@muxoai/cli 0.1.0 → 0.1.1

package/README.md

@@ -34,6 +34,7 @@ muxo plan                  Server-side diff → ordered op list
 muxo apply                 Push manifest, snapshot version
 muxo add <bundle>          Append a bundle stanza
 muxo run <workflow>        Execute a workflow one-shot
+muxo call <capability>     Invoke a capability directly
 muxo status                Project, bundles, budget
 muxo keys list|create|rotate|revoke
 muxo credits balance|packs|buy <pack>

package/dist/index.js

@@ -4,8 +4,148 @@
 import { Command } from "commander";
 
 // src/commands/init.ts
-import { access, writeFile } from "node:fs/promises";
+import { access, mkdir as mkdir2, writeFile as writeFile2 } from "node:fs/promises";
 import { basename } from "node:path";
+import { validateManifest } from "@muxoai/core";
+
+// src/lib/api.ts
+async function request(opts, method, path, body) {
+  if (opts.debug) {
+    console.error(`muxo: ${method} ${opts.baseUrl}${path}`);
+  }
+  let res;
+  try {
+    res = await fetch(`${opts.baseUrl}${path}`, {
+      method,
+      headers: {
+        ...opts.key ? { authorization: `Bearer ${opts.key}` } : {},
+        "content-type": "application/json"
+      },
+      body: body === void 0 ? void 0 : JSON.stringify(body)
+    });
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    return {
+      ok: false,
+      error: {
+        code: "internal",
+        message: `network error reaching ${opts.baseUrl}${path}: ${reason}. Check your connection and retry (default endpoint: https://api.muxo.ai/v1)`
+      }
+    };
+  }
+  try {
+    const envelope = await res.json();
+    if (!envelope.ok && res.status === 401 && opts.key === void 0) {
+      return {
+        ok: false,
+        error: {
+          code: envelope.error.code,
+          message: `${envelope.error.message} \u2014 no key found: run \`muxo keys create\` for a free one, or set MUXO_KEY`
+        }
+      };
+    }
+    return envelope;
+  } catch {
+    return {
+      ok: false,
+      error: { code: "internal", message: `muxo returned HTTP ${res.status} with a non-JSON body` }
+    };
+  }
+}
+function makeApi(opts) {
+  return {
+    get: (path) => request(opts, "GET", path),
+    post: (path, body) => request(opts, "POST", path, body),
+    put: (path, body) => request(opts, "PUT", path, body),
+    del: (path) => request(opts, "DELETE", path)
+  };
+}
+
+// src/lib/config.ts
+import { readFile as readFile2 } from "node:fs/promises";
+
+// src/lib/keychain.ts
+import { execFile } from "node:child_process";
+import { chmod, mkdir, readFile, unlink, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { promisify } from "node:util";
+var run = promisify(execFile);
+var SERVICE = "muxo";
+var ACCOUNT = "muxo-key";
+var KEY_FILE = join(homedir(), ".muxo", "key");
+async function keychainGet() {
+  if (process.platform === "darwin") {
+    try {
+      const { stdout } = await run("security", [
+        "find-generic-password",
+        "-s",
+        SERVICE,
+        "-a",
+        ACCOUNT,
+        "-w"
+      ]);
+      const key = stdout.trim();
+      if (key) return key;
+    } catch {
+    }
+  }
+  try {
+    const key = (await readFile(KEY_FILE, "utf8")).trim();
+    return key || void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function keychainSet(key) {
+  if (process.platform === "darwin") {
+    try {
+      await run("security", [
+        "add-generic-password",
+        "-U",
+        "-s",
+        SERVICE,
+        "-a",
+        ACCOUNT,
+        "-w",
+        key
+      ]);
+      return "keychain";
+    } catch {
+    }
+  }
+  await mkdir(dirname(KEY_FILE), { recursive: true });
+  await writeFile(KEY_FILE, `${key}
+`, { mode: 384 });
+  await chmod(KEY_FILE, 384);
+  return "file";
+}
+
+// src/lib/config.ts
+var DEFAULT_BASE_URL = "https://api.muxo.ai/v1";
+function normalizeBaseUrl(raw) {
+  const trimmed = raw.trim().replace(/\/+$/, "");
+  if (trimmed === "") return DEFAULT_BASE_URL;
+  return /\/v1$/.test(trimmed) ? trimmed : `${trimmed}/v1`;
+}
+function baseUrl() {
+  return normalizeBaseUrl(process.env.MUXO_API_BASE || DEFAULT_BASE_URL);
+}
+async function resolveKey() {
+  if (process.env.MUXO_KEY) return process.env.MUXO_KEY;
+  return keychainGet();
+}
+var MANIFEST_FILES = ["muxo.yaml", "muxo.muxo", ".muxo/muxo.yaml"];
+async function readManifestText() {
+  for (const file of MANIFEST_FILES) {
+    try {
+      return await readFile2(file, "utf8");
+    } catch {
+      continue;
+    }
+  }
+  return void 0;
+}
 
 // src/lib/templates.ts
 import { stringify } from "yaml";
@@ -18,6 +158,8 @@ var KNOWN_BUNDLES = [
   { name: "compute", capabilities: ["compute.sandbox", "compute.container"] },
   { name: "deploy", capabilities: ["deploy.site", "deploy.container", "deploy.edge"] },
   { name: "domains", capabilities: ["domains.register", "dns.manage"] },
+  { name: "data", capabilities: ["db.write", "db.query"] },
+  { name: "kv", capabilities: ["kv.store"] },
   { name: "storage", capabilities: ["storage.object", "vector.search"] },
   { name: "ops", capabilities: ["observability.log", "queue.emit", "email.send"] }
 ];
@@ -30,28 +172,50 @@ var webIntel = {
 var llm = {
   bundles: { llm: { capabilities: ["llm.chat", "llm.embed"] } }
 };
+var deploySite = {
+  bundles: { deploy: { capabilities: ["deploy.site", "deploy.edge"] } }
+};
+var storage = {
+  bundles: { storage: { capabilities: ["storage.object", "vector.search"] } }
+};
+var data = {
+  bundles: { data: { capabilities: ["db.write", "db.query"] } }
+};
+var kv = {
+  bundles: { kv: { capabilities: ["kv.store"] } }
+};
+var ops = {
+  bundles: { ops: { capabilities: ["observability.log", "queue.emit", "email.send"] } }
+};
+var compute = {
+  bundles: { compute: { capabilities: ["compute.sandbox", "compute.container"] } }
+};
+var browser = {
+  bundles: { browser: { capabilities: ["browser.drive"] } }
+};
+var domains = {
+  bundles: { domains: { capabilities: ["domains.register", "dns.manage"] } }
+};
 var priceRadar = {
-  bundles: { "web-intel": { capabilities: ["web.search", "web.scrape", "web.extract"] } },
+  bundles: {
+    "web-intel": { capabilities: ["web.search", "web.scrape"] }
+  },
   workflows: {
     "daily-prices": {
       on: { schedule: "0 6 * * *" },
       steps: [
-        { search: { cap: "web.search", query: "competitor pricing", into: "results" } },
-        { scrape: { cap: "web.scrape", urls: "${results.urls}", into: "pages" } },
+        // web.search resolves to an array of {url, title, markdown}
+        { search: { cap: "web.search", query: "competitor pricing", limit: 5, into: "results" } },
+        // fan out: scrape each result page
         {
-          extract: {
-            cap: "web.extract",
-            from: "pages",
-            schema: { product: "str", price: "num" },
-            into: "prices"
+          each: {
+            over: "${results}",
+            as: "item",
+            steps: [{ scrape: { cap: "web.scrape", url: "${item.url}", into: "page" } }]
           }
-        },
-        { store: { cap: "db.write", into: "stack.database.main.prices" } }
+        }
       ]
     }
-  },
-  stack: {
-    database: { main: { provider: "neon", service: "postgres" } }
   }
 };
 function slugify(name) {
@@ -77,34 +241,63 @@ function matchTemplate(intent) {
   const lower = intent.toLowerCase();
   const bundles = {};
   let workflows;
-  let stack;
-  let schedule = detectSchedule(intent);
+  const schedule = detectSchedule(intent);
   if (/\bprice|pricing\b/.test(lower)) {
     return priceRadar;
   }
-  if (/track|monitor|scrape|search|extract|crawl|web|news|hacker|hn/.test(lower)) {
+  if (/\bhost(ing)?\b|\bdeploy|\blanding\b|\bwebsite\b|web ?site|static site|\bpublish\b|\bserve\b/.test(lower)) {
+    Object.assign(bundles, deploySite.bundles);
+  }
+  if (/\btrack|monitor|scrape|search|extract|crawl|\bweb\b|news|hacker|\bhn\b/.test(lower)) {
     Object.assign(bundles, webIntel.bundles);
   }
-  if (/chat|llm|summar|embed|\bai\b/.test(lower)) {
+  if (/\bchat|llm|summar|embed|\bai\b|assistant|generate\b/.test(lower)) {
     Object.assign(bundles, llm.bundles);
   }
-  if (/store|database|db|postgres|save\b/.test(lower)) {
-    stack = { database: { main: { provider: "neon", service: "postgres" } } };
+  if (/\bstore|save|database|postgres|sql|record|table\b/.test(lower)) {
+    Object.assign(bundles, data.bundles);
+  }
+  if (/\bkv|cache|config|settings|feature flag\b/.test(lower)) {
+    Object.assign(bundles, kv.bundles);
+  }
+  if (/\bupload|\bfile|asset|object|bucket\b/.test(lower)) {
+    Object.assign(bundles, storage.bundles);
+  }
+  if (/\bvector|embedding|semantic|similarity|\brag\b|recommend\b/.test(lower)) {
+    Object.assign(bundles, storage.bundles);
   }
-  if (schedule !== void 0 && Object.keys(bundles).length > 0) {
+  if (/\bemail|notif|alert|notify|\bmail\b/.test(lower)) {
+    Object.assign(bundles, ops.bundles);
+  }
+  if (/\bsandbox|execute|run code|compute|container|docker|\bcode\b/.test(lower)) {
+    Object.assign(bundles, compute.bundles);
+  }
+  if (/\bbrowser|automate|click|login form|\bform\b/.test(lower)) {
+    Object.assign(bundles, browser.bundles);
+  }
+  if (/\bdomain|\bdns\b/.test(lower)) {
+    Object.assign(bundles, domains.bundles);
+  }
+  if (schedule !== void 0 && bundles["web-intel"] !== void 0) {
     const topic = (lower.match(/[a-z][a-z-]{3,}/)?.[0] ?? "watch").slice(0, 20);
     workflows = {
       [`${topic.replace(/-+$/, "")}-watch`]: {
         on: { schedule },
         steps: [
           { search: { cap: "web.search", query: intent.slice(0, 80), limit: 3, into: "results" } },
-          { log: { cap: "observability.log", level: "info", message: "found ${results.count} results" } }
+          {
+            each: {
+              over: "${results}",
+              as: "item",
+              steps: [{ scrape: { cap: "web.scrape", url: "${item.url}", into: "page" } }]
+            }
+          }
         ]
       }
     };
   }
   if (Object.keys(bundles).length === 0) return { bundles: {} };
-  return { bundles, workflows, stack };
+  return { bundles, workflows };
 }
 function renderManifest(project, description, tpl) {
   const doc = {
@@ -177,102 +370,93 @@ async function exists(path) {
     return false;
   }
 }
+function landingPage(title) {
+  return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>${title}</title>
+    <style>
+      :root { color-scheme: dark; }
+      body { margin: 0; min-height: 100vh; display: grid; place-items: center;
+             font-family: ui-sans-serif, system-ui, -apple-system, sans-serif;
+             background: #0b0b12; color: #f5f5f7; }
+      main { text-align: center; padding: 2rem; }
+      h1 { font-size: clamp(2rem, 6vw, 4rem); margin: 0 0 0.5rem; }
+      p { color: #a1a1aa; margin: 0; }
+    </style>
+  </head>
+  <body>
+    <main>
+      <h1>${title}</h1>
+      <p>Deployed with muxo.</p>
+    </main>
+  </body>
+</html>
+`;
+}
+async function architectManifest(intent, project, opts) {
+  const key = await resolveKey();
+  if (key === void 0) return void 0;
+  const api = makeApi({ baseUrl: baseUrl(), key, debug: opts.debug });
+  const res = await api.post("/architect", { intent, project });
+  if (!res.ok) return void 0;
+  const data2 = res.data;
+  if (typeof data2?.yaml !== "string" || data2.yaml.trim() === "") return void 0;
+  return { yaml: data2.yaml, source: "architect" };
+}
 async function init(intent, opts) {
   if (await exists("muxo.yaml")) {
     console.error("error: muxo.yaml already exists in this directory");
     return 1;
   }
-  const it = intent ?? "";
-  const tpl = matchTemplate(it);
+  const it = (intent ?? "").trim();
   const project = slugify(basename(process.cwd()));
-  const text = renderManifest(project, it, tpl);
-  await writeFile("muxo.yaml", text, "utf8");
-  info("wrote muxo.yaml", opts);
-  nextSteps(["muxo validate", "muxo plan", "muxo apply", "muxo run <workflow>  # or wait for the cron schedule", "muxo logs             # watch executions"], opts);
-  return 0;
-}
-
-// src/lib/config.ts
-import { readFile as readFile2 } from "node:fs/promises";
-
-// src/lib/keychain.ts
-import { execFile } from "node:child_process";
-import { chmod, mkdir, readFile, unlink, writeFile as writeFile2 } from "node:fs/promises";
-import { homedir } from "node:os";
-import { dirname, join } from "node:path";
-import { promisify } from "node:util";
-var run = promisify(execFile);
-var SERVICE = "muxo";
-var ACCOUNT = "muxo-key";
-var KEY_FILE = join(homedir(), ".muxo", "key");
-async function keychainGet() {
-  if (process.platform === "darwin") {
+  let text;
+  let source = "template";
+  if (it !== "") {
     try {
-      const { stdout } = await run("security", [
-        "find-generic-password",
-        "-s",
-        SERVICE,
-        "-a",
-        ACCOUNT,
-        "-w"
-      ]);
-      const key = stdout.trim();
-      if (key) return key;
+      const designed = await architectManifest(it, project, opts);
+      if (designed !== void 0) {
+        text = designed.yaml;
+        source = designed.source;
+      }
     } catch {
     }
   }
-  try {
-    const key = (await readFile(KEY_FILE, "utf8")).trim();
-    return key || void 0;
-  } catch {
-    return void 0;
+  const tpl = matchTemplate(it);
+  if (text === void 0) text = renderManifest(project, it, tpl);
+  await writeFile2("muxo.yaml", text, "utf8");
+  info(`wrote muxo.yaml${source === "architect" ? " (designed by the muxo architect)" : ""}`, opts);
+  const parsed = validateManifest(text);
+  const bundles = parsed.ok && parsed.manifest !== void 0 ? Object.keys(parsed.manifest.bundles ?? {}) : Object.keys(tpl.bundles);
+  if (bundles.length > 0) {
+    info(`bundles: ${bundles.join(", ")}`, opts);
+  } else {
+    info("no bundles yet \u2014 add one with `muxo add <bundle>`", opts);
   }
-}
-async function keychainSet(key) {
-  if (process.platform === "darwin") {
-    try {
-      await run("security", [
-        "add-generic-password",
-        "-U",
-        "-s",
-        SERVICE,
-        "-a",
-        ACCOUNT,
-        "-w",
-        key
-      ]);
-      return "keychain";
-    } catch {
-    }
+  const hasDeploy = parsed.ok && parsed.manifest !== void 0 ? Object.values(parsed.manifest.bundles ?? {}).some((b) => b.capabilities.includes("deploy.site")) : tpl.bundles.deploy !== void 0;
+  let scaffolded = false;
+  if (hasDeploy && !await exists("public/index.html")) {
+    await mkdir2("public", { recursive: true });
+    await writeFile2("public/index.html", landingPage(project), "utf8");
+    info("wrote public/index.html", opts);
+    scaffolded = true;
   }
-  await mkdir(dirname(KEY_FILE), { recursive: true });
-  await writeFile2(KEY_FILE, `${key}
-`, { mode: 384 });
-  await chmod(KEY_FILE, 384);
-  return "file";
-}
-
-// src/lib/config.ts
-var DEFAULT_BASE_URL = "https://api.muxo.ai/v1";
-var LOCAL_BASE_URL = "http://localhost:8787/v1";
-function baseUrl(local) {
-  if (local) return LOCAL_BASE_URL;
-  return process.env.MUXO_API_BASE || DEFAULT_BASE_URL;
-}
-async function resolveKey() {
-  if (process.env.MUXO_KEY) return process.env.MUXO_KEY;
-  return keychainGet();
-}
-var MANIFEST_FILES = ["muxo.yaml", "muxo.muxo", ".muxo/muxo.yaml"];
-async function readManifestText() {
-  for (const file of MANIFEST_FILES) {
-    try {
-      return await readFile2(file, "utf8");
-    } catch {
-      continue;
-    }
+  const steps = ["muxo validate", "muxo plan", "muxo apply"];
+  const workflowNames = parsed.ok && parsed.manifest !== void 0 ? Object.keys(parsed.manifest.workflows ?? {}) : Object.keys(tpl.workflows ?? {});
+  if (workflowNames.length > 0) {
+    steps.push(`muxo run ${workflowNames[0]}`, "muxo logs             # watch executions");
   }
-  return void 0;
+  if (hasDeploy) {
+    steps.push("muxo keys create      # a key scoped to this manifest");
+    steps.push(`muxo deploy ${scaffolded ? "public" : "<dir>"}       # upload the site \u2192 live URL`);
+  } else if (workflowNames.length === 0) {
+    steps.push("muxo status           # confirm the applied state");
+  }
+  nextSteps(steps, opts);
+  return 0;
 }
 
 // src/commands/validate.ts
@@ -330,7 +514,7 @@ var manifestSchema = z.object({
   }).optional(),
   workflows: z.record(workflow).optional()
 }).strict();
-function validateManifest(text) {
+function validateManifest2(text) {
   let doc;
   try {
     doc = parseYaml(text);
@@ -381,20 +565,32 @@ function validateManifest(text) {
 }
 
 // src/commands/validate.ts
+var ZERO_USAGE = { credits: 0, provider: "muxo", latency_ms: 0 };
 async function validate(opts) {
   const text = await readManifestText();
   if (text === void 0) {
-    const err = [{ path: "", message: "no muxo.yaml found in this directory" }];
-    if (opts.json) printJson(err);
-    else console.error(`error: ${err[0].message}`);
+    const message = "no muxo.yaml found in this directory";
+    if (opts.json) {
+      printJson({ ok: false, error: { code: "not_found", message } });
+    } else {
+      console.error(`error: ${message}`);
+    }
     return 1;
   }
   const issues = [
     ...coreValidate(text).errors.map((e) => ({ path: e.path, message: e.message + (e.hint ? ` (${e.hint})` : "") })),
-    ...validateManifest(text)
+    ...validateManifest2(text)
   ];
   if (opts.json) {
-    printJson(issues);
+    if (issues.length === 0) {
+      printJson({ ok: true, data: { valid: true, issues: [] }, usage: ZERO_USAGE });
+    } else {
+      printJson({
+        ok: false,
+        error: { code: "invalid_manifest", message: `muxo.yaml is invalid (${issues.length} issue${issues.length === 1 ? "" : "s"})` },
+        data: { valid: false, issues }
+      });
+    }
   } else if (issues.length === 0) {
     if (!opts.quiet) console.log("muxo.yaml is valid");
   } else {
@@ -405,49 +601,6 @@ async function validate(opts) {
   return issues.length > 0 ? 1 : 0;
 }
 
-// src/lib/api.ts
-async function request(opts, method, path, body) {
-  if (opts.debug) {
-    console.error(`muxo: ${method} ${opts.baseUrl}${path}`);
-  }
-  let res;
-  try {
-    res = await fetch(`${opts.baseUrl}${path}`, {
-      method,
-      headers: {
-        ...opts.key ? { authorization: `Bearer ${opts.key}` } : {},
-        "content-type": "application/json"
-      },
-      body: body === void 0 ? void 0 : JSON.stringify(body)
-    });
-  } catch (err) {
-    const reason = err instanceof Error ? err.message : String(err);
-    return {
-      ok: false,
-      error: {
-        code: "internal",
-        message: `network error reaching ${opts.baseUrl}${path}: ${reason}. If this is your first run, set MUXO_API_BASE to your runtime URL (e.g. export MUXO_API_BASE=https://api.muxo.ai/v1)`
-      }
-    };
-  }
-  try {
-    return await res.json();
-  } catch {
-    return {
-      ok: false,
-      error: { code: "internal", message: `muxo returned HTTP ${res.status} with a non-JSON body` }
-    };
-  }
-}
-function makeApi(opts) {
-  return {
-    get: (path) => request(opts, "GET", path),
-    post: (path, body) => request(opts, "POST", path, body),
-    put: (path, body) => request(opts, "PUT", path, body),
-    del: (path) => request(opts, "DELETE", path)
-  };
-}
-
 // src/commands/plan.ts
 async function plan(opts) {
   const text = await readManifestText();
@@ -456,15 +609,15 @@ async function plan(opts) {
     return 1;
   }
   const api = makeApi({
-    baseUrl: baseUrl(opts.local),
+    baseUrl: baseUrl(),
     key: await resolveKey(),
     debug: opts.debug
   });
   const env = await api.post("/plan", { yaml: text });
-  return renderEnvelope(env, !!opts.json, (data) => {
-    const ops = data?.ops;
-    if (Array.isArray(ops)) {
-      if (ops.length === 0) {
+  return renderEnvelope(env, !!opts.json, (data2) => {
+    const ops2 = data2?.ops;
+    if (Array.isArray(ops2)) {
+      if (ops2.length === 0) {
         console.log("no changes \u2014 manifest matches the deployed state");
         return;
       }
@@ -477,16 +630,16 @@ async function plan(opts) {
         deprovision: "-",
         noop: "!"
       };
-      ops.forEach((op, i) => {
+      ops2.forEach((op, i) => {
         const icon = ICONS[op.kind] ?? "\xB7";
         const label = op.detail !== void 0 && op.detail !== "" ? `${op.ref}: ${op.detail}` : op.ref;
         console.log(`${i + 1}. ${icon} ${label}`);
       });
-      const removes = ops.filter((o) => o.kind === "deprovision").length;
+      const removes = ops2.filter((o) => o.kind === "deprovision").length;
       if (removes > 0) console.log(`
 \u26A0 ${removes} deprovision op(s) \u2014 apply will remove these resources`);
     } else {
-      console.log(JSON.stringify(data, null, 2));
+      console.log(JSON.stringify(data2, null, 2));
     }
   });
 }
@@ -497,16 +650,16 @@ async function apply(opts) {
     return 1;
   }
   const api = makeApi({
-    baseUrl: baseUrl(opts.local),
+    baseUrl: baseUrl(),
     key: await resolveKey(),
     debug: opts.debug
   });
   const env = await api.put("/manifest", { yaml: text });
-  return renderEnvelope(env, !!opts.json, (data) => {
-    const d = data;
+  return renderEnvelope(env, !!opts.json, (data2) => {
+    const d = data2;
     const version = d?.version !== void 0 ? ` version ${d.version}` : "";
-    const ops = Array.isArray(d?.ops) ? ` (${d.ops.length} ops)` : "";
-    console.log(`applied${version}${ops}`);
+    const ops2 = Array.isArray(d?.ops) ? ` (${d.ops.length} ops)` : "";
+    console.log(`applied${version}${ops2}`);
     if (Array.isArray(d?.ops)) {
       d.ops.forEach((op, i) => {
         const label = typeof op === "string" ? op : JSON.stringify(op);
@@ -559,21 +712,7 @@ async function add(bundleName, opts) {
   return 0;
 }
 
-// src/commands/run.ts
-function printSteps(data) {
-  const d = data;
-  if (d?.execution_id !== void 0) console.log(`execution ${String(d.execution_id)}`);
-  if (Array.isArray(d?.steps)) {
-    for (const step of d.steps) {
-      const name = typeof step?.name === "string" ? step.name : "step";
-      const status2 = typeof step?.status === "string" ? step.status : JSON.stringify(step);
-      console.log(`  ${name}: ${status2}`);
-      if (step?.error !== void 0) console.log(`    ${JSON.stringify(step.error)}`);
-    }
-    return;
-  }
-  console.log(JSON.stringify(data, null, 2));
-}
+// src/lib/params.ts
 function coerceParam(value) {
   if (value === "true") return true;
   if (value === "false") return false;
@@ -589,9 +728,125 @@ function parseParams(raw) {
   }
   return params;
 }
+
+// src/commands/call.ts
+async function call(capability, opts) {
+  let input = {};
+  if (opts.data !== void 0) {
+    try {
+      const parsed = JSON.parse(opts.data);
+      if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        console.error("error: --data must be a JSON object");
+        return 1;
+      }
+      input = parsed;
+    } catch (e) {
+      console.error(`error: --data is not valid JSON: ${e instanceof Error ? e.message : String(e)}`);
+      return 1;
+    }
+  }
+  try {
+    input = { ...input, ...parseParams(opts.param) };
+  } catch (e) {
+    console.error(`error: ${e instanceof Error ? e.message : String(e)}`);
+    return 1;
+  }
+  const api = makeApi({
+    baseUrl: baseUrl(),
+    key: await resolveKey(),
+    debug: opts.debug
+  });
+  const env = await api.post(`/capabilities/${capability}`, input);
+  return renderEnvelope(env, !!opts.json, (data2) => printJson(data2));
+}
+
+// src/commands/deploy.ts
+import { access as access2, readdir, readFile as readFile4 } from "node:fs/promises";
+import { join as join2, relative, sep } from "node:path";
+async function exists2(path) {
+  try {
+    await access2(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function collectFiles(dir) {
+  const out = {};
+  async function walk(current) {
+    for (const entry of await readdir(current, { withFileTypes: true })) {
+      if (entry.name.startsWith(".")) continue;
+      const full = join2(current, entry.name);
+      if (entry.isDirectory()) {
+        await walk(full);
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      const rel = relative(dir, full).split(sep).join("/");
+      out[`/${rel}`] = await readFile4(full, "utf8");
+    }
+  }
+  await walk(dir);
+  return out;
+}
+async function deploy(dirArg, opts) {
+  let dir = dirArg;
+  if (dir === void 0) {
+    for (const candidate of ["public", "dist", "build", "out"]) {
+      if (await exists2(candidate)) {
+        dir = candidate;
+        break;
+      }
+    }
+  }
+  if (dir === void 0 || !await exists2(dir)) {
+    console.error(`error: no site directory found${dir !== void 0 ? ` at "${dir}"` : ""} \u2014 pass one: muxo deploy <dir>`);
+    return 1;
+  }
+  const files = await collectFiles(dir);
+  const count = Object.keys(files).length;
+  if (count === 0) {
+    console.error(`error: "${dir}" is empty`);
+    return 1;
+  }
+  if (!opts.quiet && !opts.json) console.error(`deploying ${count} file(s) from ${dir}\u2026`);
+  const api = makeApi({
+    baseUrl: baseUrl(),
+    key: await resolveKey(),
+    debug: opts.debug
+  });
+  const env = await api.post("/capabilities/deploy.site", {
+    files,
+    ...opts.target !== void 0 ? { target: opts.target } : {}
+  });
+  return renderEnvelope(env, !!opts.json, (data2) => {
+    const d = data2;
+    if (typeof d?.url === "string" && d.url !== "") {
+      console.log(`deployed: ${d.url}`);
+      return;
+    }
+    console.log(JSON.stringify(data2, null, 2));
+  });
+}
+
+// src/commands/run.ts
+function printSteps(data2) {
+  const d = data2;
+  if (d?.execution_id !== void 0) console.log(`execution ${String(d.execution_id)}`);
+  if (Array.isArray(d?.steps)) {
+    for (const step of d.steps) {
+      const name = typeof step?.name === "string" ? step.name : "step";
+      const status2 = typeof step?.status === "string" ? step.status : JSON.stringify(step);
+      console.log(`  ${name}: ${status2}`);
+      if (step?.error !== void 0) console.log(`    ${JSON.stringify(step.error)}`);
+    }
+    return;
+  }
+  console.log(JSON.stringify(data2, null, 2));
+}
 async function run2(workflow2, opts) {
   const api = makeApi({
-    baseUrl: baseUrl(opts.local),
+    baseUrl: baseUrl(),
     key: await resolveKey(),
     debug: opts.debug
   });
@@ -621,13 +876,13 @@ async function run2(workflow2, opts) {
 }
 async function status(opts) {
   const api = makeApi({
-    baseUrl: baseUrl(opts.local),
+    baseUrl: baseUrl(),
     key: await resolveKey(),
     debug: opts.debug
   });
   const env = await api.get("/status");
-  return renderEnvelope(env, !!opts.json, (data) => {
-    const d = data;
+  return renderEnvelope(env, !!opts.json, (data2) => {
+    const d = data2;
     if (d && typeof d === "object" && !Array.isArray(d)) {
       if (d.project !== void 0) console.log(`project: ${String(d.project)}`);
       if (d.version !== void 0) console.log(`version: ${String(d.version)}`);
@@ -640,31 +895,31 @@ async function status(opts) {
       if (d.drift !== void 0) console.log(`drift: ${JSON.stringify(d.drift)}`);
       return;
     }
-    console.log(JSON.stringify(data, null, 2));
+    console.log(JSON.stringify(data2, null, 2));
   });
 }
 async function rollback(version, opts) {
   const api = makeApi({
-    baseUrl: baseUrl(opts.local),
+    baseUrl: baseUrl(),
     key: await resolveKey(),
     debug: opts.debug
   });
   const body = version === void 0 ? {} : { version: Number(version) };
   const env = await api.post("/rollback", body);
-  return renderEnvelope(env, !!opts.json, (data) => {
-    console.log(`rolled back to ${JSON.stringify(data)}`);
+  return renderEnvelope(env, !!opts.json, (data2) => {
+    console.log(`rolled back to ${JSON.stringify(data2)}`);
   });
 }
 async function logs(workflow2, opts) {
   const api = makeApi({
-    baseUrl: baseUrl(opts.local),
+    baseUrl: baseUrl(),
     key: await resolveKey(),
     debug: opts.debug
   });
   const qs = workflow2 ? `?workflow=${encodeURIComponent(workflow2)}` : "";
   const env = await api.get(`/workflows/${encodeURIComponent(workflow2 ?? "_all")}/executions${qs}`);
-  return renderEnvelope(env, !!opts.json, (data) => {
-    const d = data;
+  return renderEnvelope(env, !!opts.json, (data2) => {
+    const d = data2;
     if (Array.isArray(d?.executions)) {
       for (const e of d.executions) {
         const when = new Date(e.started_at).toISOString().slice(0, 19).replace("T", " ");
@@ -674,18 +929,18 @@ async function logs(workflow2, opts) {
       }
       return;
     }
-    console.log(JSON.stringify(data, null, 2));
+    console.log(JSON.stringify(data2, null, 2));
   });
 }
 async function stepLogs(instanceId, opts) {
   const api = makeApi({
-    baseUrl: baseUrl(opts.local),
+    baseUrl: baseUrl(),
     key: await resolveKey(),
     debug: opts.debug
   });
   const env = await api.get(`/executions/${encodeURIComponent(instanceId)}/steps`);
-  return renderEnvelope(env, !!opts.json, (data) => {
-    const rows = data?.steps ?? [];
+  return renderEnvelope(env, !!opts.json, (data2) => {
+    const rows = data2?.steps ?? [];
     for (const s of rows) {
       const mark = s.status === "ok" ? "\u2713" : "\u2717";
       const err = s.error ? ` \u2014 ${s.error}` : "";
@@ -695,10 +950,25 @@ async function stepLogs(instanceId, opts) {
 }
 
 // src/commands/keys.ts
+import { parseManifest } from "@muxoai/core";
+async function bootstrapBody() {
+  const text = await readManifestText();
+  if (text === void 0) return {};
+  const parsed = parseManifest(text);
+  if (!parsed.ok || parsed.manifest === void 0) return {};
+  const capabilities2 = [
+    ...new Set(Object.values(parsed.manifest.bundles ?? {}).flatMap((b) => b.capabilities ?? []))
+  ];
+  return {
+    project: parsed.manifest.project,
+    ...capabilities2.length > 0 ? { scopes: capabilities2 } : {}
+  };
+}
 async function keysCommand(action, id, opts) {
+  const existingKey = await resolveKey();
   const api = makeApi({
-    baseUrl: baseUrl(opts.local),
-    key: await resolveKey(),
+    baseUrl: baseUrl(),
+    key: existingKey,
     debug: opts.debug
   });
   if (action === "revoke" && !id) {
@@ -722,7 +992,7 @@ async function keysCommand(action, id, opts) {
       env = await api.get("/keys");
       break;
     case "create":
-      env = await api.post("/keys");
+      env = await api.post("/keys", existingKey === void 0 ? await bootstrapBody() : void 0);
       break;
     case "rotate":
       env = await api.post(`/keys/${id}/rotate`);
@@ -731,32 +1001,61 @@ async function keysCommand(action, id, opts) {
       env = await api.del(`/keys/${id}`);
       break;
   }
+  let storedIn;
+  if (env.ok && action === "create" && existingKey === void 0) {
+    const data2 = env.data;
+    if (typeof data2?.key === "string") {
+      storedIn = await keychainSet(data2.key);
+      if (!opts.json && storedIn === "file") {
+        console.error("warning: keychain unavailable; key stored in ~/.muxo/key (chmod 600)");
+      }
+    }
+  }
   if (env.ok && (action === "create" || action === "rotate") && !opts.json) {
-    const data = env.data;
-    if (data?.key !== void 0) {
-      const id2 = data.keyId ?? data.id;
-      console.log(`${action === "rotate" ? "rotated" : "created"} key ${id2 !== void 0 ? String(id2) : ""}`);
-      console.log(String(data.key));
-      console.log("store it now \u2014 it will not be shown again");
+    const data2 = env.data;
+    if (data2?.key !== void 0) {
+      const keyId = data2.keyId ?? data2.key_id ?? data2.id;
+      console.log(`${action === "rotate" ? "rotated" : "created"} key ${keyId !== void 0 ? String(keyId) : ""}`);
+      console.log(String(data2.key));
+      if (data2.project_id !== void 0) {
+        console.log(`project ${String(data2.project_id)}${data2.credits !== void 0 ? ` \xB7 ${String(data2.credits)} credits` : ""}`);
+      }
+      console.log(
+        storedIn !== void 0 ? `stored in ${storedIn === "keychain" ? "OS keychain" : "~/.muxo/key"} \u2014 ready to use` : "store it now \u2014 it will not be shown again"
+      );
       return 0;
     }
   }
-  return renderEnvelope(env, !!opts.json, (data) => {
-    if (Array.isArray(data)) {
-      for (const key of data) {
+  return renderEnvelope(env, !!opts.json, (data2) => {
+    if (Array.isArray(data2)) {
+      for (const key of data2) {
         const k = key;
         console.log(`${String(k?.id ?? "?")}${k?.revoked ? " (revoked)" : ""}`);
       }
       return;
     }
-    printJson(data);
+    printJson(data2);
+  });
+}
+
+// src/commands/capabilities.ts
+async function capabilities(opts) {
+  const api = makeApi({ baseUrl: baseUrl(), key: await resolveKey(), debug: opts.debug });
+  const env = await api.get("/capabilities");
+  return renderEnvelope(env, !!opts.json, (data2) => {
+    const rows = data2.capabilities ?? [];
+    for (const c of rows) {
+      const providers = c.backends.map((b) => b.configured ? b.provider : `${b.provider}*`).join(", ");
+      console.log(`${c.available ? "ok  " : "--  "}${c.name.padEnd(20)} ${providers}`);
+    }
+    console.log("\n* = not configured (missing runtime secrets)");
   });
 }
 
 // src/commands/credits.ts
 async function creditsCommand(action, packId, opts) {
   const api = makeApi({
-    baseUrl: baseUrl(opts.local),
+    baseUrl: baseUrl(),
     key: await resolveKey(),
     debug: opts.debug
   });
@@ -766,8 +1065,8 @@ async function creditsCommand(action, packId, opts) {
       return 1;
     }
     const env2 = await api.post("/credits/checkout", { pack: packId });
-    return renderEnvelope(env2, !!opts.json, (data) => {
-      const d = data;
+    return renderEnvelope(env2, !!opts.json, (data2) => {
+      const d = data2;
       if (d?.url !== void 0) {
         console.log(`checkout: ${d.url}`);
         if (d.stubbed) console.log("(stub \u2014 set STRIPE_SECRET_KEY on the runtime for real checkout)");
@@ -775,8 +1074,8 @@ async function creditsCommand(action, packId, opts) {
     });
   }
   const env = await api.get("/credits");
-  return renderEnvelope(env, !!opts.json, (data) => {
-    const d = data;
+  return renderEnvelope(env, !!opts.json, (data2) => {
+    const d = data2;
     if (action === "packs") {
       for (const p of d?.packs ?? []) {
         console.log(`${p.id}  ${p.credits} credits  $${(p.price_cents / 100).toFixed(2)}`);
@@ -807,7 +1106,7 @@ function promptHidden(promptText) {
       });
       return;
     }
-    process.stdout.write(promptText);
+    process.stderr.write(promptText);
     const wasRaw = process.stdin.isRaw ?? false;
     process.stdin.setRawMode(true);
     process.stdin.resume();
@@ -818,7 +1117,7 @@ function promptHidden(promptText) {
           process.stdin.setRawMode(wasRaw);
           process.stdin.pause();
           process.stdin.removeListener("data", onData);
-          process.stdout.write("\n");
+          process.stderr.write("\n");
           resolve(buf);
           return;
         }
@@ -828,7 +1127,7 @@ function promptHidden(promptText) {
           process.stdin.setRawMode(wasRaw);
           process.stdin.pause();
           process.stdin.removeListener("data", onData);
-          process.stdout.write("\n");
+          process.stderr.write("\n");
           process.exit(130);
         } else {
           buf += ch;
@@ -841,14 +1140,41 @@ function promptHidden(promptText) {
 async function login(opts) {
   const key = await promptHidden("Paste your muxo key: ");
   if (!key) {
-    console.error("error: no key provided");
+    if (opts.json) {
+      printJson({ ok: false, error: { code: "invalid_input", message: "no key provided" } });
+    } else {
+      console.error("error: no key provided");
+    }
     return 1;
   }
+  const api = makeApi({ baseUrl: baseUrl(), key, debug: opts.debug });
+  const check = await api.get("/status");
+  if (!check.ok && check.error.code === "forbidden") {
+    if (opts.json) {
+      printJson(check);
+    } else {
+      console.error(`error: ${check.error.message}`);
+    }
+    return 2;
+  }
   const where = await keychainSet(key);
   if (where === "file") {
     console.error("warning: keychain unavailable; key stored in ~/.muxo/key (chmod 600)");
   }
+  if (opts.json) {
+    printJson({
+      ok: true,
+      data: { stored: where, validated: check.ok },
+      usage: { credits: 0, provider: "muxo", latency_ms: 0 }
+    });
+    return 0;
+  }
   info(where === "keychain" ? "key stored in OS keychain" : "key stored in ~/.muxo/key", opts);
+  if (!check.ok) {
+    console.error(`warning: could not verify key against the runtime (${check.error.message}) \u2014 stored anyway`);
+  } else {
+    info("key verified against the runtime", opts);
+  }
   nextSteps(["muxo status"], opts);
   return 0;
 }
@@ -867,6 +1193,9 @@ var STATIC_TOOLS = [
   { name: "llm_tts", description: "Text to speech. Inputs: text (required), voice?." },
   { name: "compute_sandbox", description: "Run code in a sandbox. Inputs: code (required), runtime?, timeout?." },
   { name: "kv_store", description: "Key-value store. Inputs: key (required), value (to write) or get (to read)." },
+  { name: "db_write", description: "Write rows to a stack database. Inputs: into (stack address, required), rows (required)." },
+  { name: "db_query", description: "Query a stack database. Inputs: sql (required)." },
+  { name: "dns_manage", description: "Manage DNS records for a domain. Inputs: domain (required), records." },
   { name: "storage_object", description: "Object storage. Inputs: key (required), file (write) or get (read)." },
   { name: "vector_search", description: "Vector search. Inputs: query (required), k?." },
   { name: "email_send", description: "Send an email. Inputs: to, subject, body (all required)." },
@@ -889,10 +1218,10 @@ async function fetchTools(baseUrl2, key) {
   const api = makeApi({ baseUrl: baseUrl2, key });
   const env = await api.get("/status");
   if (!env.ok) return STATIC_TOOLS.map((t) => toolShape(t.name, t.description));
-  const data = env.data;
-  if (Array.isArray(data?.tools)) {
+  const data2 = env.data;
+  if (Array.isArray(data2?.tools)) {
     const tools = [];
-    for (const t of data.tools) {
+    for (const t of data2.tools) {
       if (typeof t === "string") {
         tools.push(toolShape(toToolName(t), ""));
         continue;
@@ -908,15 +1237,15 @@ async function fetchTools(baseUrl2, key) {
     const filtered = tools.filter((t) => !excluded(t.name));
     return filtered.length > 0 ? filtered : STATIC_TOOLS.map((t) => toolShape(t.name, t.description));
   }
-  if (Array.isArray(data?.capabilities)) {
-    const tools = data.capabilities.filter((c) => typeof c === "string").map((c) => toolShape(toToolName(c), "")).filter((t) => !excluded(t.name));
+  if (Array.isArray(data2?.capabilities)) {
+    const tools = data2.capabilities.filter((c) => typeof c === "string").map((c) => toolShape(toToolName(c), "")).filter((t) => !excluded(t.name));
     return tools.length > 0 ? tools : STATIC_TOOLS.map((t) => toolShape(t.name, t.description));
   }
   return STATIC_TOOLS.map((t) => toolShape(t.name, t.description));
 }
-function successResult(data, usage) {
+function successResult(data2, usage) {
   return {
-    content: [{ type: "text", text: JSON.stringify({ data, usage }) }],
+    content: [{ type: "text", text: JSON.stringify({ data: data2, usage }) }],
     isError: false
   };
 }
@@ -931,7 +1260,7 @@ function errorResult(error) {
   };
 }
 async function mcp(opts) {
-  const baseUrl2 = opts.local ? LOCAL_BASE_URL : process.env.MUXO_API_BASE || DEFAULT_BASE_URL;
+  const baseUrl2 = process.env.MUXO_API_BASE || DEFAULT_BASE_URL;
   const key = await resolveKey();
   const api = makeApi({ baseUrl: baseUrl2, key });
   let tools = null;
@@ -953,7 +1282,7 @@ async function mcp(opts) {
         reply(id, {
           protocolVersion: version,
           capabilities: { tools: { listChanged: false } },
-          serverInfo: { name: "muxo", version: "0.1.0" }
+          serverInfo: { name: "muxo", version: "0.1.1" }
         });
         return;
       }
@@ -1007,11 +1336,12 @@ function flags(cmd) {
 }
 async function main() {
   const program = new Command();
-  program.name("muxo").description("Muxo CLI \u2014 one key for your whole stack").version("0.1.0").addHelpText("after", `
+  program.name("muxo").description("Muxo CLI \u2014 one key for your whole stack").version("0.1.1").addHelpText("after", `
 Examples:
   muxo init "scrape hacker news every hour and store titles"
   muxo validate && muxo plan && muxo apply
   muxo run hn-scraper --param max_items=3
+  muxo call web.search --data '{"query":"agent infra","limit":3}'
   muxo logs && muxo steps <instanceId>
 
 Auth: export MUXO_KEY=mk_...   Endpoint: export MUXO_API_BASE=https://api.muxo.ai/v1
@@ -1047,11 +1377,29 @@ Docs: https://api.muxo.ai/docs/quickstart`);
   runCmd.description("Execute a workflow one-shot").action(async (workflow2, opts) => {
     process.exitCode = await run2(workflow2, opts);
   });
+  const callCmd = program.command("call <capability>");
+  flags(callCmd);
+  callCmd.option("--data <json>", `JSON object of capability inputs, e.g. --data '{"query":"x"}'`).option("--param <key=value>", "input field, e.g. --param limit=5 (repeatable)", (v, prev) => [...prev, v], []);
+  callCmd.description("Invoke a capability directly (web.search, deploy.site, llm.chat, \u2026)").action(
+    async (capability, opts) => {
+      process.exitCode = await call(capability, opts);
+    }
+  );
+  const deployCmd = program.command("deploy [dir]");
+  flags(deployCmd);
+  deployCmd.option("--target <target>", "deployment target, e.g. production").description("Deploy a local directory as a static site (default: public/ or dist/)").action(async (dir, opts) => {
+    process.exitCode = await deploy(dir, opts);
+  });
   const statusCmd = program.command("status");
   flags(statusCmd);
   statusCmd.description("Project health, bundles, budget state").action(async (opts) => {
     process.exitCode = await status(opts);
   });
+  const capabilitiesCmd = program.command("capabilities");
+  flags(capabilitiesCmd);
+  capabilitiesCmd.description("Show which capabilities this deployment can serve").action(async (opts) => {
+    process.exitCode = await capabilities(opts);
+  });
   const keys = program.command("keys");
   flags(keys);
   keys.description("Manage project keys");
@@ -1110,13 +1458,12 @@ Docs: https://api.muxo.ai/docs/quickstart`);
   });
   const loginCmd = program.command("login");
   flags(loginCmd);
-  loginCmd.description("Store your muxo key in the OS keychain").action(async (opts) => {
+  loginCmd.description("Store your muxo key in the OS keychain (validated against the runtime)").action(async (opts) => {
     process.exitCode = await login(opts);
   });
   const mcpCmd = program.command("mcp");
   flags(mcpCmd);
-  mcpCmd.option("--local", "target local runtime (http://localhost:8787/v1)");
-  mcpCmd.description("Stdio MCP proxy wrapping the muxo API (SPEC \xA712)").action(async (opts) => {
+  mcpCmd.description("Stdio MCP proxy wrapping the muxo API").action(async (opts) => {
     process.exitCode = await mcp(opts);
   });
   await program.parseAsync(process.argv);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@muxoai/cli",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Muxo CLI: one key for your whole stack — scaffold, validate, apply, run, and monitor agent workflows.",
   "type": "module",
   "license": "MIT",
@@ -39,7 +39,7 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@muxoai/core": "^0.1.0",
+    "@muxoai/core": "^0.1.1",
     "commander": "^12.0.0",
     "yaml": "^2.4.0",
     "zod": "^3.23.0"