@stigmer/cli 3.3.0 → 3.4.1

package/src/resources/mutate-verbs.integration.test.ts

@@ -16,9 +16,21 @@ import { AgentExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/agentex
 import { AgentExecutionCommandController } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/command_pb";
 import { ExecutionPhase } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import { AgentExecutionQueryController } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/query_pb";
+import { AgentChannelSchema } from "@stigmer/protos/ai/stigmer/agentic/agentchannel/v1/api_pb";
+import { AgentChannelCommandController } from "@stigmer/protos/ai/stigmer/agentic/agentchannel/v1/command_pb";
+import { AgentChannelQueryController } from "@stigmer/protos/ai/stigmer/agentic/agentchannel/v1/query_pb";
 import { AgentInstanceSchema } from "@stigmer/protos/ai/stigmer/agentic/agentinstance/v1/api_pb";
 import { AgentInstanceCommandController } from "@stigmer/protos/ai/stigmer/agentic/agentinstance/v1/command_pb";
 import { AgentInstanceQueryController } from "@stigmer/protos/ai/stigmer/agentic/agentinstance/v1/query_pb";
+import { ChannelAppSchema } from "@stigmer/protos/ai/stigmer/agentic/channelapp/v1/api_pb";
+import { ChannelAppCommandController } from "@stigmer/protos/ai/stigmer/agentic/channelapp/v1/command_pb";
+import { ChannelAppQueryController } from "@stigmer/protos/ai/stigmer/agentic/channelapp/v1/query_pb";
+import { DatastoreSchema } from "@stigmer/protos/ai/stigmer/agentic/datastore/v1/api_pb";
+import { DatastoreCommandController } from "@stigmer/protos/ai/stigmer/agentic/datastore/v1/command_pb";
+import { DatastoreQueryController } from "@stigmer/protos/ai/stigmer/agentic/datastore/v1/query_pb";
+import { EnvironmentSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/api_pb";
+import { EnvironmentCommandController } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/command_pb";
+import { EnvironmentQueryController } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/query_pb";
 import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
 import { McpServerCommandController } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/command_pb";
 import { McpServerQueryController } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/query_pb";
@@ -51,6 +63,28 @@ const knownWorkflow = create(WorkflowSchema, {
   metadata: { name: "Deploy", slug: "deploy", org: "acme", id: "wfl_1" },
 });
 
+// The mock treats this datastore as NON-EMPTY: delete refuses without the
+// force acknowledgment, mirroring the server's GuardNonEmptyStep contract.
+const knownDatastore = create(DatastoreSchema, {
+  metadata: { name: "clinic-records", slug: "clinic-records", org: "acme", id: "dst_1" },
+});
+
+// Byte-shaped like the Go server's GuardNonEmptyStep refusal (delete_guards.go).
+const nonEmptyGuardMessage =
+  'datastore "clinic-records" holds 12 records across 3 collections; deleting destroys them — pass force to acknowledge';
+
+const knownEnvironment = create(EnvironmentSchema, {
+  metadata: { name: "clinic-patient-db", slug: "clinic-patient-db", org: "acme", id: "env_1" },
+});
+
+const knownChannel = create(AgentChannelSchema, {
+  metadata: { name: "clinic-patient-whatsapp", slug: "clinic-patient-whatsapp", org: "acme", id: "ach_1" },
+});
+
+const knownChannelApp = create(ChannelAppSchema, {
+  metadata: { name: "clinic-meta-app", slug: "clinic-meta-app", org: "acme", id: "chapp_1" },
+});
+
 // Pending execution (cancellable) vs. an already-terminal one.
 const pendingExecution = create(AgentExecutionSchema, {
   metadata: { id: "aex_run" },
@@ -72,10 +106,20 @@ const openSessions = new Set<ServerHttp2Session>();
 // Spies for the command-side calls, reset per test.
 let cancelCalls: string[] = [];
 let tagCalls: { workflowId: string; versionHash: string; tag: string }[] = [];
+// Force-carrying deletes record what actually rode the RPC.
+let datastoreDeletes: { resourceId: string; force: boolean }[] = [];
+let environmentDeletes: { resourceId: string; force: boolean }[] = [];
+let channelAppDeletes: { resourceId: string; force: boolean }[] = [];
+// agent_channel's delete is a typed ID — no force field exists on the wire.
+let channelDeleteIds: string[] = [];
 
 beforeEach(() => {
   cancelCalls = [];
   tagCalls = [];
+  datastoreDeletes = [];
+  environmentDeletes = [];
+  channelAppDeletes = [];
+  channelDeleteIds = [];
 });
 
 beforeAll(async () => {
@@ -118,6 +162,60 @@ beforeAll(async () => {
       },
     });
 
+    router.service(DatastoreQueryController, {
+      getByReference: (req) => {
+        if (req.slug !== "clinic-records") throw new ConnectError("datastore not found", Code.NotFound);
+        return knownDatastore;
+      },
+    });
+    router.service(DatastoreCommandController, {
+      delete: (req) => {
+        datastoreDeletes.push({ resourceId: req.resourceId, force: req.force });
+        // Mirrors GuardNonEmptyStep: a non-empty datastore refuses without force.
+        if (!req.force) throw new ConnectError(nonEmptyGuardMessage, Code.FailedPrecondition);
+        return knownDatastore;
+      },
+    });
+
+    router.service(EnvironmentQueryController, {
+      getByReference: (req) => {
+        if (req.slug !== "clinic-patient-db") throw new ConnectError("environment not found", Code.NotFound);
+        return knownEnvironment;
+      },
+    });
+    router.service(EnvironmentCommandController, {
+      delete: (req) => {
+        environmentDeletes.push({ resourceId: req.resourceId, force: req.force });
+        return knownEnvironment;
+      },
+    });
+
+    router.service(AgentChannelQueryController, {
+      getByReference: (req) => {
+        if (req.slug !== "clinic-patient-whatsapp") throw new ConnectError("agent channel not found", Code.NotFound);
+        return knownChannel;
+      },
+    });
+    router.service(AgentChannelCommandController, {
+      delete: (req) => {
+        channelDeleteIds.push(req.value);
+        return knownChannel;
+      },
+    });
+
+    router.service(ChannelAppQueryController, {
+      getByReference: (req) => {
+        if (req.slug !== "clinic-meta-app") throw new ConnectError("channel app not found", Code.NotFound);
+        return knownChannelApp;
+      },
+    });
+    router.service(ChannelAppCommandController, {
+      delete: (req) => {
+        channelAppDeletes.push({ resourceId: req.resourceId, force: req.force });
+        return knownChannelApp;
+      },
+    });
+
     router.service(WorkflowQueryController, {
       getByReference: (req) => {
         if (req.slug !== "deploy") throw new ConnectError("workflow not found", Code.NotFound);
@@ -208,9 +306,17 @@ describe("delete (standard kinds)", () => {
     expect(classify(err)?.exitCode).toBe(ExitCode.NotFound);
   });
 
-  it("rejects an unknown type with a usage error", async () => {
+  it("rejects an unknown type and lists exactly the wired types", async () => {
     const err = await planDelete(client, "bogus", "x", "acme").catch((e) => e);
     expect(classify(err)?.exitCode).toBe(ExitCode.Usage);
+    // The list is derived from DELETE_HANDLERS (+ the two special cases), so
+    // it must name the wired kinds and never the declared-but-unwired ones.
+    const message = String(err.message);
+    for (const wired of ["datastore", "environment", "agentchannel", "channelapp", "execution", "organization"]) {
+      expect(message).toContain(wired);
+    }
+    expect(message).not.toContain("session");
+    expect(message).not.toContain("oauthapp");
   });
 
   it("rejects a kind that has no delete handler with a usage error", async () => {
@@ -219,6 +325,77 @@ describe("delete (standard kinds)", () => {
   });
 });
 
+describe("delete (force acknowledgment)", () => {
+  it("threads --force to the datastore delete RPC as the destroy-records ack", async () => {
+    const plan = await planDelete(client, "datastore", "clinic-records", "acme", true);
+    const result = await plan.perform();
+
+    expect(result.status).toBe("success");
+    expect(result.message).toBe("Datastore deleted successfully");
+    expect(datastoreDeletes).toEqual([{ resourceId: "dst_1", force: true }]);
+  });
+
+  it("surfaces the non-empty guard refusal verbatim when force is absent", async () => {
+    const plan = await planDelete(client, "datastore", "clinic-records", "acme");
+    const err = await plan.perform().catch((e) => e);
+
+    // A confirmed-but-unforced delete must NOT bypass the server guard: the
+    // RPC carries force=false and the refusal reaches the user verbatim.
+    expect(datastoreDeletes).toEqual([{ resourceId: "dst_1", force: false }]);
+    const classified = classify(err);
+    expect(classified?.exitCode).toBe(ExitCode.Usage);
+    expect(classified?.message).toBe(`Precondition failed: ${nonEmptyGuardMessage}`);
+  });
+
+  it("warns up front that datastore records are destroyed and force-guarded", async () => {
+    const plan = await planDelete(client, "datastore", "clinic-records", "acme");
+    expect(plan.warning.hints).toContain("All records held by this datastore will be destroyed.");
+    expect(plan.warning.hints).toContain(
+      "A datastore holding records is refused unless --force acknowledges destroying them.",
+    );
+  });
+});
+
+describe("delete (cutover kinds: environment, agent channel, channel app)", () => {
+  it("deletes an environment via the DeleteResourceInput shape", async () => {
+    const plan = await planDelete(client, "environment", "clinic-patient-db", "acme");
+    const result = await plan.perform();
+
+    expect(result.status).toBe("success");
+    expect(result.message).toBe("Environment deleted successfully");
+    expect(environmentDeletes).toEqual([{ resourceId: "env_1", force: false }]);
+  });
+
+  it("threads --force through the environment delete (generic ack carrier)", async () => {
+    const plan = await planDelete(client, "environment", "clinic-patient-db", "acme", true);
+    await plan.perform();
+    expect(environmentDeletes).toEqual([{ resourceId: "env_1", force: true }]);
+  });
+
+  it("deletes an agent channel via its typed-ID contract, ignoring force gracefully", async () => {
+    const plan = await planDelete(client, "agent-channel", "clinic-patient-whatsapp", "acme", true);
+
+    // The teardown-vs-pause distinction rides the warning (server doc contract).
+    expect(plan.warning.hints).toContain(
+      "Delete is the connection's full teardown; to pause instead, apply with spec.enabled: false.",
+    );
+
+    const result = await plan.perform();
+    expect(result.status).toBe("success");
+    expect(result.message).toBe("Agent Channel deleted successfully");
+    expect(channelDeleteIds).toEqual(["ach_1"]);
+  });
+
+  it("deletes a channel app via the DeleteResourceInput shape", async () => {
+    const plan = await planDelete(client, "channel-app", "clinic-meta-app", "acme");
+    const result = await plan.perform();
+
+    expect(result.status).toBe("success");
+    expect(result.message).toBe("Channel App deleted successfully");
+    expect(channelAppDeletes).toEqual([{ resourceId: "chapp_1", force: false }]);
+  });
+});
+
 describe("delete execution (cancel special case)", () => {
   it("cancels a non-terminal execution", async () => {
     const plan = await planDelete(client, "execution", "aex_run", "");

package/src/resources/read-verbs.integration.test.ts

@@ -7,12 +7,20 @@
 // to the right CLI exit code via classify().
 
 import { create, toJson } from "@bufbuild/protobuf";
+import { timestampFromDate } from "@bufbuild/protobuf/wkt";
 import { Code, ConnectError, type ConnectRouter } from "@connectrpc/connect";
 import { connectNodeAdapter } from "@connectrpc/connect-node";
 import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
 import { AgentQueryController } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/query_pb";
+import { AgentChannelSchema } from "@stigmer/protos/ai/stigmer/agentic/agentchannel/v1/api_pb";
+import { AgentChannelQueryController } from "@stigmer/protos/ai/stigmer/agentic/agentchannel/v1/query_pb";
+import { AgentChannelInstallState } from "@stigmer/protos/ai/stigmer/agentic/agentchannel/v1/status_pb";
 import { AgentInstanceSchema } from "@stigmer/protos/ai/stigmer/agentic/agentinstance/v1/api_pb";
 import { AgentInstanceQueryController } from "@stigmer/protos/ai/stigmer/agentic/agentinstance/v1/query_pb";
+import { ChannelAppSchema } from "@stigmer/protos/ai/stigmer/agentic/channelapp/v1/api_pb";
+import { ChannelAppQueryController } from "@stigmer/protos/ai/stigmer/agentic/channelapp/v1/query_pb";
+import { EnvironmentSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/api_pb";
+import { EnvironmentQueryController } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/query_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { ApiKeySchema } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/api_pb";
 import { ApiKeyQueryController } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/query_pb";
@@ -67,6 +75,73 @@ const knownSearchResult = create(SearchResultSchema, {
   description: "reviews code",
 });
 
+// The three T07 cutover kinds — wired into get-bindings and list alongside
+// this test. environment lists via the SearchService (it is search-indexed);
+// the two channel kinds list via their dedicated query RPCs.
+const knownEnvironment = create(EnvironmentSchema, {
+  apiVersion: "agentic.stigmer.ai/v1",
+  kind: "Environment",
+  metadata: { name: "clinic-patient-db", slug: "clinic-patient-db", org: "acme", id: "env_1" },
+});
+
+const knownEnvironmentSearchResult = create(SearchResultSchema, {
+  kind: ApiResourceKind.environment,
+  id: "env_1",
+  name: "clinic-patient-db",
+  slug: "clinic-patient-db",
+  qualifiedSlug: "acme/clinic-patient-db",
+  org: "acme",
+  description: "clinic patient database credentials",
+});
+
+// Spec/status populated to exercise every AGENT_CHANNEL_TABLE column:
+// agent_ref, the provider oneof, install_state, and enabled.
+const knownChannel = create(AgentChannelSchema, {
+  apiVersion: "agentic.stigmer.ai/v1",
+  kind: "AgentChannel",
+  metadata: { name: "clinic-patient-whatsapp", slug: "clinic-patient-whatsapp", org: "acme", id: "ach_1" },
+  spec: {
+    enabled: true,
+    agentRef: { kind: ApiResourceKind.agent, org: "acme", slug: "clinic-assistant" },
+    providerConfig: { case: "whatsapp", value: { phoneNumberId: "106540352242922" } },
+  },
+  status: { installState: AgentChannelInstallState.installed },
+});
+
+// Secret fields carry the redaction marker, matching what the server's
+// RedactChannelApp pipeline returns on every list/get response.
+const knownChannelApp = create(ChannelAppSchema, {
+  apiVersion: "agentic.stigmer.ai/v1",
+  kind: "ChannelApp",
+  metadata: { name: "clinic-meta-app", slug: "clinic-meta-app", org: "acme", id: "chapp_1" },
+  spec: {
+    providerConfig: {
+      case: "whatsapp",
+      value: {
+        appId: "108954",
+        appSecret: "***REDACTED***",
+        accessToken: "***REDACTED***",
+        verifyToken: "***REDACTED***",
+      },
+    },
+  },
+  status: { audit: { specAudit: { createdAt: timestampFromDate(new Date("2026-07-20T10:00:00Z")) } } },
+});
+
+// Second entry (slack arm) so the list tests cover both provider derivations
+// and the client-side --limit slice (listByOrg has no pagination).
+const secondChannelApp = create(ChannelAppSchema, {
+  apiVersion: "agentic.stigmer.ai/v1",
+  kind: "ChannelApp",
+  metadata: { name: "clinic-slack-app", slug: "clinic-slack-app", org: "acme", id: "chapp_2" },
+  spec: {
+    providerConfig: {
+      case: "slack",
+      value: { clientId: "12.34", clientSecret: "***REDACTED***", signingSecret: "***REDACTED***" },
+    },
+  },
+});
+
 let backend: Http2Server;
 let client: Stigmer;
 const openSessions = new Set<ServerHttp2Session>();
@@ -98,7 +173,14 @@ beforeAll(async () => {
       },
     });
     router.service(SearchService, {
-      search: () => ({ entries: [knownSearchResult], totalCount: 1, totalPages: 1 }),
+      // Kind-aware: search-backed list sends a single-kind query, so the
+      // environment arm proves the kind actually rode the request.
+      search: (req) => {
+        if (req.kinds.length === 1 && req.kinds[0] === ApiResourceKind.environment) {
+          return { entries: [knownEnvironmentSearchResult], totalCount: 1, totalPages: 1 };
+        }
+        return { entries: [knownSearchResult], totalCount: 1, totalPages: 1 };
+      },
     });
     router.service(OrganizationQueryController, {
       findMyOrganizations: () => ({ entries: [knownOrg] }),
@@ -106,6 +188,44 @@ beforeAll(async () => {
     router.service(ApiKeyQueryController, {
       findAll: () => ({ entries: [knownApiKey] }),
     });
+    router.service(EnvironmentQueryController, {
+      get: (req) => {
+        if (req.value !== "env_1") throw new ConnectError("environment not found", Code.NotFound);
+        return knownEnvironment;
+      },
+      getByReference: (req) => {
+        if (req.slug !== "clinic-patient-db") throw new ConnectError("environment not found", Code.NotFound);
+        return knownEnvironment;
+      },
+    });
+    router.service(AgentChannelQueryController, {
+      get: (req) => {
+        if (req.value !== "ach_1") throw new ConnectError("agent channel not found", Code.NotFound);
+        return knownChannel;
+      },
+      getByReference: (req) => {
+        if (req.slug !== "clinic-patient-whatsapp") throw new ConnectError("agent channel not found", Code.NotFound);
+        return knownChannel;
+      },
+      list: (req) => {
+        if (req.org !== "acme") throw new ConnectError("org is required", Code.InvalidArgument);
+        return { totalCount: 1, items: [knownChannel] };
+      },
+    });
+    router.service(ChannelAppQueryController, {
+      get: (req) => {
+        if (req.value !== "chapp_1") throw new ConnectError("channel app not found", Code.NotFound);
+        return knownChannelApp;
+      },
+      getByReference: (req) => {
+        if (req.slug !== "clinic-meta-app") throw new ConnectError("channel app not found", Code.NotFound);
+        return knownChannelApp;
+      },
+      listByOrg: (req) => {
+        if (req.org !== "acme") throw new ConnectError("org is required", Code.InvalidArgument);
+        return { entries: [knownChannelApp, secondChannelApp] };
+      },
+    });
   };
   backend = createHttp2Server(connectNodeAdapter({ routes }));
   backend.on("session", (session) => {
@@ -169,6 +289,58 @@ describe("get integration", () => {
     });
   });
 
+  it("fetches an environment by org/slug and renders backend protojson", async () => {
+    const { schema, message } = await fetchResource(client, ApiResourceKind.environment, {
+      kind: "ref",
+      org: "acme",
+      slug: "clinic-patient-db",
+    });
+    const rendered = JSON.parse(renderResource(schema, message, "json"));
+    expect(rendered).toEqual(toJson(EnvironmentSchema, knownEnvironment, { useProtoFieldName: true }));
+  });
+
+  it("fetches an environment by ID", async () => {
+    const { message } = await fetchResource(client, ApiResourceKind.environment, { kind: "id", id: "env_1" });
+    expect(JSON.parse(renderResource(EnvironmentSchema, message, "json"))).toMatchObject({
+      metadata: { id: "env_1" },
+    });
+  });
+
+  it("fetches an agent channel by org/slug and renders backend protojson", async () => {
+    const { schema, message } = await fetchResource(client, ApiResourceKind.agent_channel, {
+      kind: "ref",
+      org: "acme",
+      slug: "clinic-patient-whatsapp",
+    });
+    const rendered = JSON.parse(renderResource(schema, message, "json"));
+    expect(rendered).toEqual(toJson(AgentChannelSchema, knownChannel, { useProtoFieldName: true }));
+  });
+
+  it("fetches an agent channel by ID", async () => {
+    const { message } = await fetchResource(client, ApiResourceKind.agent_channel, { kind: "id", id: "ach_1" });
+    expect(JSON.parse(renderResource(AgentChannelSchema, message, "json"))).toMatchObject({
+      metadata: { id: "ach_1" },
+      spec: { enabled: true },
+    });
+  });
+
+  it("fetches a channel app by org/slug and renders backend protojson", async () => {
+    const { schema, message } = await fetchResource(client, ApiResourceKind.channel_app, {
+      kind: "ref",
+      org: "acme",
+      slug: "clinic-meta-app",
+    });
+    const rendered = JSON.parse(renderResource(schema, message, "json"));
+    expect(rendered).toEqual(toJson(ChannelAppSchema, knownChannelApp, { useProtoFieldName: true }));
+  });
+
+  it("fetches a channel app by ID", async () => {
+    const { message } = await fetchResource(client, ApiResourceKind.channel_app, { kind: "id", id: "chapp_1" });
+    expect(JSON.parse(renderResource(ChannelAppSchema, message, "json"))).toMatchObject({
+      metadata: { id: "chapp_1" },
+    });
+  });
+
   it("maps a NotFound backend error to ExitCode.NotFound", async () => {
     const err = await fetchResource(client, ApiResourceKind.agent, { kind: "id", id: "missing" }).catch((e) => e);
     const classified = classify(err);
@@ -176,7 +348,9 @@ describe("get integration", () => {
   });
 
   it("rejects an unsupported kind with a usage error", async () => {
-    const err = await fetchResource(client, ApiResourceKind.environment, { kind: "id", id: "x" }).catch((e) => e);
+    // session declares Get in the registry but has no get binding — the
+    // canonical still-unwired kind (environment gained a binding).
+    const err = await fetchResource(client, ApiResourceKind.session, { kind: "id", id: "x" }).catch((e) => e);
     expect(classify(err)?.exitCode).toBe(ExitCode.Usage);
   });
 });
@@ -214,4 +388,64 @@ describe("list integration", () => {
     expect(out).toContain("reviewer-default");
     expect(out).toContain("agt_1");
   });
+
+  it("lists environments via the search service as JSON", async () => {
+    const out = await listResources(client, ApiResourceKind.environment, "acme", 50, "json");
+    expect(JSON.parse(out)).toEqual([
+      toJson(SearchResultSchema, knownEnvironmentSearchResult, { useProtoFieldName: true }),
+    ]);
+  });
+
+  it("renders a human table for environment lists", async () => {
+    const out = await listResources(client, ApiResourceKind.environment, "acme", 50, "table");
+    expect(out).toContain("NAME");
+    expect(out).toContain("acme/clinic-patient-db");
+  });
+
+  it("lists agent channels via the dedicated list RPC as JSON", async () => {
+    const out = await listResources(client, ApiResourceKind.agent_channel, "acme", 50, "json");
+    expect(JSON.parse(out)).toEqual([toJson(AgentChannelSchema, knownChannel, { useProtoFieldName: true })]);
+  });
+
+  it("renders a human table for agent channels with the serving signals", async () => {
+    const out = await listResources(client, ApiResourceKind.agent_channel, "acme", 50, "table");
+    expect(out).toContain("PROVIDER");
+    expect(out).toContain("STATE");
+    expect(out).toContain("ENABLED");
+    expect(out).toContain("acme/clinic-assistant"); // agent_ref as org/slug
+    expect(out).toContain("whatsapp"); // derived from the provider oneof
+    expect(out).toContain("installed"); // status.install_state
+    expect(out).toContain("true"); // spec.enabled
+  });
+
+  it("lists channel apps via listByOrg as JSON", async () => {
+    const out = await listResources(client, ApiResourceKind.channel_app, "acme", 50, "json");
+    expect(JSON.parse(out)).toEqual([
+      toJson(ChannelAppSchema, knownChannelApp, { useProtoFieldName: true }),
+      toJson(ChannelAppSchema, secondChannelApp, { useProtoFieldName: true }),
+    ]);
+  });
+
+  it("renders a human table for channel apps with provider and created date", async () => {
+    const out = await listResources(client, ApiResourceKind.channel_app, "acme", 50, "table");
+    expect(out).toContain("PROVIDER");
+    expect(out).toContain("whatsapp");
+    expect(out).toContain("slack");
+    expect(out).toContain("2026-07-20"); // status.audit.spec_audit.created_at
+    // Secrets never reach the table (redaction markers stay in json/yaml only).
+    expect(out).not.toContain("***REDACTED***");
+  });
+
+  it("applies --limit client-side for channel apps (listByOrg has no pagination)", async () => {
+    const out = await listResources(client, ApiResourceKind.channel_app, "acme", 1, "json");
+    expect(JSON.parse(out)).toEqual([toJson(ChannelAppSchema, knownChannelApp, { useProtoFieldName: true })]);
+  });
+
+  it("rejects a kind whose list is unwired with a usage error", async () => {
+    // agent_share declares List in the registry but has no list branch —
+    // the canonical still-unwired list kind (the three cutover kinds and
+    // environment gained branches).
+    const err = await listResources(client, ApiResourceKind.agent_share, "acme", 50, "json").catch((e) => e);
+    expect(classify(err)?.exitCode).toBe(ExitCode.Usage);
+  });
 });