@stigmer/cli 3.5.3 → 3.7.0

package/src/resources/apply/apply.ts

@@ -39,26 +39,6 @@ export interface ApplyOutcome {
   readonly applied?: Message;
 }
 
-// Dependency apply order (ascending priority); kinds absent get 99 (applied
-// last). Mirrors Go's applier.DefaultApplyOrder.
-const APPLY_ORDER: ReadonlyMap<ApiResourceKind, number> = new Map([
-  [ApiResourceKind.organization, 0],
-  [ApiResourceKind.mcp_server, 1],
-  // Before agent: an Agent references a Datastore via datastore_usages
-  // (the McpServer-before-Agent pattern; mirrors the SDK manifest registry).
-  [ApiResourceKind.datastore, 2],
-  [ApiResourceKind.agent, 3],
-  [ApiResourceKind.workflow, 4],
-  [ApiResourceKind.environment, 5],
-  [ApiResourceKind.identity_provider, 6],
-  [ApiResourceKind.oauth_app, 7],
-  [ApiResourceKind.agent_instance, 8],
-  [ApiResourceKind.workflow_instance, 9],
-  [ApiResourceKind.session, 10],
-  // After agent and environment: a share references both.
-  [ApiResourceKind.agent_share, 11],
-]);
-
 /** Expand a path into ordered, kind-resolved apply items (strict YAML parse). */
 export function resolveApplyItems(path: string): ApplyItem[] {
   const files = resolveYamlFiles(path);
@@ -83,14 +63,28 @@ export function resolveHandlerForKind(kind: string, where: string): ApplyHandler
   const info = defaultRegistry().getByYamlKind(kind);
   if (info === undefined) throw new UsageError(`unknown resource kind '${kind}' in ${where}`);
   if (!info.supportedVerbs.has(Verb.Apply)) throw new UsageError(`${info.displayName} does not support 'apply'`);
+  if (info.kind === ApiResourceKind.project) {
+    // Project's Apply verb is the stigmer.yaml track, deliberately not a
+    // manifest handler: a file-mode apply would create a second, member-less
+    // way to apply a project, bypassing the membership reconciler.
+    throw new UsageError(
+      `a Project is not applied from a resource manifest (${where}): ` +
+        "run `stigmer apply` in the directory containing stigmer.yaml and the project is reconciled from its members",
+    );
+  }
   const handler = APPLY_HANDLERS.get(info.kind);
   if (handler === undefined) throw new UsageError(`apply not implemented for ${info.displayName}`);
   return handler;
 }
 
-/** Stable sort by dependency priority (Array.prototype.sort is stable in V8). */
+/**
+ * Stable sort by dependency priority (Array.prototype.sort is stable in V8).
+ * The priority rides each handler (`applyOrder`, sourced from the SDK
+ * manifest registry) — there is deliberately no local ordering table to
+ * drift from it.
+ */
 export function sortApplyItems(items: ApplyItem[]): ApplyItem[] {
-  items.sort((a, b) => priorityOf(a.handler.kind) - priorityOf(b.handler.kind));
+  items.sort((a, b) => a.handler.applyOrder - b.handler.applyOrder);
   return items;
 }
 
@@ -202,6 +196,3 @@ function buildDryRunResult(handler: ApplyHandler, message: Message): CommandResu
   return result;
 }
 
-function priorityOf(kind: ApiResourceKind): number {
-  return APPLY_ORDER.get(kind) ?? 99;
-}

package/src/resources/apply/handlers.ts

@@ -1,178 +1,88 @@
-// Explicit apply-handler registry for `apply -f` (file mode).
+// Apply-handler registry for `apply -f` (file mode) and the synthesis track.
 //
-// Each handler binds an ApiResourceKind to its proto schema (for strict
-// YAML→proto marshalling) and the raw command-controller `apply` RPC. We drive
-// the *generated controllers* directly — not the high-level SDK `apply(input)`
-// methods — because the SDK's `*Input` wrappers are lossy (they drop
-// `metadata.id`, so an update would be misrouted as a create). The `apply` RPC
-// takes the full resource message, preserving every field round-tripped from
-// YAML. This is the keystone decision for Wave 2e.
+// The declarative manifest kinds come from the SDK's manifest registry
+// (`manifestKinds()` in @stigmer/sdk) — the one table binding a kind to its
+// proto schema, its raw command-controller `apply` RPC, and its dependency
+// apply order. The CLI consumes that table instead of keeping a copy: the
+// copy this file used to carry drifted twice (ChannelApp was missing
+// entirely — stigmer/stigmer#353 — and three kinds were absent from the
+// local ordering map, so multi-document bundles applied on file-order luck).
 //
-// Registration is explicit (no init magic), mirroring Go's
-// newApplyHandlerRegistry — to add a kind, add a line here.
+// Both registries drive the *generated controllers* directly — not the
+// high-level SDK `apply(input)` methods — because the SDK's `*Input`
+// wrappers are lossy (they drop `metadata.id`, so an update would be
+// misrouted as a create). The `apply` RPC takes the full resource message,
+// preserving every field round-tripped from YAML.
+//
+// CLI_EXTRA_HANDLERS carries the kinds the CLI applies but the SDK's
+// manifest engine deliberately does not treat as manifest kinds:
+// Organization (not org-scoped — the bootstrap resource every other kind
+// lives inside) and the runtime-instance kinds (WorkflowInstance, Session).
+// A kind added here must also declare Apply in the registry's verb matrix —
+// the conformance test in registry/registry.test.ts enforces both
+// directions, so an entry without a matrix line (or vice versa) fails CI.
 
-import type { Client } from "@connectrpc/connect";
 import type { DescMessage, DescService, Message } from "@bufbuild/protobuf";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-
-import { type Agent, AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
-import { AgentCommandController } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/command_pb";
-import { type AgentChannel, AgentChannelSchema } from "@stigmer/protos/ai/stigmer/agentic/agentchannel/v1/api_pb";
-import { AgentChannelCommandController } from "@stigmer/protos/ai/stigmer/agentic/agentchannel/v1/command_pb";
-import { type AgentInstance, AgentInstanceSchema } from "@stigmer/protos/ai/stigmer/agentic/agentinstance/v1/api_pb";
-import { AgentInstanceCommandController } from "@stigmer/protos/ai/stigmer/agentic/agentinstance/v1/command_pb";
-import { type AgentShare, AgentShareSchema } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/api_pb";
-import { AgentShareCommandController } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/command_pb";
-import { type Datastore, DatastoreSchema } from "@stigmer/protos/ai/stigmer/agentic/datastore/v1/api_pb";
-import { DatastoreCommandController } from "@stigmer/protos/ai/stigmer/agentic/datastore/v1/command_pb";
-import { type Environment, EnvironmentSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/api_pb";
-import { EnvironmentCommandController } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/command_pb";
-import { type McpServer, McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
-import { McpServerCommandController } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/command_pb";
+import type { Client } from "@connectrpc/connect";
 import { type Session, SessionSchema } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_pb";
 import { SessionCommandController } from "@stigmer/protos/ai/stigmer/agentic/session/v1/command_pb";
-import { type Workflow, WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
-import { WorkflowCommandController } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/command_pb";
 import {
   type WorkflowInstance,
   WorkflowInstanceSchema,
 } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/api_pb";
 import { WorkflowInstanceCommandController } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/command_pb";
-import { type IdentityProvider, IdentityProviderSchema } from "@stigmer/protos/ai/stigmer/iam/identityprovider/v1/api_pb";
-import { IdentityProviderCommandController } from "@stigmer/protos/ai/stigmer/iam/identityprovider/v1/command_pb";
-import { type OAuthApp, OAuthAppSchema } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/api_pb";
-import { OAuthAppCommandController } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/command_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { type Organization, OrganizationSchema } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
 import { OrganizationCommandController } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/command_pb";
+import { manifestKinds } from "@stigmer/sdk";
 
 /** Accessor for a raw Connect client over a generated service controller. */
 export type ControllerFn = <Desc extends DescService>(service: Desc) => Client<Desc>;
 
 export interface ApplyHandler {
   readonly kind: ApiResourceKind;
+  /** Human-facing name for messages, e.g. "MCP Server". */
   readonly displayName: string;
   /** Proto schema for strict YAML→proto marshalling. */
   readonly schema: DescMessage;
+  /**
+   * Position in the dependency apply order (ascending) — referenced kinds
+   * apply before their dependents. Manifest kinds carry the SDK registry's
+   * value; the CLI extras slot around them (organization first, the
+   * runtime-instance kinds after every blueprint they can reference).
+   */
+  readonly applyOrder: number;
   /** Drive the controller's `apply` RPC with the full resource message. */
   apply(controller: ControllerFn, message: Message): Promise<Message>;
 }
 
+// The SDK registry's applyOrder values end at schedule = 12; the extras slot
+// outside that range so a future SDK kind never collides with them.
+const CLI_EXTRA_HANDLERS: readonly ApplyHandler[] = [
+  {
+    kind: ApiResourceKind.organization,
+    displayName: "Organization",
+    schema: OrganizationSchema,
+    applyOrder: 0,
+    apply: (c, m) => c(OrganizationCommandController).apply(m as Organization),
+  },
+  {
+    kind: ApiResourceKind.workflow_instance,
+    displayName: "Workflow Instance",
+    schema: WorkflowInstanceSchema,
+    applyOrder: 13,
+    apply: (c, m) => c(WorkflowInstanceCommandController).apply(m as WorkflowInstance),
+  },
+  {
+    kind: ApiResourceKind.session,
+    displayName: "Session",
+    schema: SessionSchema,
+    applyOrder: 14,
+    apply: (c, m) => c(SessionCommandController).apply(m as Session),
+  },
+];
+
 export const APPLY_HANDLERS: ReadonlyMap<ApiResourceKind, ApplyHandler> = new Map<ApiResourceKind, ApplyHandler>([
-  [
-    ApiResourceKind.organization,
-    {
-      kind: ApiResourceKind.organization,
-      displayName: "Organization",
-      schema: OrganizationSchema,
-      apply: (c, m) => c(OrganizationCommandController).apply(m as Organization),
-    },
-  ],
-  [
-    ApiResourceKind.mcp_server,
-    {
-      kind: ApiResourceKind.mcp_server,
-      displayName: "MCP Server",
-      schema: McpServerSchema,
-      apply: (c, m) => c(McpServerCommandController).apply(m as McpServer),
-    },
-  ],
-  [
-    ApiResourceKind.datastore,
-    {
-      kind: ApiResourceKind.datastore,
-      displayName: "Datastore",
-      schema: DatastoreSchema,
-      apply: (c, m) => c(DatastoreCommandController).apply(m as Datastore),
-    },
-  ],
-  [
-    ApiResourceKind.agent,
-    {
-      kind: ApiResourceKind.agent,
-      displayName: "Agent",
-      schema: AgentSchema,
-      apply: (c, m) => c(AgentCommandController).apply(m as Agent),
-    },
-  ],
-  [
-    ApiResourceKind.workflow,
-    {
-      kind: ApiResourceKind.workflow,
-      displayName: "Workflow",
-      schema: WorkflowSchema,
-      apply: (c, m) => c(WorkflowCommandController).apply(m as Workflow),
-    },
-  ],
-  [
-    ApiResourceKind.environment,
-    {
-      kind: ApiResourceKind.environment,
-      displayName: "Environment",
-      schema: EnvironmentSchema,
-      apply: (c, m) => c(EnvironmentCommandController).apply(m as Environment),
-    },
-  ],
-  [
-    ApiResourceKind.identity_provider,
-    {
-      kind: ApiResourceKind.identity_provider,
-      displayName: "Identity Provider",
-      schema: IdentityProviderSchema,
-      apply: (c, m) => c(IdentityProviderCommandController).apply(m as IdentityProvider),
-    },
-  ],
-  [
-    ApiResourceKind.oauth_app,
-    {
-      kind: ApiResourceKind.oauth_app,
-      displayName: "OAuth App",
-      schema: OAuthAppSchema,
-      apply: (c, m) => c(OAuthAppCommandController).apply(m as OAuthApp),
-    },
-  ],
-  [
-    ApiResourceKind.agent_share,
-    {
-      kind: ApiResourceKind.agent_share,
-      displayName: "Agent Share",
-      schema: AgentShareSchema,
-      apply: (c, m) => c(AgentShareCommandController).apply(m as AgentShare),
-    },
-  ],
-  [
-    ApiResourceKind.agent_channel,
-    {
-      kind: ApiResourceKind.agent_channel,
-      displayName: "Agent Channel",
-      schema: AgentChannelSchema,
-      apply: (c, m) => c(AgentChannelCommandController).apply(m as AgentChannel),
-    },
-  ],
-  [
-    ApiResourceKind.agent_instance,
-    {
-      kind: ApiResourceKind.agent_instance,
-      displayName: "Agent Instance",
-      schema: AgentInstanceSchema,
-      apply: (c, m) => c(AgentInstanceCommandController).apply(m as AgentInstance),
-    },
-  ],
-  [
-    ApiResourceKind.workflow_instance,
-    {
-      kind: ApiResourceKind.workflow_instance,
-      displayName: "Workflow Instance",
-      schema: WorkflowInstanceSchema,
-      apply: (c, m) => c(WorkflowInstanceCommandController).apply(m as WorkflowInstance),
-    },
-  ],
-  [
-    ApiResourceKind.session,
-    {
-      kind: ApiResourceKind.session,
-      displayName: "Session",
-      schema: SessionSchema,
-      apply: (c, m) => c(SessionCommandController).apply(m as Session),
-    },
-  ],
+  ...manifestKinds().map((handler) => [handler.kind, handler] as const),
+  ...CLI_EXTRA_HANDLERS.map((handler) => [handler.kind, handler] as const),
 ]);

package/src/resources/delete.ts

@@ -52,22 +52,26 @@ interface HasMetadata {
 type DeleteFn = (client: Stigmer, id: string, force: boolean) => Promise<HasMetadata>;
 
 // Kinds the unified delete handles directly, each bound to its SDK delete call.
-// Kinds that carry a Delete verb but no entry here (identity_provider,
-// oauth_app, agent_share, workflow_instance, session) fall through to a
-// "not implemented" usage error, matching Go's default branch.
+// Every kind declaring Delete in the verb matrix must have an entry here (or a
+// documented special case) — the conformance test in registry/registry.test.ts
+// enforces it, so the two cannot drift.
 // Kinds whose delete takes a DeleteResourceInput (not an ID) thread the force
 // acknowledgment through; today only the datastore server honors it (the
 // non-empty guard), but force is the contract's generic ack carrier.
-const DELETE_HANDLERS: ReadonlyMap<ApiResourceKind, DeleteFn> = new Map<ApiResourceKind, DeleteFn>([
+export const DELETE_HANDLERS: ReadonlyMap<ApiResourceKind, DeleteFn> = new Map<ApiResourceKind, DeleteFn>([
   [ApiResourceKind.agent, (c, id) => c.agent.delete(id)],
   [ApiResourceKind.agent_instance, (c, id) => c.agentInstance.delete(id)],
   [ApiResourceKind.workflow, (c, id) => c.workflow.delete(id)],
+  [ApiResourceKind.workflow_instance, (c, id) => c.workflowInstance.delete(id)],
   [ApiResourceKind.mcp_server, (c, id, force) => c.mcpServer.delete({ resourceId: id, force })],
   [ApiResourceKind.project, (c, id) => c.project.delete(id)],
   [ApiResourceKind.datastore, (c, id, force) => c.datastore.delete({ resourceId: id, force })],
   [ApiResourceKind.environment, (c, id, force) => c.environment.delete({ resourceId: id, force })],
   [ApiResourceKind.agent_channel, (c, id) => c.agentChannel.delete(id)],
   [ApiResourceKind.channel_app, (c, id, force) => c.channelapp.delete({ resourceId: id, force })],
+  // A schedule delete also tears down its Temporal Schedule artifact
+  // server-side; the RPC takes a bare ScheduleId, so force is ignored.
+  [ApiResourceKind.schedule, (c, id) => c.schedule.delete(id)],
   [ApiResourceKind.skill, (c, id) => c.skill.delete(id)],
   [ApiResourceKind.api_key, (c, id) => c.apiKey.delete(id)],
 ]);

package/src/resources/execution.ts

@@ -124,15 +124,29 @@ export async function getExecution(client: Stigmer, id: string): Promise<Resourc
   return { schema: WorkflowExecutionSchema, message: await client.workflowExecution.get(id) };
 }
 
-/** List agent executions for the current context, paginated by `limit`. */
-export async function listAgentExecutions(client: Stigmer, limit: number): Promise<ResourceResult> {
-  const message = await client.agentExecution.list(create(ListAgentExecutionsRequestSchema, { pageSize: limit }));
+/**
+ * List agent executions for the current context, paginated by `limit`.
+ *
+ * `org` scopes results to that organization; empty means permission-bounded
+ * (all orgs the caller can view — the OSS single-tenant behavior).
+ */
+export async function listAgentExecutions(client: Stigmer, limit: number, org = ""): Promise<ResourceResult> {
+  const message = await client.agentExecution.list(
+    create(ListAgentExecutionsRequestSchema, { pageSize: limit, org }),
+  );
   return { schema: AgentExecutionListSchema, message };
 }
 
-/** List workflow executions for the current context, paginated by `limit`. */
-export async function listWorkflowExecutions(client: Stigmer, limit: number): Promise<ResourceResult> {
-  const message = await client.workflowExecution.list(create(ListWorkflowExecutionsRequestSchema, { pageSize: limit }));
+/**
+ * List workflow executions for the current context, paginated by `limit`.
+ *
+ * `org` scopes results to that organization; empty means permission-bounded
+ * (all orgs the caller can view — the OSS single-tenant behavior).
+ */
+export async function listWorkflowExecutions(client: Stigmer, limit: number, org = ""): Promise<ResourceResult> {
+  const message = await client.workflowExecution.list(
+    create(ListWorkflowExecutionsRequestSchema, { pageSize: limit, org }),
+  );
   return { schema: WorkflowExecutionListSchema, message };
 }
 

package/src/resources/get-bindings.ts

@@ -11,8 +11,10 @@ import { ChannelAppSchema } from "@stigmer/protos/ai/stigmer/agentic/channelapp/
 import { DatastoreSchema } from "@stigmer/protos/ai/stigmer/agentic/datastore/v1/api_pb";
 import { EnvironmentSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/api_pb";
 import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
+import { ScheduleSchema } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/api_pb";
 import { SkillSchema } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/api_pb";
 import { WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
+import { WorkflowInstanceSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/api_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { ApiKeySchema } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/api_pb";
 import { ProjectSchema } from "@stigmer/protos/ai/stigmer/tenancy/project/v1/api_pb";
@@ -27,16 +29,21 @@ export interface ResourceResult {
 
 type Getter = (client: Stigmer, ref: ParsedReference) => Promise<ResourceResult>;
 
-const GET_BINDINGS: ReadonlyMap<ApiResourceKind, Getter> = new Map([
+// Every kind declaring Get in the verb matrix must have an entry here (or a
+// documented special case, e.g. organization) — the conformance test in
+// registry/registry.test.ts enforces it, so the two cannot drift.
+export const GET_BINDINGS: ReadonlyMap<ApiResourceKind, Getter> = new Map([
   [ApiResourceKind.agent, refGetter(ApiResourceKind.agent, AgentSchema, (c) => c.agent)],
   [ApiResourceKind.agent_instance, refGetter(ApiResourceKind.agent_instance, AgentInstanceSchema, (c) => c.agentInstance)],
   [ApiResourceKind.workflow, refGetter(ApiResourceKind.workflow, WorkflowSchema, (c) => c.workflow)],
+  [ApiResourceKind.workflow_instance, refGetter(ApiResourceKind.workflow_instance, WorkflowInstanceSchema, (c) => c.workflowInstance)],
   [ApiResourceKind.mcp_server, refGetter(ApiResourceKind.mcp_server, McpServerSchema, (c) => c.mcpServer)],
   [ApiResourceKind.project, refGetter(ApiResourceKind.project, ProjectSchema, (c) => c.project)],
   [ApiResourceKind.datastore, refGetter(ApiResourceKind.datastore, DatastoreSchema, (c) => c.datastore)],
   [ApiResourceKind.environment, refGetter(ApiResourceKind.environment, EnvironmentSchema, (c) => c.environment)],
   [ApiResourceKind.agent_channel, refGetter(ApiResourceKind.agent_channel, AgentChannelSchema, (c) => c.agentChannel)],
   [ApiResourceKind.channel_app, refGetter(ApiResourceKind.channel_app, ChannelAppSchema, (c) => c.channelapp)],
+  [ApiResourceKind.schedule, refGetter(ApiResourceKind.schedule, ScheduleSchema, (c) => c.schedule)],
   [ApiResourceKind.skill, refGetter(ApiResourceKind.skill, SkillSchema, (c) => c.skill)],
   [ApiResourceKind.api_key, idOnlyGetter(ApiKeySchema, (c) => c.apiKey, "API keys")],
 ]);

package/src/resources/list.ts

@@ -2,8 +2,11 @@
 //
 // Most registry kinds are search-indexed and list through the unified
 // SearchService. Kinds that are deliberately not search-indexed
-// (organizations, API keys, agent instances, agent channels, channel apps)
-// use their dedicated find/list RPCs with bespoke table shapes.
+// (organizations, API keys, agent instances, agent channels, channel apps,
+// schedules) use their dedicated find/list RPCs with bespoke table shapes,
+// registered in LIST_HANDLERS — the same map-dispatch shape as the get,
+// delete, and apply registries, so the conformance test in
+// registry/registry.test.ts can hold all four to the verb matrix.
 
 import { create } from "@bufbuild/protobuf";
 import { AgentChannelSchema } from "@stigmer/protos/ai/stigmer/agentic/agentchannel/v1/api_pb";
@@ -12,6 +15,8 @@ import { AgentInstanceSchema } from "@stigmer/protos/ai/stigmer/agentic/agentins
 import { ListAgentInstancesRequestSchema } from "@stigmer/protos/ai/stigmer/agentic/agentinstance/v1/io_pb";
 import { ChannelAppSchema } from "@stigmer/protos/ai/stigmer/agentic/channelapp/v1/api_pb";
 import { ListChannelAppsByOrgInputSchema } from "@stigmer/protos/ai/stigmer/agentic/channelapp/v1/io_pb";
+import { ScheduleSchema } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/api_pb";
+import { ListSchedulesRequestSchema } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/io_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { PageInfoSchema } from "@stigmer/protos/ai/stigmer/commons/rpc/pagination_pb";
 import { ApiKeySchema } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/api_pb";
@@ -26,9 +31,9 @@ import { bool, type JsonObject, obj, renderCollection, str, type TableShape } fr
 // scope). Must stay in step with the server's SearchableKinds allowlist
 // (backend/services/stigmer-server/pkg/query/search/valueobject/
 // search_criteria.go): a kind present here but absent there silently lists
-// as empty. agent_channel and channel_app are deliberately NOT here — they
-// are not_search_indexed by design and take dedicated-RPC branches below.
-const SEARCH_KINDS = new Set<ApiResourceKind>([
+// as empty. The LIST_HANDLERS kinds are deliberately NOT here — they are
+// not_search_indexed by design and take dedicated-RPC handlers below.
+export const SEARCH_KINDS: ReadonlySet<ApiResourceKind> = new Set<ApiResourceKind>([
   ApiResourceKind.agent,
   ApiResourceKind.workflow,
   ApiResourceKind.mcp_server,
@@ -38,6 +43,73 @@ const SEARCH_KINDS = new Set<ApiResourceKind>([
   ApiResourceKind.environment,
 ]);
 
+type ListFn = (client: Stigmer, org: string, limit: number, format: OutputFormat) => Promise<string>;
+
+// Dedicated-RPC list handlers for the non-search-indexed kinds. Every kind
+// declaring List in the verb matrix must appear here or in SEARCH_KINDS —
+// the conformance test enforces it, so the two cannot drift.
+export const LIST_HANDLERS: ReadonlyMap<ApiResourceKind, ListFn> = new Map<ApiResourceKind, ListFn>([
+  [
+    ApiResourceKind.organization,
+    async (client, _org, _limit, format) => {
+      const result = await client.organization.findMyOrganizations();
+      return renderCollection(OrganizationSchema, result.entries, format, ORG_TABLE);
+    },
+  ],
+  [
+    ApiResourceKind.api_key,
+    async (client, _org, _limit, format) => {
+      const result = await client.apiKey.findAll();
+      return renderCollection(ApiKeySchema, result.entries, format, APIKEY_TABLE);
+    },
+  ],
+  [
+    ApiResourceKind.agent_instance,
+    async (client, org, limit, format) => {
+      const result = await client.agentInstance.list(
+        create(ListAgentInstancesRequestSchema, { org, pageInfo: create(PageInfoSchema, { num: 1, size: limit }) }),
+      );
+      return renderCollection(AgentInstanceSchema, result.items, format, INSTANCE_TABLE);
+    },
+  ],
+  [
+    ApiResourceKind.agent_channel,
+    async (client, org, limit, format) => {
+      const result = await client.agentChannel.list(
+        create(ListAgentChannelsRequestSchema, { org, pageInfo: create(PageInfoSchema, { num: 1, size: limit }) }),
+      );
+      return renderCollection(AgentChannelSchema, result.items, format, AGENT_CHANNEL_TABLE);
+    },
+  ],
+  [
+    ApiResourceKind.channel_app,
+    async (client, org, limit, format) => {
+      // listByOrg has no pagination on its contract (the per-org set is small
+      // by design); the limit is applied client-side so --limit stays honest.
+      // `channelapp` (not `channelApp`) is a recorded SDK codegen naming quirk.
+      const result = await client.channelapp.listByOrg(create(ListChannelAppsByOrgInputSchema, { org }));
+      return renderCollection(ChannelAppSchema, result.entries.slice(0, limit), format, CHANNEL_APP_TABLE);
+    },
+  ],
+  [
+    ApiResourceKind.schedule,
+    async (client, org, limit, format) => {
+      // ListSchedulesRequest requires an org (min_len 1), but an unset cloud
+      // context resolves to "" — refuse with actionable copy instead of
+      // relaying the server's raw validation error.
+      if (org === "") {
+        throw new UsageError(
+          "schedules are org-scoped: pass --org <slug> or configure an organization context",
+        );
+      }
+      const result = await client.schedule.list(
+        create(ListSchedulesRequestSchema, { org, pageInfo: create(PageInfoSchema, { num: 1, size: limit }) }),
+      );
+      return renderCollection(ScheduleSchema, result.items, format, SCHEDULE_TABLE);
+    },
+  ],
+]);
+
 export async function listResources(
   client: Stigmer,
   kind: ApiResourceKind,
@@ -45,32 +117,9 @@ export async function listResources(
   limit: number,
   format: OutputFormat,
 ): Promise<string> {
-  if (kind === ApiResourceKind.organization) {
-    const result = await client.organization.findMyOrganizations();
-    return renderCollection(OrganizationSchema, result.entries, format, ORG_TABLE);
-  }
-  if (kind === ApiResourceKind.api_key) {
-    const result = await client.apiKey.findAll();
-    return renderCollection(ApiKeySchema, result.entries, format, APIKEY_TABLE);
-  }
-  if (kind === ApiResourceKind.agent_instance) {
-    const result = await client.agentInstance.list(
-      create(ListAgentInstancesRequestSchema, { org, pageInfo: create(PageInfoSchema, { num: 1, size: limit }) }),
-    );
-    return renderCollection(AgentInstanceSchema, result.items, format, INSTANCE_TABLE);
-  }
-  if (kind === ApiResourceKind.agent_channel) {
-    const result = await client.agentChannel.list(
-      create(ListAgentChannelsRequestSchema, { org, pageInfo: create(PageInfoSchema, { num: 1, size: limit }) }),
-    );
-    return renderCollection(AgentChannelSchema, result.items, format, AGENT_CHANNEL_TABLE);
-  }
-  if (kind === ApiResourceKind.channel_app) {
-    // listByOrg has no pagination on its contract (the per-org set is small
-    // by design); the limit is applied client-side so --limit stays honest.
-    // `channelapp` (not `channelApp`) is a recorded SDK codegen naming quirk.
-    const result = await client.channelapp.listByOrg(create(ListChannelAppsByOrgInputSchema, { org }));
-    return renderCollection(ChannelAppSchema, result.entries.slice(0, limit), format, CHANNEL_APP_TABLE);
+  const dedicated = LIST_HANDLERS.get(kind);
+  if (dedicated !== undefined) {
+    return dedicated(client, org, limit, format);
   }
   if (!SEARCH_KINDS.has(kind)) {
     throw new UsageError("list is not implemented for this resource type");
@@ -146,6 +195,33 @@ const CHANNEL_APP_TABLE: TableShape = {
   },
 };
 
+// ENABLED is the owner's switch (spec.enabled); STATE is the platform's
+// failure latch, derived from status.paused_reason. They are different
+// states with different remedies — re-apply with `enabled: true` versus
+// `stigmer schedule resume` — so the table keeps them as two columns. An
+// auto-paused schedule with ENABLED true is exactly the condition this
+// surface exists to make visible (stigmer/stigmer#352).
+const SCHEDULE_TABLE: TableShape = {
+  resourceName: "schedules",
+  headers: ["ID", "SLUG", "TARGET", "CRON", "TZ", "ENABLED", "STATE"],
+  row: (json) => {
+    const metadata = obj(json, "metadata");
+    const spec = obj(json, "spec");
+    // The target oneof has one arm today (`agent`); a future workflow arm
+    // extends this accessor alongside the proto.
+    const agentRef = obj(obj(spec, "agent"), "agent_ref");
+    return [
+      str(metadata, "id"),
+      str(metadata, "slug"),
+      `${str(agentRef, "org")}/${str(agentRef, "slug")}`,
+      str(spec, "cron"),
+      str(spec, "time_zone"),
+      bool(spec, "enabled") ? "true" : "false",
+      str(obj(json, "status"), "paused_reason") === "" ? "active" : "paused",
+    ];
+  },
+};
+
 // The provider_config oneof serializes as exactly one provider-named key in
 // protojson (AgentChannelSpec and ChannelAppSpec share the same oneof
 // shape). Extend this list when a new provider arm lands in the protos.