join17(options.rootDir, entry);
         try {
           const stat = statSync5(sub);
           if (!stat.isDirectory())
@@ -10876,10 +11462,10 @@ function isToolHandlerPath(rel) {
 }
 
 // src/lib/dev/tools-watcher.ts
-import { existsSync as existsSync19 } from "node:fs";
+import { existsSync as existsSync20 } from "node:fs";
 function startToolsWatcher(args) {
   const rootDir = serverToolsDir(devRoot(args.cwd), args.serverId);
-  if (!existsSync19(rootDir))
+  if (!existsSync20(rootDir))
     return null;
   let inflight = false;
   let pendingNames = new Set;
@@ -10994,10 +11580,10 @@ async function maybeHotReload(args) {
 }
 
 // src/lib/dev/handlers-watcher.ts
-import { existsSync as existsSync20 } from "node:fs";
+import { existsSync as existsSync21 } from "node:fs";
 function startHandlersWatcher(args) {
   const rootDir = serverBundleHandlersDir(devRoot(args.cwd));
-  if (!existsSync20(rootDir))
+  if (!existsSync21(rootDir))
     return null;
   let inflight = false;
   let pendingSlugs = new Set;
@@ -11094,8 +11680,8 @@ async function handleOne2(args) {
 
 // src/lib/dev/local-runtime.ts
 import { spawn as spawn5 } from "node:child_process";
-import { existsSync as existsSync21 } from "node:fs";
-import { join as join17 } from "node:path";
+import { existsSync as existsSync22 } from "node:fs";
+import { join as join18 } from "node:path";
 function detectRuntime(preferred = "auto") {
   if (preferred === "bun" || preferred === "node")
     return preferred;
@@ -11106,7 +11692,7 @@ function detectRuntime(preferred = "auto") {
   return "node";
 }
 function startRuntime(options) {
-  if (!existsSync21(options.hostScriptPath)) {
+  if (!existsSync22(options.hostScriptPath)) {
     throw new Error(`Host script not found: ${options.hostScriptPath}`);
   }
   const runtime = detectRuntime(options.runtime);
@@ -11132,52 +11718,52 @@ function startRuntime(options) {
       if (child.exitCode !== null)
         return;
       child.kill("SIGTERM");
-      await new Promise((resolve6) => {
+      await new Promise((resolve7) => {
         const timer = setTimeout(() => {
           if (child.exitCode === null)
             child.kill("SIGKILL");
-          resolve6();
+          resolve7();
         }, 3000);
         child.once("exit", () => {
           clearTimeout(timer);
-          resolve6();
+          resolve7();
         });
       });
     }
   };
 }
 async function installDependencies(options) {
-  const pkgPath = join17(options.serverDir, "package.json");
-  if (!existsSync21(pkgPath))
+  const pkgPath = join18(options.serverDir, "package.json");
+  if (!existsSync22(pkgPath))
     return { ran: false, exitCode: null };
-  const nodeModules = join17(options.serverDir, "node_modules");
-  if (options.skipIfPresent !== false && existsSync21(nodeModules)) {
+  const nodeModules = join18(options.serverDir, "node_modules");
+  if (options.skipIfPresent !== false && existsSync22(nodeModules)) {
     return { ran: false, exitCode: 0 };
   }
   options.onStep?.("Installing dependencies (bun install)…");
-  return await new Promise((resolve6) => {
+  return await new Promise((resolve7) => {
     const child = spawn5("bun", ["install", "--silent"], {
       cwd: options.serverDir,
       stdio: "inherit"
     });
-    child.on("error", () => resolve6({ ran: true, exitCode: 127 }));
-    child.on("exit", (code) => resolve6({ ran: true, exitCode: code }));
+    child.on("error", () => resolve7({ ran: true, exitCode: 127 }));
+    child.on("exit", (code) => resolve7({ ran: true, exitCode: code }));
   });
 }
 
 // src/lib/dev/prepare.ts
-import { existsSync as existsSync25, writeFileSync as writeFileSync11 } from "node:fs";
-import { join as join21, relative as relative6 } from "node:path";
+import { existsSync as existsSync26, writeFileSync as writeFileSync12 } from "node:fs";
+import { join as join22, relative as relative6 } from "node:path";
 
 // src/lib/dev/git-clone.ts
 import { spawnSync } from "node:child_process";
 import {
-  existsSync as existsSync22,
-  mkdirSync as mkdirSync10,
-  readFileSync as readFileSync14,
-  writeFileSync as writeFileSync8
+  existsSync as existsSync23,
+  mkdirSync as mkdirSync11,
+  readFileSync as readFileSync15,
+  writeFileSync as writeFileSync9
 } from "node:fs";
-import { dirname as dirname6, join as join18 } from "node:path";
+import { dirname as dirname7, join as join19 } from "node:path";
 
 class GitNotAvailableError extends Error {
   constructor() {
@@ -11250,21 +11836,21 @@ function isGitAvailable() {
   }
 }
 function applyLocalExcludes(repoDir) {
-  const excludePath = join18(repoDir, ".git", "info", "exclude");
-  const existing = existsSync22(excludePath) ? readFileSync14(excludePath, "utf-8") : "";
+  const excludePath = join19(repoDir, ".git", "info", "exclude");
+  const existing = existsSync23(excludePath) ? readFileSync15(excludePath, "utf-8") : "";
   const next = mergeLocalExcludes(existing);
   if (next === null)
     return;
-  if (!existsSync22(dirname6(excludePath))) {
-    mkdirSync10(dirname6(excludePath), { recursive: true });
+  if (!existsSync23(dirname7(excludePath))) {
+    mkdirSync11(dirname7(excludePath), { recursive: true });
   }
-  writeFileSync8(excludePath, next, "utf-8");
+  writeFileSync9(excludePath, next, "utf-8");
 }
 function ensureClone(opts) {
   if (!isGitAvailable()) {
     throw new GitNotAvailableError;
   }
-  if (existsSync22(join18(opts.repoDir, ".git"))) {
+  if (existsSync23(join19(opts.repoDir, ".git"))) {
     opts.onStep?.("Refreshing existing clone (git fetch)…");
     runGit(gitFetchArgs(opts.branch), opts.repoDir);
     applyLocalExcludes(opts.repoDir);
@@ -11280,12 +11866,12 @@ function ensureClone(opts) {
 }
 
 // src/lib/dev/host-runtime.ts
-import { existsSync as existsSync24, mkdirSync as mkdirSync12, writeFileSync as writeFileSync10 } from "node:fs";
-import { dirname as dirname7, join as join20 } from "node:path";
+import { existsSync as existsSync25, mkdirSync as mkdirSync13, writeFileSync as writeFileSync11 } from "node:fs";
+import { dirname as dirname8, join as join21 } from "node:path";
 
 // src/lib/dev/inspector-module.ts
-import { existsSync as existsSync23, mkdirSync as mkdirSync11, writeFileSync as writeFileSync9 } from "node:fs";
-import { join as join19 } from "node:path";
+import { existsSync as existsSync24, mkdirSync as mkdirSync12, writeFileSync as writeFileSync10 } from "node:fs";
+import { join as join20 } from "node:path";
 
 // src/lib/dev/inspector-assets.ts
 var INSPECTOR_HTML = `<!doctype html>
@@ -26420,10 +27006,10 @@ function buildInspectorModule() {
 `);
 }
 function writeInspectorModule(serverDir2) {
-  if (!existsSync23(serverDir2))
-    mkdirSync11(serverDir2, { recursive: true });
-  const target = join19(serverDir2, INSPECTOR_FILE_NAME);
-  writeFileSync9(target, buildInspectorModule(), "utf-8");
+  if (!existsSync24(serverDir2))
+    mkdirSync12(serverDir2, { recursive: true });
+  const target = join20(serverDir2, INSPECTOR_FILE_NAME);
+  writeFileSync10(target, buildInspectorModule(), "utf-8");
   return target;
 }
 
@@ -26602,11 +27188,11 @@ function buildHostScript(options) {
 `);
 }
 function writeHostScript(serverDir2, options) {
-  if (!existsSync24(serverDir2))
-    mkdirSync12(serverDir2, { recursive: true });
-  const target = join20(serverDir2, HOST_FILE_NAME);
-  mkdirSync12(dirname7(target), { recursive: true });
-  writeFileSync10(target, buildHostScript(options), "utf-8");
+  if (!existsSync25(serverDir2))
+    mkdirSync13(serverDir2, { recursive: true });
+  const target = join21(serverDir2, HOST_FILE_NAME);
+  mkdirSync13(dirname8(target), { recursive: true });
+  writeFileSync11(target, buildHostScript(options), "utf-8");
   if (options.inspector) {
     writeInspectorModule(serverDir2);
   }
@@ -26635,7 +27221,7 @@ async function prepareDev(opts) {
     projectId = projectId ?? gitLink.projectId;
     serverName = `${gitLink.owner}/${gitLink.name}`;
     repoDir = gitCloneDir(cwd, gitLink.owner, gitLink.name);
-    dest = gitLink.pathPrefix ? join21(repoDir, gitLink.pathPrefix) : repoDir;
+    dest = gitLink.pathPrefix ? join22(repoDir, gitLink.pathPrefix) : repoDir;
     printStep(`Git-linked server — cloning ${gitLink.owner}/${gitLink.name}@${gitLink.branch}…`);
     try {
       const result = ensureClone({
@@ -26655,8 +27241,8 @@ async function prepareDev(opts) {
       }
       process.exit(1);
     }
-    if (!existsSync25(env)) {
-      writeFileSync11(env, `{}
+    if (!existsSync26(env)) {
+      writeFileSync12(env, `{}
 `, "utf-8");
       printInfo(`  → seeded ${relative6(cwd, env)} (empty; fill secrets here)`);
     }
@@ -26680,8 +27266,8 @@ async function prepareDev(opts) {
     });
     const result = materializeBundle(dest, bundle, { prune: true });
     printInfo(`  → wrote ${result.filesWritten} files (pruned ${result.filesRemoved})`);
-    if (!existsSync25(env)) {
-      writeFileSync11(env, `{}
+    if (!existsSync26(env)) {
+      writeFileSync12(env, `{}
 `, "utf-8");
       printInfo(`  → seeded ${relative6(cwd, env)} (empty; fill secrets here)`);
     }
@@ -26698,7 +27284,7 @@ async function prepareDev(opts) {
     });
     printInfo(`  → wrote ${toolsResult.filesWritten} editable tool file${toolsResult.filesWritten === 1 ? "" : "s"}${toolsResult.filesRemoved > 0 ? ` (pruned ${toolsResult.filesRemoved})` : ""}`);
   } else {
-    if (!existsSync25(dest)) {
+    if (!existsSync26(dest)) {
       printError("No cached bundle found. Run once without --offline first.");
       process.exit(1);
     }
@@ -26707,7 +27293,7 @@ async function prepareDev(opts) {
       process.exit(1);
     }
   }
-  const entryRel = ENTRY_CANDIDATES.find((c2) => existsSync25(join21(dest, c2)));
+  const entryRel = ENTRY_CANDIDATES.find((c2) => existsSync26(join22(dest, c2)));
   if (!entryRel) {
     printError("Could not locate an entry file (expected src/worker.ts).");
     process.exit(1);
@@ -26865,73 +27451,73 @@ function createBurstGuard() {
 }
 
 // src/lib/dev/agent-connectors/claude-code.ts
-import { existsSync as existsSync27, unlinkSync as unlinkSync2, writeFileSync as writeFileSync13 } from "node:fs";
+import { existsSync as existsSync28, unlinkSync as unlinkSync2, writeFileSync as writeFileSync14 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { join as join23 } from "node:path";
+import { join as join24 } from "node:path";
 
 // src/lib/dev/agent-connectors/json-config-utils.ts
-import { existsSync as existsSync26, mkdirSync as mkdirSync13, readFileSync as readFileSync15, writeFileSync as writeFileSync12 } from "node:fs";
-import { dirname as dirname8, join as join22, basename } from "node:path";
+import { existsSync as existsSync27, mkdirSync as mkdirSync14, readFileSync as readFileSync16, writeFileSync as writeFileSync13 } from "node:fs";
+import { dirname as dirname9, join as join23, basename } from "node:path";
 function readJsonFile(path) {
-  if (!existsSync26(path))
+  if (!existsSync27(path))
     return { ok: true, value: {} };
   try {
-    const raw = readFileSync15(path, "utf-8");
+    const raw = readFileSync16(path, "utf-8");
     if (!raw.trim())
       return { ok: true, value: {} };
     return { ok: true, value: JSON.parse(raw) };
   } catch {
     try {
-      return { ok: false, raw: readFileSync15(path, "utf-8") };
+      return { ok: false, raw: readFileSync16(path, "utf-8") };
     } catch {
       return { ok: false };
     }
   }
 }
 function atomicWriteJson(path, value) {
-  mkdirSync13(dirname8(path), { recursive: true });
+  mkdirSync14(dirname9(path), { recursive: true });
   const tmp = `${path}.mcpsh-${process.pid}-${Date.now()}.tmp`;
-  writeFileSync12(tmp, JSON.stringify(value, null, 2) + `
+  writeFileSync13(tmp, JSON.stringify(value, null, 2) + `
 `, "utf-8");
   const { renameSync: renameSync2 } = __require("node:fs");
   renameSync2(tmp, path);
 }
 function backupConfig(args) {
-  if (!existsSync26(args.configPath)) {
+  if (!existsSync27(args.configPath)) {
     return { backupPath: null, existed: false };
   }
-  mkdirSync13(args.backupsDir, { recursive: true });
+  mkdirSync14(args.backupsDir, { recursive: true });
   const filename = `${args.agentId}__${basename(args.configPath)}.bak`;
-  const backupPath = join22(args.backupsDir, filename);
-  if (!existsSync26(backupPath)) {
-    const raw = readFileSync15(args.configPath, "utf-8");
-    writeFileSync12(backupPath, raw, "utf-8");
+  const backupPath = join23(args.backupsDir, filename);
+  if (!existsSync27(backupPath)) {
+    const raw = readFileSync16(args.configPath, "utf-8");
+    writeFileSync13(backupPath, raw, "utf-8");
   }
   return { backupPath, existed: true };
 }
 function restoreFromBackup(args) {
   const filename = `${args.agentId}__${basename(args.configPath)}.bak`;
-  const backupPath = join22(args.backupsDir, filename);
-  if (!existsSync26(backupPath)) {
+  const backupPath = join23(args.backupsDir, filename);
+  if (!existsSync27(backupPath)) {
     return { restored: false };
   }
-  const raw = readFileSync15(backupPath, "utf-8");
-  mkdirSync13(dirname8(args.configPath), { recursive: true });
-  writeFileSync12(args.configPath, raw, "utf-8");
+  const raw = readFileSync16(backupPath, "utf-8");
+  mkdirSync14(dirname9(args.configPath), { recursive: true });
+  writeFileSync13(args.configPath, raw, "utf-8");
   return { restored: true };
 }
 
 // src/lib/dev/agent-connectors/claude-code.ts
 function configPath() {
-  return join23(homedir4(), ".claude.json");
+  return join24(homedir4(), ".claude.json");
 }
 function legacyConfigPath() {
-  return join23(homedir4(), ".claude", "mcp.json");
+  return join24(homedir4(), ".claude", "mcp.json");
 }
 function resolveConfigPath() {
-  if (existsSync27(configPath()))
+  if (existsSync28(configPath()))
     return configPath();
-  if (existsSync27(legacyConfigPath()))
+  if (existsSync28(legacyConfigPath()))
     return legacyConfigPath();
   return configPath();
 }
@@ -26941,8 +27527,8 @@ var claudeCodeConnector = {
   hotkey: "c",
   describeLocation: () => resolveConfigPath(),
   async detect() {
-    const claudeDir = join23(homedir4(), ".claude");
-    if (existsSync27(configPath()) || existsSync27(legacyConfigPath()) || existsSync27(claudeDir)) {
+    const claudeDir = join24(homedir4(), ".claude");
+    if (existsSync28(configPath()) || existsSync28(legacyConfigPath()) || existsSync28(claudeDir)) {
       return { installed: true, note: "Found Claude Code config" };
     }
     return { installed: false };
@@ -26980,7 +27566,7 @@ var claudeCodeConnector = {
       backupsDir: args.backupsDir,
       agentId: this.id
     });
-    if (!restored.restored && existsSync27(path)) {
+    if (!restored.restored && existsSync28(path)) {
       const after = readJsonFile(path);
       if (after.ok && after.value && typeof after.value === "object") {
         const root = after.value;
@@ -26990,7 +27576,7 @@ var claudeCodeConnector = {
           try {
             unlinkSync2(path);
           } catch {
-            writeFileSync13(path, `{}
+            writeFileSync14(path, `{}
 `, "utf-8");
           }
         }
@@ -27002,16 +27588,16 @@ var claudeCodeConnector = {
 
 // src/lib/dev/agent-connectors/codex.ts
 import {
-  existsSync as existsSync28,
-  mkdirSync as mkdirSync14,
-  readFileSync as readFileSync16,
+  existsSync as existsSync29,
+  mkdirSync as mkdirSync15,
+  readFileSync as readFileSync17,
   unlinkSync as unlinkSync3,
-  writeFileSync as writeFileSync14
+  writeFileSync as writeFileSync15
 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { dirname as dirname9, join as join24 } from "node:path";
+import { dirname as dirname10, join as join25 } from "node:path";
 function configPath2() {
-  return join24(homedir5(), ".codex", "config.toml");
+  return join25(homedir5(), ".codex", "config.toml");
 }
 var SECTION_PREFIX = "mcp_servers.";
 function buildSection(name, url) {
@@ -27049,7 +27635,7 @@ var codexConnector = {
   hotkey: "x",
   describeLocation: () => configPath2(),
   async detect() {
-    if (existsSync28(join24(homedir5(), ".codex")) || existsSync28(configPath2())) {
+    if (existsSync29(join25(homedir5(), ".codex")) || existsSync29(configPath2())) {
       return { installed: true, note: "Found ~/.codex/" };
     }
     return { installed: false };
@@ -27062,8 +27648,8 @@ var codexConnector = {
       agentId: this.id
     });
     let existing = "";
-    if (existsSync28(path)) {
-      existing = readFileSync16(path, "utf-8");
+    if (existsSync29(path)) {
+      existing = readFileSync17(path, "utf-8");
     }
     const conflict = findSectionRange(existing, args.name) !== null;
     let next = existing;
@@ -27078,18 +27664,18 @@ var codexConnector = {
       next += `
 `;
     next += buildSection(args.name, args.url);
-    mkdirSync14(dirname9(path), { recursive: true });
-    writeFileSync14(path, next, "utf-8");
+    mkdirSync15(dirname10(path), { recursive: true });
+    writeFileSync15(path, next, "utf-8");
     return { added: !conflict, conflict };
   },
   async remove(args) {
     const path = configPath2();
-    if (existsSync28(path)) {
-      const existing = readFileSync16(path, "utf-8");
+    if (existsSync29(path)) {
+      const existing = readFileSync17(path, "utf-8");
       const range = findSectionRange(existing, args.name);
       if (range) {
         const next = existing.slice(0, range.start) + existing.slice(range.end);
-        writeFileSync14(path, next, "utf-8");
+        writeFileSync15(path, next, "utf-8");
       }
     }
     const restored = restoreFromBackup({
@@ -27097,8 +27683,8 @@ var codexConnector = {
       backupsDir: args.backupsDir,
       agentId: this.id
     });
-    if (!restored.restored && existsSync28(path)) {
-      const after = readFileSync16(path, "utf-8");
+    if (!restored.restored && existsSync29(path)) {
+      const after = readFileSync17(path, "utf-8");
       if (!after.trim()) {
         try {
           unlinkSync3(path);
@@ -27110,11 +27696,11 @@ var codexConnector = {
 };
 
 // src/lib/dev/agent-connectors/continue.ts
-import { existsSync as existsSync29, unlinkSync as unlinkSync4, writeFileSync as writeFileSync15 } from "node:fs";
+import { existsSync as existsSync30, unlinkSync as unlinkSync4, writeFileSync as writeFileSync16 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { join as join25 } from "node:path";
+import { join as join26 } from "node:path";
 function configPath3() {
-  return join25(homedir6(), ".continue", "config.json");
+  return join26(homedir6(), ".continue", "config.json");
 }
 function isContinueServerEntry(value) {
   return Boolean(value && typeof value === "object" && typeof value.name === "string");
@@ -27125,8 +27711,8 @@ var continueConnector = {
   hotkey: "n",
   describeLocation: () => configPath3(),
   async detect() {
-    const dir = join25(homedir6(), ".continue");
-    if (existsSync29(dir) || existsSync29(configPath3())) {
+    const dir = join26(homedir6(), ".continue");
+    if (existsSync30(dir) || existsSync30(configPath3())) {
       return { installed: true, note: "Found ~/.continue/" };
     }
     return { installed: false };
@@ -27164,7 +27750,7 @@ var continueConnector = {
       backupsDir: args.backupsDir,
       agentId: this.id
     });
-    if (!restored.restored && existsSync29(path)) {
+    if (!restored.restored && existsSync30(path)) {
       const after = readJsonFile(path);
       if (after.ok && after.value && typeof after.value === "object") {
         const root = after.value;
@@ -27174,7 +27760,7 @@ var continueConnector = {
           try {
             unlinkSync4(path);
           } catch {
-            writeFileSync15(path, `{}
+            writeFileSync16(path, `{}
 `, "utf-8");
           }
         }
@@ -27185,11 +27771,11 @@ var continueConnector = {
 };
 
 // src/lib/dev/agent-connectors/cursor.ts
-import { existsSync as existsSync30, unlinkSync as unlinkSync5, writeFileSync as writeFileSync16 } from "node:fs";
+import { existsSync as existsSync31, unlinkSync as unlinkSync5, writeFileSync as writeFileSync17 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
-import { join as join26 } from "node:path";
+import { join as join27 } from "node:path";
 function globalConfigPath() {
-  return join26(homedir7(), ".cursor", "mcp.json");
+  return join27(homedir7(), ".cursor", "mcp.json");
 }
 var cursorConnector = {
   id: "cursor",
@@ -27197,9 +27783,9 @@ var cursorConnector = {
   hotkey: "u",
   describeLocation: () => globalConfigPath(),
   async detect() {
-    const cursorDir = join26(homedir7(), ".cursor");
-    const macAppSupport = join26(homedir7(), "Library", "Application Support", "Cursor");
-    if (existsSync30(cursorDir) || existsSync30(macAppSupport)) {
+    const cursorDir = join27(homedir7(), ".cursor");
+    const macAppSupport = join27(homedir7(), "Library", "Application Support", "Cursor");
+    if (existsSync31(cursorDir) || existsSync31(macAppSupport)) {
       return { installed: true, note: "Found Cursor config dir" };
     }
     return { installed: false };
@@ -27237,7 +27823,7 @@ var cursorConnector = {
       backupsDir: args.backupsDir,
       agentId: this.id
     });
-    if (!restored.restored && existsSync30(path)) {
+    if (!restored.restored && existsSync31(path)) {
       const after = readJsonFile(path);
       if (after.ok && after.value && typeof after.value === "object") {
         const root = after.value;
@@ -27247,7 +27833,7 @@ var cursorConnector = {
           try {
             unlinkSync5(path);
           } catch {
-            writeFileSync16(path, `{}
+            writeFileSync17(path, `{}
 `, "utf-8");
           }
         }
@@ -27258,30 +27844,30 @@ var cursorConnector = {
 };
 
 // src/lib/dev/agent-connectors/vscode-copilot.ts
-import { existsSync as existsSync31, unlinkSync as unlinkSync6, writeFileSync as writeFileSync17 } from "node:fs";
+import { existsSync as existsSync32, unlinkSync as unlinkSync6, writeFileSync as writeFileSync18 } from "node:fs";
 import { homedir as homedir8, platform as platform4 } from "node:os";
-import { join as join27, resolve as resolve6 } from "node:path";
+import { join as join28, resolve as resolve7 } from "node:path";
 function userLevelConfigPath() {
   const home = homedir8();
   const p2 = platform4();
   if (p2 === "darwin")
-    return join27(home, "Library", "Application Support", "Code", "User", "mcp.json");
+    return join28(home, "Library", "Application Support", "Code", "User", "mcp.json");
   if (p2 === "win32") {
-    const appData = process.env["APPDATA"] ?? join27(home, "AppData", "Roaming");
-    return join27(appData, "Code", "User", "mcp.json");
+    const appData = process.env["APPDATA"] ?? join28(home, "AppData", "Roaming");
+    return join28(appData, "Code", "User", "mcp.json");
   }
-  const xdg = process.env["XDG_CONFIG_HOME"] ?? join27(home, ".config");
-  return join27(xdg, "Code", "User", "mcp.json");
+  const xdg = process.env["XDG_CONFIG_HOME"] ?? join28(home, ".config");
+  return join28(xdg, "Code", "User", "mcp.json");
 }
 function isHomeDir(cwd) {
-  return resolve6(cwd) === resolve6(homedir8());
+  return resolve7(cwd) === resolve7(homedir8());
 }
 function hasWorkspaceVscode(cwd) {
-  return existsSync31(join27(cwd, ".vscode"));
+  return existsSync32(join28(cwd, ".vscode"));
 }
 function configPath4(cwd) {
   if (!isHomeDir(cwd) && hasWorkspaceVscode(cwd)) {
-    return join27(cwd, ".vscode", "mcp.json");
+    return join28(cwd, ".vscode", "mcp.json");
   }
   return userLevelConfigPath();
 }
@@ -27295,7 +27881,7 @@ var vscodeCopilotConnector = {
     if (!isHomeDir(here) && hasWorkspaceVscode(here)) {
       return { installed: true, note: "Found .vscode/ in current dir" };
     }
-    if (existsSync31(userLevelConfigPath().replace(/mcp\.json$/, ""))) {
+    if (existsSync32(userLevelConfigPath().replace(/mcp\.json$/, ""))) {
       return { installed: true, note: "Found VS Code user profile" };
     }
     return { installed: false };
@@ -27333,7 +27919,7 @@ var vscodeCopilotConnector = {
       backupsDir: args.backupsDir,
       agentId: this.id
     });
-    if (!restored.restored && existsSync31(path)) {
+    if (!restored.restored && existsSync32(path)) {
       const after = readJsonFile(path);
       if (after.ok && after.value && typeof after.value === "object") {
         const root = after.value;
@@ -27343,7 +27929,7 @@ var vscodeCopilotConnector = {
           try {
             unlinkSync6(path);
           } catch {
-            writeFileSync17(path, `{}
+            writeFileSync18(path, `{}
 `, "utf-8");
           }
         }
@@ -27487,7 +28073,7 @@ function parseGraceMs(value, fallbackMs) {
   return Math.round(n * 1000);
 }
 function resolveSpecPath(cwd, raw) {
-  return isAbsolute3(raw) ? raw : resolve7(cwd, raw);
+  return isAbsolute3(raw) ? raw : resolve8(cwd, raw);
 }
 function buildConnectionName(serverId) {
   const slug = serverId.toLowerCase().replace(/[^a-z0-9]+/g, "-").slice(0, 24) || "mcp-server";
@@ -27646,7 +28232,7 @@ async function runDev(opts) {
   let specPath = null;
   if (opts.spec) {
     const resolved = resolveSpecPath(cwd, opts.spec);
-    if (!existsSync32(resolved)) {
+    if (!existsSync33(resolved)) {
       printError(`Spec file not found: ${resolved}`);
       process.exit(1);
     }
@@ -28407,7 +28993,7 @@ function registerDeploymentCommands(program2) {
       const ok = await confirmRollback(deploymentId);
       if (!ok) {
         printInfo(c.dim("Aborted."));
-        process.exit(1);
+        throw new CliExitError(1);
       }
     }
     const orgId = await resolveOrgId(opts.org);
@@ -28416,20 +29002,57 @@ function registerDeploymentCommands(program2) {
       printJson(data);
       return;
     }
-    const d = data.deployment;
-    printSuccess(`Deployment ${d.deploymentId} rolled back to active.`);
+    const d = data.deployment;
+    printSuccess(`Deployment ${d.deploymentId} rolled back to active.`);
+    printKeyValue({
+      "deployment id": d.deploymentId,
+      server: d.serverId,
+      "previous status": d.previousStatus,
+      status: d.status,
+      "access mode": d.accessMode,
+      url: d.deploymentUrl ?? "—",
+      target: d.target,
+      version: d.version,
+      demoted: d.demotedDeploymentId ?? "—",
+      "rolled back at": formatDate(d.rolledBackAt)
+    });
+  }));
+  deployments.command("health <deploymentId>").description("Show a deployment's last health-check result (status, HTTP code, when it was checked)").option("--org <organizationId>", "Organization ID").addHelpText("after", [
+    "",
+    "Exit codes:",
+    "  0   the deployment reported a healthy status",
+    "  1   the deployment is unhealthy, unknown, or not found",
+    "",
+    "Examples:",
+    "  $ mcp deployments health dep_123",
+    '  $ mcp --quiet deployments health dep_123 && echo "deploy is green"',
+    "  $ mcp --json deployments health dep_123 | jq '.health.status'"
+  ].join(`
+`)).action(runAction(async (deploymentId, opts) => {
+    const orgId = await resolveOrgId(opts.org);
+    const data = await api.get("/api/v1/deployment/health", { organizationId: orgId, deploymentId });
+    const isHealthy = data.health.status === "healthy";
+    if (isQuiet()) {
+      if (!isHealthy)
+        throw new CliExitError(1);
+      return;
+    }
+    if (isJsonMode()) {
+      printJson(data);
+      if (!isHealthy)
+        throw new CliExitError(1);
+      return;
+    }
     printKeyValue({
-      "deployment id": d.deploymentId,
-      server: d.serverId,
-      "previous status": d.previousStatus,
-      status: d.status,
-      "access mode": d.accessMode,
-      url: d.deploymentUrl ?? "—",
-      target: d.target,
-      version: d.version,
-      demoted: d.demotedDeploymentId ?? "—",
-      "rolled back at": formatDate(d.rolledBackAt)
+      deployment: `${data.deployment.serverName} (${data.deployment.id})`,
+      status: data.health.status,
+      "http status": data.health.statusCode ?? "—",
+      "checked at": data.health.checkedAt ? formatDate(data.health.checkedAt) : "—",
+      "health error": data.health.error ?? "—",
+      "deploy error": data.health.deploymentError ?? "—"
     });
+    if (!isHealthy)
+      throw new CliExitError(1);
   }));
   deployments.command("logs <deploymentId>").description("Show recent deployment events; pass --follow to tail new ones as they arrive").option("--org <organizationId>", "Organization ID").option("--limit <n>", "Number of recent events on the initial read (default 50)", parsePositiveIntOption("limit"), "50").option("--follow", "Tail new events as they arrive (long-poll). Ctrl-C to stop.").option("--since <when>", "Only show events after this point. Accepts relative (5m, 1h, 30s), Unix-ms, or ISO-8601.").option("--follow-timeout <seconds>", "Maximum seconds to keep --follow open before exiting (default: 1 hour).", "3600").addHelpText("after", [
     "",
@@ -28462,13 +29085,13 @@ async function confirmRollback(deploymentId) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync34, statSync as statSync6, readFileSync as readFileSync18 } from "node:fs";
+import { existsSync as existsSync35, statSync as statSync6, readFileSync as readFileSync19 } from "node:fs";
 import { homedir as homedir9, platform as platform6 } from "node:os";
-import { join as join29, delimiter as delimiter3 } from "node:path";
+import { join as join30, delimiter as delimiter3 } from "node:path";
 
 // src/lib/version-check.ts
-import { existsSync as existsSync33, mkdirSync as mkdirSync15, readFileSync as readFileSync17, writeFileSync as writeFileSync18 } from "node:fs";
-import { join as join28 } from "node:path";
+import { existsSync as existsSync34, mkdirSync as mkdirSync16, readFileSync as readFileSync18, writeFileSync as writeFileSync19 } from "node:fs";
+import { join as join29 } from "node:path";
 var CACHE_TTL_MS = 24 * 60 * 60 * 1000;
 var FETCH_TIMEOUT_MS2 = 2000;
 var REGISTRY_URL = "https://registry.npmjs.org/@mcpcloud/cli/latest";
@@ -28476,13 +29099,13 @@ function cacheDir() {
   return configDir();
 }
 function cacheFile() {
-  return join28(cacheDir(), "version-check.json");
+  return join29(cacheDir(), "version-check.json");
 }
 function readCache() {
-  if (!existsSync33(cacheFile()))
+  if (!existsSync34(cacheFile()))
     return null;
   try {
-    const raw = JSON.parse(readFileSync17(cacheFile(), "utf-8"));
+    const raw = JSON.parse(readFileSync18(cacheFile(), "utf-8"));
     if (typeof raw.latest !== "string" || typeof raw.fetchedAt !== "number")
       return null;
     return { latest: raw.latest, fetchedAt: raw.fetchedAt };
@@ -28492,9 +29115,9 @@ function readCache() {
 }
 function writeCache(entry) {
   try {
-    if (!existsSync33(cacheDir()))
-      mkdirSync15(cacheDir(), { recursive: true, mode: 448 });
-    writeFileSync18(cacheFile(), JSON.stringify(entry, null, 2), { mode: 384 });
+    if (!existsSync34(cacheDir()))
+      mkdirSync16(cacheDir(), { recursive: true, mode: 448 });
+    writeFileSync19(cacheFile(), JSON.stringify(entry, null, 2), { mode: 384 });
   } catch {}
 }
 function compareVersions(a, b) {
@@ -28605,8 +29228,8 @@ function checkNode() {
 }
 function checkConfigFile() {
   const t0 = Date.now();
-  const path = join29(homedir9(), ".mcpcloud", "config.json");
-  if (!existsSync34(path)) {
+  const path = join30(homedir9(), ".mcpcloud", "config.json");
+  if (!existsSync35(path)) {
     return {
       name: "Config file",
       status: "warn",
@@ -28628,7 +29251,7 @@ function checkConfigFile() {
     } catch {}
   }
   try {
-    JSON.parse(readFileSync18(path, "utf-8"));
+    JSON.parse(readFileSync19(path, "utf-8"));
   } catch (err) {
     return {
       name: "Config file",
@@ -28763,8 +29386,8 @@ function checkClaudeCli() {
   for (const dir of PATH.split(delimiter3)) {
     if (!dir)
       continue;
-    const candidate = join29(dir, exe);
-    if (existsSync34(candidate)) {
+    const candidate = join30(dir, exe);
+    if (existsSync35(candidate)) {
       return {
         name: "claude CLI",
         status: "pass",
@@ -29099,14 +29722,14 @@ function registerHelpCommand(program2) {
 // src/commands/init.ts
 import { createInterface as createInterface2 } from "node:readline";
 function prompt2(question) {
-  if (isCiMode()) {
+  if (isNonInteractive()) {
     throw new Error("Interactive prompts are disabled in CI mode. Pass --org / --project / --name explicitly or run `mcp init` outside CI.");
   }
   const rl = createInterface2({ input: process.stdin, output: process.stderr });
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     rl.question(question, (answer) => {
       rl.close();
-      resolve8(answer.trim());
+      resolve9(answer.trim());
     });
   });
 }
@@ -29117,7 +29740,7 @@ async function pickProject(orgId, override) {
   }
   const list = await api.get("/api/v1/projects", { organizationId: orgId, limit: "25" });
   if (list.projects.length === 0) {
-    if (isCiMode()) {
+    if (isNonInteractive()) {
       throw new Error("Organization has no projects yet. Pass --project <id> to reuse an existing one or run outside CI to create one.");
     }
     printInfo(c.dim("No projects yet — creating one."));
@@ -29127,7 +29750,7 @@ async function pickProject(orgId, override) {
     const created = await api.post("/api/v1/projects", { organizationId: orgId, name });
     return { project: created.project, created: true };
   }
-  if (isCiMode()) {
+  if (isNonInteractive()) {
     throw new Error("Multiple projects found. Pass --project <id> to pick one in CI mode.");
   }
   printInfo("");
@@ -29157,7 +29780,7 @@ async function pickServerName(override) {
       throw new Error("--name must not be empty.");
     return trimmed;
   }
-  if (isCiMode()) {
+  if (isNonInteractive()) {
     throw new Error("Interactive prompts are disabled in CI mode. Pass --name <serverName>.");
   }
   const name = await prompt2("Server name: ");
@@ -29166,27 +29789,25 @@ async function pickServerName(override) {
   return name;
 }
 function registerInitCommand(program2) {
-  program2.command("init").description("Guided onboarding: pick org → pick/create project → create empty server skeleton").option("--org <organizationId>", "Organization ID").option("--project <projectId>", "Reuse an existing project instead of creating one").option("--name <serverName>", "Name for the new server").option("--non-interactive", "Fail instead of prompting for missing values (also implied by CI mode)").addHelpText("after", [
-    "",
-    "What v0 does:",
-    "  1. Resolves the target organization (--org or default).",
-    "  2. Lets you pick or create a project.",
-    "  3. Creates an empty server skeleton in that project.",
+  program2.command("init").description("Guided onboarding: pick org → pick/create project → create a server (empty skeleton, or generated from an OpenAPI/GraphQL spec via --from-spec)").option("--org <organizationId>", "Organization ID").option("--project <projectId>", "Reuse an existing project instead of creating one").option("--name <serverName>", "Name for the new server (skeleton path only)").option("--from-spec <file|url>", "Build the server from an OpenAPI/GraphQL spec: a local file, http(s) URL (fetched server-side), or @- for stdin").option("--source-type <type>", `Override spec classification: ${SOURCE_TYPES.join(" | ")} (auto-detected by default)`).option("--deploy", "After importing the spec, deploy the server").option("--wait", "With --deploy, follow events until the deploy is terminal").option("--wait-timeout <seconds>", "Max seconds to wait for a terminal deploy state (default 300)", "300").addHelpText("after", [
     "",
-    "Not yet wired (B1 backend):",
-    "  Source-material import (OpenAPI/GraphQL spec) and AI tool enrichment.",
-    "  Once `POST /api/v1/server/{ingest,enrich,generate}` ship, this command",
-    "  will gain --from-spec <url|path> for the full guided flow.",
+    "Two modes:",
+    "  Skeleton (default): resolve org → pick/create project → create an empty server.",
+    "  Spec (--from-spec):  resolve org → pick/create project → ingest the spec into a",
+    "                       generated server, then optionally --deploy [--wait].",
     "",
     "Examples:",
     "  $ mcp init",
-    '  $ mcp init --org org_acme --project proj_123 --name "Stripe MCP"'
+    '  $ mcp init --org org_acme --project proj_123 --name "Stripe MCP"',
+    "  $ mcp init --from-spec ./openapi.yaml --project proj_123",
+    "  $ mcp init --from-spec https://api.example.com/openapi.json --project proj_123 --deploy --wait"
   ].join(`
 `)).action(runAction(async (opts) => {
-    if (opts.nonInteractive) {
-      setCiMode(true);
-    }
     const orgId = await resolveOrgId(opts.org);
+    if (opts.fromSpec) {
+      await runSpecInit({ orgId, opts });
+      return;
+    }
     if (!isJsonMode()) {
       const orgs = await api.get("/api/v1/organizations");
       const org = orgs.organizations.find((o) => o.id === orgId);
@@ -29222,12 +29843,103 @@ function registerInitCommand(program2) {
     printSuccess(`Server ${c.bold(server.id)} ready.`);
     printInfo("");
     printInfo("Next steps:");
-    printInfo(`  1. Import an API spec — currently via the dashboard's "Import spec" UI.`);
-    printInfo(`     ${c.dim("(CLI ingest is backend-blocked; coming with B1)")}`);
+    printInfo(`  1. Import an API spec: \`mcp servers ingest --project ${project.id} --spec ./openapi.yaml\``);
+    printInfo(`     ${c.dim("(or re-run `mcp init --from-spec ./openapi.yaml` for the guided flow)")}`);
     printInfo(`  2. Run \`mcp dev --spec ./openapi.yaml\` to iterate locally.`);
     printInfo(`  3. \`mcp servers deploy ${server.id} --wait\` to ship it.`);
   }));
 }
+function validateSourceType2(value) {
+  if (value === undefined)
+    return;
+  const v2 = value.trim().toLowerCase();
+  if (!SOURCE_TYPES.includes(v2)) {
+    throw new Error(`Invalid --source-type: ${value}. Expected one of: ${SOURCE_TYPES.join(", ")}.`);
+  }
+  return v2;
+}
+async function runSpecInit(args) {
+  const { orgId, opts } = args;
+  const sourceType = validateSourceType2(opts.sourceType);
+  const payload = await readSpecSource(opts.fromSpec, sourceType);
+  const { project, created: projectCreated } = await pickProject(orgId, opts.project);
+  if (!isJsonMode() && projectCreated) {
+    printSuccess(`Project ${c.bold(project.name)} created (${project.id}).`);
+  }
+  if (!isJsonMode()) {
+    printStep(`Importing ${c.bold(payload.sourceType)} spec into ${c.bold(project.name)}…`);
+  }
+  const ingest = await api.post("/api/v1/server/ingest", buildIngestBody({
+    organizationId: orgId,
+    projectId: project.id,
+    payload
+  }));
+  const server = ingest.server;
+  if (!isJsonMode()) {
+    printSuccess(`Server ${c.bold(server.id)} created from spec.`);
+  }
+  let deployResult = null;
+  if (opts.deploy) {
+    if (!isJsonMode())
+      printStep(`Deploying ${c.bold(server.id)}…`);
+    const deployData = await api.post("/api/v1/server/deploy", {
+      organizationId: orgId,
+      serverId: server.id
+    });
+    let waitDone = !opts.wait;
+    let terminalEvent = null;
+    if (opts.wait) {
+      const totalTimeoutMs = Math.max(10, Number.parseInt(opts.waitTimeout, 10) || 300) * 1000;
+      const followed = await followDeploymentEvents({
+        organizationId: orgId,
+        deploymentId: deployData.deployment.deploymentId,
+        totalTimeoutMs,
+        onEvent: (event) => {
+          if (!isJsonMode())
+            printInfo(formatEventLine(event));
+        }
+      });
+      waitDone = followed.done;
+      terminalEvent = followed.terminalEvent;
+    }
+    deployResult = { deployment: deployData.deployment, waitDone, terminalEvent };
+  }
+  if (isJsonMode()) {
+    printJson({
+      organizationId: orgId,
+      project,
+      projectCreated,
+      apiSource: ingest.apiSource,
+      server,
+      deploy: deployResult
+    });
+    if (deployResult && opts.wait && !deployResult.waitDone)
+      throw new CliExitError(1);
+    return;
+  }
+  if (deployResult) {
+    const dep = deployResult.deployment;
+    printSuccess(`Deployment ${c.bold(dep.deploymentId)} created.`);
+    printKeyValue({
+      "server id": server.id,
+      "deployment id": dep.deploymentId,
+      url: dep.deploymentUrl ?? "—",
+      target: dep.target,
+      "access mode": dep.accessMode,
+      status: dep.status
+    });
+    if (opts.wait && !deployResult.waitDone) {
+      printError(`Deploy did not reach a terminal state in time. Watch with \`mcp deployments logs ${dep.deploymentId} --follow\`.`);
+      throw new CliExitError(1);
+    }
+    printStep(`Try it: \`mcp invoke ${server.id} <tool>\`.`);
+    return;
+  }
+  printInfo("");
+  printInfo("Next steps:");
+  printStep(`Generate the bundle: \`mcp servers generate ${server.id} --out ./build\``);
+  printStep(`Deploy it: \`mcp servers deploy ${server.id} --wait\``);
+}
 
 // src/commands/installation.ts
 function registerInstallationCommands(program2) {
@@ -29369,7 +30081,7 @@ function mapApiError2(err, context) {
 }
 
 // src/commands/invoke.ts
-function parseTimeoutMs2(value, fallbackMs) {
+function parseTimeoutMs3(value, fallbackMs) {
   if (!value)
     return fallbackMs;
   const n = Number(value);
@@ -29399,7 +30111,7 @@ function registerInvokeCommand(program2) {
       orgOverride: opts.org,
       deploymentOverride: opts.deployment,
       argsRaw: opts.args,
-      timeoutMs: parseTimeoutMs2(opts.timeout, 60000),
+      timeoutMs: parseTimeoutMs3(opts.timeout, 60000),
       raw: Boolean(opts.raw)
     });
   }));
@@ -29417,7 +30129,7 @@ async function runInvoke(args) {
   });
   if (!resolved.ok) {
     printError(resolved.message);
-    process.exit(1);
+    throw new CliExitError(1);
   }
   const target = resolved.target;
   const result = await invokeMcpTool({
@@ -29447,7 +30159,7 @@ function failOnArgsError(parsed) {
   } else if (parsed.reason === "not-an-object") {
     printError("--args must decode to a JSON object (not array / scalar).");
   }
-  process.exit(1);
+  throw new CliExitError(1);
 }
 function renderInvokeResult(args) {
   if (isJsonMode()) {
@@ -29457,10 +30169,10 @@ function renderInvokeResult(args) {
       deploymentId: args.deploymentId,
       accessMode: args.accessMode,
       exchangedRuntimeToken: args.exchangedRuntimeToken,
-      ...invokeResultToJson2(args.result)
+      ...invokeResultToJson3(args.result)
     });
     if (!args.result.ok)
-      process.exit(1);
+      throw new CliExitError(1);
     return;
   }
   if (!args.result.ok) {
@@ -29474,7 +30186,7 @@ function renderInvokeResult(args) {
       const statusLine = args.result.status > 0 ? `HTTP ${args.result.status}` : "network error";
       printError(`${statusLine} from deployment: ${args.result.message}`);
     }
-    process.exit(1);
+    throw new CliExitError(1);
   }
   if (args.raw) {
     printInfo(JSON.stringify(args.result.result, null, 2));
@@ -29488,7 +30200,7 @@ function renderInvokeResult(args) {
     printWarn(`Tool reported isError=true. Inspect ${c.bold("--json")} or ${c.bold("--raw")} for the full envelope.`);
   }
 }
-function invokeResultToJson2(result) {
+function invokeResultToJson3(result) {
   if (result.ok) {
     return {
       ok: true,
@@ -29667,7 +30379,106 @@ function registerMarketplaceCommands(program2) {
       }
     }
     printInfo("");
-    printInfo(c.dim("  Install via the dashboard for now; CLI install lands when the registry install mutation ships."));
+    printInfo(c.dim(`  Install it: \`mcp marketplace install ${a.id}\`  ·  Fork it: \`mcp marketplace fork ${a.id} --project <id>\``));
+  }));
+  marketplace.command("install <artifactId>").description("Install a published registry artifact (server or skill) into your organization").option("--org <organizationId>", "Organization ID").option("--semver <semver>", "Install a specific version (default: latest)").addHelpText("after", [
+    "",
+    "Notes:",
+    "  Paid listings must be purchased from the dashboard first. Private-org",
+    "  artifacts from another org require the Pro plan.",
+    "",
+    "Examples:",
+    "  $ mcp marketplace install rga_123",
+    "  $ mcp marketplace install rga_123 --semver 1.2.0"
+  ].join(`
+`)).action(runAction(async (artifactId, opts) => {
+    const orgId = await resolveOrgId(opts.org);
+    const data = await api.post("/api/v1/registry/install", {
+      organizationId: orgId,
+      artifactId,
+      ...opts.semver ? { version: opts.semver } : {}
+    });
+    if (isJsonMode()) {
+      printJson(data);
+      return;
+    }
+    const i = data.installation;
+    printSuccess(`Installed ${c.bold(i.artifactType)} (v${i.version}) into your organization.`);
+    printKeyValue({
+      "installation id": i.id,
+      type: i.artifactType,
+      artifact: i.primaryArtifactId,
+      version: i.version,
+      status: i.status
+    });
+  }));
+  marketplace.command("fork <artifactId>").description("Fork a registry artifact into one of your projects as an editable draft").requiredOption("--project <projectId>", "Project to fork the artifact into").option("--org <organizationId>", "Organization ID").addHelpText("after", [
+    "",
+    "Examples:",
+    "  $ mcp marketplace fork rga_123 --project proj_456"
+  ].join(`
+`)).action(runAction(async (artifactId, opts) => {
+    const orgId = await resolveOrgId(opts.org);
+    const data = await api.post("/api/v1/registry/fork", {
+      organizationId: orgId,
+      sourceArtifactId: artifactId,
+      targetProjectId: opts.project
+    });
+    if (isJsonMode()) {
+      printJson(data);
+      return;
+    }
+    printSuccess(`Forked ${c.bold(data.fork.artifactType)} → ${data.fork.forkedId} (draft).`);
+    printStep(data.fork.artifactType === "server" ? `Iterate: \`mcp dev\` then \`mcp servers deploy ${data.fork.forkedId} --wait\`.` : `Iterate on skill ${data.fork.forkedId} then \`mcp skills deploy\`.`);
+  }));
+  marketplace.command("publish <serverId|skillId>").description("Publish a deployed server or a versioned skill to the registry (requires org admin)").requiredOption("--type <type>", "Artifact type: server | skill").requiredOption("--project <projectId>", "The artifact's project ID").option("--semver <semver>", "Version to publish (required for servers; skills use their current version)").option("--visibility <visibility>", "public (marketplace) | private (your org only). Default public.", "public").option("--changelog <text>", "Optional changelog for this version").option("--org <organizationId>", "Organization ID").addHelpText("after", [
+    "",
+    "Notes:",
+    "  Servers must be successfully deployed before publishing. Publishing to",
+    "  the public marketplace or a private-org registry requires the Pro plan.",
+    "",
+    "Examples:",
+    "  $ mcp marketplace publish srv_123 --type server --project proj_1 --semver 1.0.0",
+    "  $ mcp marketplace publish skill_9 --type skill --project proj_1 --visibility private"
+  ].join(`
+`)).action(runAction(async (id, opts) => {
+    const orgId = await resolveOrgId(opts.org);
+    const type = opts.type.trim().toLowerCase();
+    if (type !== "server" && type !== "skill") {
+      throw new Error(`Invalid --type: ${opts.type}. Expected one of: server, skill.`);
+    }
+    const visibility = opts.visibility.trim().toLowerCase();
+    if (visibility !== "public" && visibility !== "private") {
+      throw new Error(`Invalid --visibility: ${opts.visibility}. Expected one of: public, private.`);
+    }
+    const access = visibility === "private" ? "privateOrg" : "public";
+    const body = {
+      organizationId: orgId,
+      artifactType: type,
+      projectId: opts.project,
+      access,
+      ...opts.changelog ? { changelog: opts.changelog } : {}
+    };
+    if (type === "server") {
+      if (!opts.semver) {
+        throw new Error("--semver <semver> is required when --type server.");
+      }
+      body["serverId"] = id;
+      body["semver"] = opts.semver;
+    } else {
+      body["skillId"] = id;
+    }
+    const data = await api.post("/api/v1/registry/publish", body);
+    if (isJsonMode()) {
+      printJson(data);
+      return;
+    }
+    printSuccess(`Published ${c.bold(data.artifact.name)} to the ${data.artifact.access === "public" ? "marketplace" : "private registry"}.`);
+    printKeyValue({
+      "artifact id": data.artifact.id,
+      name: data.artifact.name,
+      access: data.artifact.access
+    });
   }));
 }
 
@@ -29700,43 +30511,349 @@ function registerOAuthCommands(program2) {
       updated: formatDate(c2.updatedAt)
     });
   }));
+  oauth.command("connections").description("List OAuth provider connections across the organization").option("--org <organizationId>", "Organization ID").option("--status <status>", "Filter: all | connected | expired | error | revoked (default connected)", "connected").option("--server <serverId>", "Restrict to one server").addHelpText("after", [
+    "",
+    "Examples:",
+    "  $ mcp oauth connections",
+    "  $ mcp oauth connections --status all",
+    "  $ mcp --json oauth connections | jq '.connections[].id'"
+  ].join(`
+`)).action(runAction(async (opts) => {
+    const orgId = await resolveOrgId(opts.org);
+    const params = {
+      organizationId: orgId,
+      status: opts.status
+    };
+    if (opts.server)
+      params["serverId"] = opts.server;
+    const data = await api.get("/api/v1/oauth/connections", params);
+    printList(data.connections.map((conn) => ({
+      id: conn.id,
+      provider: conn.providerKey,
+      server: conn.serverName ?? "—",
+      status: conn.status,
+      scopes: conn.scopes.length,
+      updated: formatDate(conn.updatedAt)
+    })), [
+      { key: "id", label: "ID", width: 22 },
+      { key: "provider", label: "Provider", width: 16 },
+      { key: "server", label: "Server", width: 22 },
+      { key: "status", label: "Status", width: 12 },
+      { key: "scopes", label: "Scopes", width: 8 },
+      { key: "updated", label: "Updated", width: 22 }
+    ], data);
+  }));
+}
+
+// src/commands/usage.ts
+var MAX_WINDOW_DAYS = 90;
+function parseWindowDays(raw) {
+  if (!raw)
+    return 30;
+  const trimmed = raw.trim().toLowerCase();
+  const match = /^(\d+)\s*(d|w|h)?$/.exec(trimmed);
+  if (!match) {
+    throw new Error(`Invalid --since: ${raw}. Expected a window like 30d, 4w, or a day count.`);
+  }
+  const value = Number.parseInt(match[1], 10);
+  const unit = match[2] ?? "d";
+  let days;
+  if (unit === "w")
+    days = value * 7;
+  else if (unit === "h")
+    days = Math.ceil(value / 24);
+  else
+    days = value;
+  if (days < 1)
+    days = 1;
+  if (days > MAX_WINDOW_DAYS)
+    days = MAX_WINDOW_DAYS;
+  return days;
+}
+function formatMicros(micros) {
+  if (micros == null)
+    return "—";
+  return `$${(micros / 1e6).toFixed(2)}`;
+}
+function registerUsageCommands(program2) {
+  const usage = program2.command("usage").description("Show organization usage (tool-call volume) and credit balance from the terminal").option("--org <organizationId>", "Organization ID").option("--since <window>", "Aggregation window: 30d, 4w, or a day count (1–90, default 30d)").addHelpText("after", [
+    "",
+    "Examples:",
+    "  $ mcp usage                       # last 30 days of request volume + credit balance",
+    "  $ mcp usage --since 7d",
+    "  $ mcp --json usage | jq '.usage.totals.requestCount'",
+    "  $ mcp usage ledger --limit 20     # recent credit ledger entries"
+  ].join(`
+`)).action(runAction(async (opts) => {
+    const orgId = await resolveOrgId(opts.org);
+    const windowDays = parseWindowDays(opts.since);
+    const [usageData, creditsData] = await Promise.all([
+      api.get("/api/v1/billing/usage", {
+        organizationId: orgId,
+        windowDays: String(windowDays)
+      }),
+      api.get("/api/v1/credits/ledger", {
+        organizationId: orgId,
+        limit: "1"
+      })
+    ]);
+    if (isJsonMode()) {
+      printJson({
+        organization: usageData.organization,
+        usage: usageData.usage,
+        account: creditsData.account
+      });
+      return;
+    }
+    const t = usageData.usage.totals;
+    printKeyValue({
+      organization: `${usageData.organization.name ?? "—"} (${usageData.organization.id})`,
+      plan: usageData.organization.plan ?? "—",
+      window: `${usageData.usage.windowDays}d (since ${formatDate(usageData.usage.windowStartedAt)})`,
+      requests: t.requestCount,
+      allowed: t.allowedCount,
+      "rate-limited": t.rateLimitedCount,
+      unauthorized: t.unauthorizedCount,
+      failed: t.failedCount,
+      "avg cpu ms": usageData.usage.averageCpuTimeMs == null ? "—" : usageData.usage.averageCpuTimeMs.toFixed(1),
+      "avg duration ms": usageData.usage.averageDurationMs == null ? "—" : usageData.usage.averageDurationMs.toFixed(1),
+      "credit balance": formatMicros(creditsData.account?.balanceMicros),
+      "credits granted": formatMicros(creditsData.account?.totalGrantedMicros),
+      "credits debited": formatMicros(creditsData.account?.totalDebitedMicros)
+    });
+  }));
+  usage.command("ledger").description("List organization credit ledger entries (most recent first)").option("--org <organizationId>", "Organization ID").option("--limit <n>", "Maximum entries (1–100, default 50)", "50").option("--cursor <createdAtMs>", "Pagination cursor: the createdAt ms from a previous nextCursor").action(runAction(async (opts) => {
+    const orgId = await resolveOrgId(opts.org);
+    const params = {
+      organizationId: orgId,
+      limit: opts.limit
+    };
+    if (opts.cursor)
+      params["cursor"] = opts.cursor;
+    const data = await api.get("/api/v1/credits/ledger", params);
+    printList(data.entries.map((entry) => ({
+      id: entry.id,
+      kind: entry.entryKind,
+      amount: formatMicros(entry.amountMicros),
+      balance: formatMicros(entry.balanceAfterMicros),
+      source: entry.source ?? "—",
+      note: entry.note ?? "—",
+      created: formatDate(entry.createdAt)
+    })), [
+      { key: "id", label: "ID", width: 22 },
+      { key: "kind", label: "Kind", width: 14 },
+      { key: "amount", label: "Amount", width: 12 },
+      { key: "balance", label: "Balance", width: 12 },
+      { key: "source", label: "Source", width: 16 },
+      { key: "note", label: "Note", width: 24 },
+      { key: "created", label: "Created", width: 22 }
+    ], data);
+  }));
+}
+
+// src/commands/metrics.ts
+function formatPercent(rate) {
+  if (rate == null)
+    return "—";
+  return `${(rate * 100).toFixed(2)}%`;
+}
+function formatMs(value) {
+  if (value == null)
+    return "—";
+  return `${value.toFixed(1)}ms`;
+}
+function registerMetricsCommands(program2) {
+  const metrics = program2.command("metrics").description("Aggregate deployment metrics (request volume, error rate)");
+  metrics.command("deployment <deploymentId>").description("Show aggregate request metrics for a deployment over a window (CI deploy gate)").option("--org <organizationId>", "Organization ID").option("--since <window>", "Aggregation window: 24h, 7d, 4w, or a day count (1–90, default 7d)").option("--max-error-rate <ratio>", "Exit non-zero if the error rate exceeds this fraction (e.g. 0.05). For CI gates.").addHelpText("after", [
+    "",
+    "Exit codes:",
+    "  0   metrics fetched (and error rate within --max-error-rate if set)",
+    "  1   error rate exceeded --max-error-rate",
+    "",
+    "Examples:",
+    "  $ mcp metrics deployment dep_123 --since 24h",
+    "  $ mcp metrics deployment dep_123 --since 7d --max-error-rate 0.02",
+    "  $ mcp --json metrics deployment dep_123 | jq '.metrics.errorRate'"
+  ].join(`
+`)).action(runAction(async (deploymentId, opts) => {
+    const orgId = await resolveOrgId(opts.org);
+    const windowDays = parseWindowDays(opts.since);
+    const data = await api.get("/api/v1/deployment/metrics", {
+      organizationId: orgId,
+      deploymentId,
+      windowDays: String(windowDays)
+    });
+    let maxErrorRate = null;
+    if (opts.maxErrorRate !== undefined) {
+      const parsed = Number(opts.maxErrorRate);
+      if (!Number.isFinite(parsed) || parsed < 0 || parsed > 1) {
+        throw new Error(`Invalid --max-error-rate: ${opts.maxErrorRate}. Expected a fraction between 0 and 1.`);
+      }
+      maxErrorRate = parsed;
+    }
+    const errorRate = data.metrics.errorRate;
+    const breached = maxErrorRate !== null && errorRate !== null && errorRate > maxErrorRate;
+    if (isJsonMode()) {
+      printJson(data);
+      if (breached)
+        throw new CliExitError(1);
+      return;
+    }
+    const m2 = data.metrics;
+    printKeyValue({
+      deployment: `${data.deployment.serverName} (${data.deployment.id})`,
+      window: `${m2.windowDays}d (since ${formatDate(m2.windowStartedAt)})`,
+      requests: m2.totals.requestCount,
+      allowed: m2.totals.allowedCount,
+      "rate-limited": m2.totals.rateLimitedCount,
+      unauthorized: m2.totals.unauthorizedCount,
+      failed: m2.totals.failedCount,
+      "error rate": formatPercent(errorRate),
+      "avg duration": formatMs(m2.averageDurationMs),
+      "avg cpu": formatMs(m2.averageCpuTimeMs),
+      "last event": m2.lastEventAt ? formatDate(m2.lastEventAt) : "—"
+    });
+    if (breached)
+      throw new CliExitError(1);
+  }));
+}
+
+// src/commands/orgs.ts
+var ACCESS_STATES = ["active", "disabled", "all"];
+function registerOrgCommands(program2) {
+  const orgs = program2.command("orgs").description("List and inspect the organizations you belong to");
+  orgs.command("list").description("List organizations you can access").addHelpText("after", [
+    "",
+    "Examples:",
+    "  $ mcp orgs list",
+    "  $ mcp --json orgs list | jq '.organizations[].id'"
+  ].join(`
+`)).action(runAction(async () => {
+    const data = await api.get("/api/v1/organizations");
+    printList(data.organizations.map((org) => ({
+      id: org.id,
+      name: org.name ?? "—",
+      slug: org.slug ?? "—",
+      plan: org.plan ?? "—",
+      role: org.role,
+      default: org.isDefault || org.id === data.defaultOrganizationId ? "*" : ""
+    })), [
+      { key: "id", label: "ID", width: 22 },
+      { key: "name", label: "Name", width: 24 },
+      { key: "slug", label: "Slug", width: 18 },
+      { key: "plan", label: "Plan", width: 12 },
+      { key: "role", label: "Role", width: 10 },
+      { key: "default", label: "Default", width: 7 }
+    ], data);
+  }));
+  orgs.command("get [organizationId]").description("Show one organization (defaults to your active org)").action(runAction(async (organizationId) => {
+    const orgId = await resolveOrgId(organizationId);
+    const data = await api.get("/api/v1/organization", {
+      organizationId: orgId
+    });
+    if (isJsonMode()) {
+      printJson(data);
+      return;
+    }
+    const org = data.organization;
+    printKeyValue({
+      id: org.id,
+      name: org.name ?? "—",
+      slug: org.slug ?? "—",
+      plan: org.plan ?? "—",
+      "your role": org.role
+    });
+  }));
+  orgs.command("members [organizationId]").description("List members of an organization").option("--access-state <state>", `Filter: ${ACCESS_STATES.join(" | ")} (default active)`, "active").option("--limit <n>", "Maximum members (1–100, default 50)", "50").option("--cursor <cursor>", "Pagination cursor from a previous nextCursor").action(runAction(async (organizationId, opts) => {
+    const orgId = await resolveOrgId(organizationId);
+    const params = {
+      organizationId: orgId,
+      accessState: opts.accessState,
+      limit: opts.limit
+    };
+    if (opts.cursor)
+      params["cursor"] = opts.cursor;
+    const data = await api.get("/api/v1/organization/members", params);
+    printList(data.members.map((member) => ({
+      userId: member.userId,
+      name: member.name ?? "—",
+      email: member.email ?? "—",
+      role: member.role,
+      access: member.accessState
+    })), [
+      { key: "userId", label: "User ID", width: 22 },
+      { key: "name", label: "Name", width: 20 },
+      { key: "email", label: "Email", width: 28 },
+      { key: "role", label: "Role", width: 10 },
+      { key: "access", label: "Access", width: 10 }
+    ], data);
+  }));
+  orgs.command("usage [organizationId]").description("Show request-volume usage for an organization").option("--since <window>", "Aggregation window: 30d, 4w, or a day count (1–90, default 30d)").action(runAction(async (organizationId, opts) => {
+    const orgId = await resolveOrgId(organizationId);
+    const windowDays = parseWindowDays(opts.since);
+    const data = await api.get("/api/v1/organization/usage", { organizationId: orgId, windowDays: String(windowDays) });
+    if (isJsonMode()) {
+      printJson(data);
+      return;
+    }
+    const t = data.usage.totals;
+    printKeyValue({
+      organization: `${data.organization.name ?? "—"} (${data.organization.id})`,
+      window: `${data.usage.windowDays}d (since ${formatDate(data.usage.windowStartedAt)})`,
+      requests: t.requestCount,
+      allowed: t.allowedCount,
+      "rate-limited": t.rateLimitedCount,
+      unauthorized: t.unauthorizedCount,
+      failed: t.failedCount
+    });
+  }));
+  orgs.command("use <organizationId>").description("Set the default organization for this profile (discoverable alias of `mcp config set-org`)").action(runAction((organizationId) => {
+    const config = readConfig();
+    config.defaultOrganizationId = organizationId;
+    writeConfig(config);
+    if (isJsonMode()) {
+      printJson({ defaultOrganizationId: organizationId });
+      return;
+    }
+    printSuccess(`Default organization set to ${organizationId}`);
+  }));
 }
 
 // src/lib/plugins.ts
 import { spawn as spawn7 } from "node:child_process";
 import {
-  existsSync as existsSync35,
-  mkdirSync as mkdirSync16,
+  existsSync as existsSync36,
+  mkdirSync as mkdirSync17,
   readdirSync as readdirSync4,
-  readFileSync as readFileSync19,
+  readFileSync as readFileSync20,
   rmSync as rmSync3,
   statSync as statSync7
 } from "node:fs";
-import { join as join30 } from "node:path";
+import { join as join31 } from "node:path";
 import { pathToFileURL } from "node:url";
 function pluginsDir() {
-  return join30(configDir(), "plugins");
+  return join31(configDir(), "plugins");
 }
 function ensureDir2() {
   const dir = pluginsDir();
-  if (!existsSync35(dir))
-    mkdirSync16(dir, { recursive: true, mode: 448 });
+  if (!existsSync36(dir))
+    mkdirSync17(dir, { recursive: true, mode: 448 });
 }
 function readManifestFromPackageDir(packageDir) {
-  const pkgPath = join30(packageDir, "package.json");
-  if (!existsSync35(pkgPath))
+  const pkgPath = join31(packageDir, "package.json");
+  if (!existsSync36(pkgPath))
     return null;
   let pkg;
   try {
-    pkg = JSON.parse(readFileSync19(pkgPath, "utf-8"));
+    pkg = JSON.parse(readFileSync20(pkgPath, "utf-8"));
   } catch {
     return null;
   }
   if (!pkg.name)
     return null;
-  const relEntry = pkg.mcpsh?.register ?? pkg.main ?? "index.js";
-  const entry = join30(packageDir, relEntry);
-  if (!existsSync35(entry))
+  const relEntry = pkg.mcpsh?.register ?? pkg.mcp?.register ?? pkg.main ?? "index.js";
+  const entry = join31(packageDir, relEntry);
+  if (!existsSync36(entry))
     return null;
   return {
     name: pkg.name,
@@ -29747,11 +30864,11 @@ function readManifestFromPackageDir(packageDir) {
 }
 function listInstalledPlugins() {
   const dir = pluginsDir();
-  if (!existsSync35(dir))
+  if (!existsSync36(dir))
     return [];
   const out = [];
   for (const entry of readdirSync4(dir)) {
-    const full = join30(dir, entry);
+    const full = join31(dir, entry);
     let s;
     try {
       s = statSync7(full);
@@ -29762,7 +30879,7 @@ function listInstalledPlugins() {
       continue;
     if (entry.startsWith("@")) {
       for (const child of readdirSync4(full)) {
-        const m2 = readManifestFromPackageDir(join30(full, child));
+        const m2 = readManifestFromPackageDir(join31(full, child));
         if (m2)
           out.push(m2);
       }
@@ -29797,15 +30914,15 @@ async function loadPlugins(program2) {
 }
 var PACKAGE_SPEC_PATTERN = /^(@[a-z0-9~-][\w.~-]*\/)?[a-z0-9~-][\w.~-]*(@[-\w.^~><=*+|]+)?$/i;
 function runNpm(args, cwd) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const isWindows = process.platform === "win32";
     const child = spawn7(isWindows ? "npm.cmd" : "npm", args, {
       shell: isWindows,
       cwd,
       stdio: "inherit"
     });
-    child.on("close", (code) => resolve8(code ?? 1));
-    child.on("error", () => resolve8(1));
+    child.on("close", (code) => resolve9(code ?? 1));
+    child.on("error", () => resolve9(1));
   });
 }
 async function installPlugin(packageSpec) {
@@ -29826,12 +30943,12 @@ async function installPlugin(packageSpec) {
   if (code !== 0) {
     throw new Error(`npm install ${packageSpec} exited with code ${code}.`);
   }
-  const nm = join30(dir, "node_modules");
-  if (!existsSync35(nm)) {
+  const nm = join31(dir, "node_modules");
+  if (!existsSync36(nm)) {
     throw new Error(`npm install ran but produced no node_modules under ${dir}.`);
   }
   const baseName = packageSpec.replace(/@[^@/]+$/, "");
-  const candidatePath = baseName.startsWith("@") ? join30(nm, baseName.split("/")[0], baseName.split("/")[1] ?? "") : join30(nm, baseName);
+  const candidatePath = baseName.startsWith("@") ? join31(nm, baseName.split("/")[0], baseName.split("/")[1] ?? "") : join31(nm, baseName);
   const manifest = readManifestFromPackageDir(candidatePath);
   if (!manifest) {
     throw new Error(`Installed but could not read plugin manifest at ${candidatePath}.`);
@@ -29839,26 +30956,26 @@ async function installPlugin(packageSpec) {
   return { name: manifest.name, entry: manifest.entry };
 }
 function removePlugin(name) {
-  const nm = join30(pluginsDir(), "node_modules");
-  if (!existsSync35(nm))
+  const nm = join31(pluginsDir(), "node_modules");
+  if (!existsSync36(nm))
     return false;
-  const target = name.startsWith("@") ? join30(nm, name.split("/")[0], name.split("/")[1] ?? "") : join30(nm, name);
-  if (!existsSync35(target))
+  const target = name.startsWith("@") ? join31(nm, name.split("/")[0], name.split("/")[1] ?? "") : join31(nm, name);
+  if (!existsSync36(target))
     return false;
   rmSync3(target, { recursive: true, force: true });
   return true;
 }
 function listInstalledPluginsCombined() {
   const direct = listInstalledPlugins();
-  const nm = join30(pluginsDir(), "node_modules");
-  if (!existsSync35(nm))
+  const nm = join31(pluginsDir(), "node_modules");
+  if (!existsSync36(nm))
     return direct;
   const seen = new Set(direct.map((p2) => p2.name));
   const out = [...direct];
   for (const entry of readdirSync4(nm)) {
     if (entry === ".bin" || entry === ".package-lock.json")
       continue;
-    const full = join30(nm, entry);
+    const full = join31(nm, entry);
     let s;
     try {
       s = statSync7(full);
@@ -29869,7 +30986,7 @@ function listInstalledPluginsCombined() {
       continue;
     if (entry.startsWith("@")) {
       for (const child of readdirSync4(full)) {
-        const m2 = readManifestFromPackageDir(join30(full, child));
+        const m2 = readManifestFromPackageDir(join31(full, child));
         if (m2 && !seen.has(m2.name)) {
           seen.add(m2.name);
           out.push(m2);
@@ -29899,7 +31016,7 @@ function registerPluginCommands(program2) {
     "  {",
     '    "name": "mcpsh-plugin-foo",',
     '    "main": "index.js",',
-    '    "mcp": { "register": "index.js" }',
+    '    "mcpsh": { "register": "index.js" }',
     "  }",
     "",
     "  // index.js",
@@ -29908,7 +31025,11 @@ function registerPluginCommands(program2) {
     "      const orgs = await api.get('/api/v1/organizations')",
     "      console.log(orgs)",
     "    })",
-    "  }"
+    "  }",
+    "",
+    "Trust model: plugins run IN-PROCESS with the CLI — same API client, same",
+    "credentials, same filesystem access. Install only plugins you trust.",
+    '  (The legacy "mcp.register" key is still accepted for older plugins.)'
   ].join(`
 `));
   plugin.command("install <package>").description("Install a plugin from npm (uses npm under the hood)").addHelpText("after", [
@@ -30325,7 +31446,7 @@ function clipboardCandidatesFor(platform7, waylandDisplay) {
   return linux;
 }
 async function defaultIsExecutable(binary) {
-  return await new Promise((resolve8) => {
+  return await new Promise((resolve9) => {
     const isWin = process.platform === "win32";
     const cmd = isWin ? "where" : "command";
     const args = isWin ? [binary] : ["-v", binary];
@@ -30333,8 +31454,8 @@ async function defaultIsExecutable(binary) {
       shell: !isWin,
       stdio: "ignore"
     });
-    child.on("error", () => resolve8(false));
-    child.on("exit", (code) => resolve8(code === 0));
+    child.on("error", () => resolve9(false));
+    child.on("exit", (code) => resolve9(code === 0));
   });
 }
 async function detectClipboard(probe) {
@@ -30356,7 +31477,7 @@ async function copyToClipboard(text, probe) {
     };
   }
   const spawnImpl = probe?.spawnImpl ?? spawn8;
-  return await new Promise((resolve8) => {
+  return await new Promise((resolve9) => {
     const child = spawnImpl(candidate.binary, candidate.args, {
       stdio: ["pipe", "ignore", "pipe"]
     });
@@ -30365,7 +31486,7 @@ async function copyToClipboard(text, probe) {
       stderr += chunk.toString("utf-8");
     });
     child.on("error", (err) => {
-      resolve8({
+      resolve9({
         kind: "failed",
         binary: candidate.binary,
         message: err instanceof Error ? err.message : String(err)
@@ -30373,9 +31494,9 @@ async function copyToClipboard(text, probe) {
     });
     child.on("exit", (code) => {
       if (code === 0) {
-        resolve8({ kind: "ok", binary: candidate.binary });
+        resolve9({ kind: "ok", binary: candidate.binary });
       } else {
-        resolve8({
+        resolve9({
           kind: "failed",
           binary: candidate.binary,
           message: stderr.trim() || `${candidate.binary} exited with status ${code ?? "?"}`
@@ -30385,7 +31506,7 @@ async function copyToClipboard(text, probe) {
     try {
       child.stdin?.end(text);
     } catch (err) {
-      resolve8({
+      resolve9({
         kind: "failed",
         binary: candidate.binary,
         message: err instanceof Error ? err.message : String(err)
@@ -31455,12 +32576,12 @@ function displayValueFor(field, value) {
 
 // src/lib/tui/state-store.ts
 import {
-  existsSync as existsSync36,
-  mkdirSync as mkdirSync17,
-  readFileSync as readFileSync20,
-  writeFileSync as writeFileSync19
+  existsSync as existsSync37,
+  mkdirSync as mkdirSync18,
+  readFileSync as readFileSync21,
+  writeFileSync as writeFileSync20
 } from "node:fs";
-import { join as join31 } from "node:path";
+import { join as join32 } from "node:path";
 var ALL_TABS = [
   "servers",
   "projects",
@@ -31470,7 +32591,7 @@ var ALL_TABS = [
   "devSessions"
 ];
 function tuiStateFile() {
-  return join31(configDir(), "tui-state.json");
+  return join32(configDir(), "tui-state.json");
 }
 function isTab(v2) {
   return typeof v2 === "string" && ALL_TABS.includes(v2);
@@ -31535,11 +32656,11 @@ function sanitizeTuiState(input) {
 }
 function readTuiState() {
   const path = tuiStateFile();
-  if (!existsSync36(path))
+  if (!existsSync37(path))
     return {};
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync20(path, "utf-8"));
+    parsed = JSON.parse(readFileSync21(path, "utf-8"));
   } catch {
     return {};
   }
@@ -31547,10 +32668,10 @@ function readTuiState() {
 }
 function writeTuiState(state) {
   try {
-    if (!existsSync36(configDir())) {
-      mkdirSync17(configDir(), { recursive: true, mode: 448 });
+    if (!existsSync37(configDir())) {
+      mkdirSync18(configDir(), { recursive: true, mode: 448 });
     }
-    writeFileSync19(tuiStateFile(), JSON.stringify(state, null, 2), {
+    writeFileSync20(tuiStateFile(), JSON.stringify(state, null, 2), {
       encoding: "utf-8",
       mode: 384
     });
@@ -33555,7 +34676,7 @@ function registerUiCommand(program2) {
       }
       return false;
     };
-    await new Promise((resolve8) => {
+    await new Promise((resolve9) => {
       const flushAndExit = () => {
         try {
           if (persistTimer) {
@@ -33565,7 +34686,7 @@ function registerUiCommand(program2) {
           writeTuiState(snapshotForPersist());
         } catch {}
         shutdown(handles);
-        resolve8();
+        resolve9();
       };
       const executePaletteCommand = (id) => {
         if (id.startsWith("tab:")) {
@@ -34174,7 +35295,7 @@ function registerUiCommand(program2) {
 
 // src/commands/update.ts
 import { spawn as spawn9 } from "node:child_process";
-import { dirname as dirname10 } from "node:path";
+import { dirname as dirname11 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function detectInstallContext() {
   const override = process.env["MCPSH_PACKAGE_MANAGER"]?.trim().toLowerCase();
@@ -34187,7 +35308,7 @@ function detectInstallContext() {
   }
   const here = (() => {
     try {
-      return dirname10(fileURLToPath2(import.meta.url));
+      return dirname11(fileURLToPath2(import.meta.url));
     } catch {
       return process.argv[1] ?? "";
     }
@@ -34235,10 +35356,10 @@ function buildCommand(manager) {
   }
 }
 function runShell(command) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const child = spawn9(command, { shell: true, stdio: "inherit" });
-    child.on("close", (code) => resolve8(code ?? 1));
-    child.on("error", () => resolve8(1));
+    child.on("close", (code) => resolve9(code ?? 1));
+    child.on("error", () => resolve9(1));
   });
 }
 function registerUpdateCommand(program2) {
@@ -34304,12 +35425,14 @@ function registerUpdateCommand(program2) {
 // src/create-program.ts
 function createProgram() {
   const program2 = new Command;
-  program2.name("mcp").description("The official CLI for MCPCloud — manage projects, MCP servers, skills, and API keys from the terminal").version(getCliVersion(), "-v, --version", "Print the CLI version").option("--json", "Output raw JSON (useful for scripting)").option("--base-url <url>", "API base URL for this invocation. Falls back to MCPCLOUD_BASE_URL or `mcp config set-url`.").option("--profile <name>", "Run against a named config profile for this invocation (overrides MCPCLOUD_PROFILE and the saved current profile).").option("--ci", "Force CI mode for this invocation. Auto-detected when CI=true. Disables color, swaps Unicode glyphs for ASCII, refuses interactive prompts, and always surfaces request IDs.").option("--warnings-as-errors", "Exit non-zero if any warning is emitted during the command (CI ergonomics).").option("--format <mode>", "Output format for list commands: table (default), tsv, jsonl, json.").option("--no-table", "Shorthand for --format tsv. Tab-separated rows for awk/cut/grep pipelines.").option("--field <names>", "Comma-separated list of fields to include in list output (repeatable).", (value, prev) => prev ? [...prev, value] : [value]).option("--filter <key=substring>", "Substring filter for list rows (repeatable). Case-insensitive.", (value, prev) => prev ? [...prev, value] : [value]).option("--idempotency-key <key>", "Stable Idempotency-Key for mutations (1–255 ASCII chars, no whitespace). When omitted, the CLI auto-generates a UUID per invocation so internal retries on transient failures stay safe.").option("--debug", "Print every HTTP request/response with secrets redacted. Equivalent to MCPCLOUD_LOG=debug.").hook("preAction", (thisCommand) => {
+  program2.name("mcp").description("The official CLI for MCPCloud — manage projects, MCP servers, skills, and API keys from the terminal").version(getCliVersion(), "-v, --version", "Print the CLI version").option("--json", "Output raw JSON (useful for scripting)").option("--base-url <url>", "API base URL for this invocation. Falls back to MCPCLOUD_BASE_URL or `mcp config set-url`.").option("--profile <name>", "Run against a named config profile for this invocation (overrides MCPCLOUD_PROFILE and the saved current profile).").option("--ci", "Force CI mode for this invocation. Auto-detected when CI=true. Disables color, swaps Unicode glyphs for ASCII, refuses interactive prompts, and always surfaces request IDs.").option("--warnings-as-errors", "Exit non-zero if any warning is emitted during the command (CI ergonomics).").option("--non-interactive", "Refuse interactive prompts (fail fast on missing input) without the color/glyph changes of --ci.").option("--quiet", "Suppress success/step/info chrome; data and errors still print. Pairs with exit codes for health/existence gates.").option("--format <mode>", "Output format for list commands: table (default), tsv, jsonl, json.").option("--no-table", "Shorthand for --format tsv. Tab-separated rows for awk/cut/grep pipelines.").option("--field <names>", "Comma-separated list of fields to include in list output (repeatable).", (value, prev) => prev ? [...prev, value] : [value]).option("--filter <key=substring>", "Substring filter for list rows (repeatable). Case-insensitive.", (value, prev) => prev ? [...prev, value] : [value]).option("--idempotency-key <key>", "Stable Idempotency-Key for mutations (1–255 ASCII chars, no whitespace). When omitted, the CLI auto-generates a UUID per invocation so internal retries on transient failures stay safe.").option("--debug", "Print every HTTP request/response with secrets redacted. Equivalent to MCPCLOUD_LOG=debug.").hook("preAction", (thisCommand) => {
     const opts = thisCommand.optsWithGlobals();
     setJsonMode(Boolean(opts.json));
     setBaseUrlOverride(opts.baseUrl);
     setProfileOverride(opts.profile);
     setCiMode(Boolean(opts.ci) || isCiEnv());
+    setNonInteractive(Boolean(opts.nonInteractive));
+    setQuiet(Boolean(opts.quiet));
     setWarningsAsErrors(Boolean(opts.warningsAsErrors));
     setListFormat(opts.format);
     setNoTable(opts.table === false);
@@ -34347,6 +35470,9 @@ function createProgram() {
   registerSkillCommands(program2);
   registerApiKeyCommands(program2);
   registerDeploymentCommands(program2);
+  registerOrgCommands(program2);
+  registerUsageCommands(program2);
+  registerMetricsCommands(program2);
   registerDevCommand(program2);
   registerCompletionCommand(program2);
   registerDoctorCommand(program2);