@uru-intelligence/cli 0.3.56 → 0.3.57

package/dist/uru.mjs

@@ -3,10 +3,70 @@
 
 // src/cli.ts
 import { spawn as spawn3 } from "node:child_process";
+// package.json
+var package_default = {
+  name: "@uru-intelligence/cli",
+  version: "0.3.57",
+  private: false,
+  description: "Uru full-platform command line interface",
+  repository: {
+    type: "git",
+    url: "git+https://github.com/Ignition-Forward/uru-workspace-platform.git",
+    directory: "apps/cli"
+  },
+  uru: {
+    mcpPackage: "uru-mcp@3.7.2"
+  },
+  type: "module",
+  bin: {
+    uru: "dist/uru.mjs"
+  },
+  exports: {
+    ".": "./dist/uru.mjs"
+  },
+  scripts: {
+    lint: "oxlint . --type-aware",
+    "lint:fix": "oxlint . --type-aware --fix",
+    "type-check": "tsc --noEmit",
+    test: "bun test",
+    "test:unit": "bun test",
+    format: "prettier --write . --ignore-path ../../.prettierignore",
+    "format:check": "prettier --check . --ignore-path ../../.prettierignore",
+    ci: "bun run lint && bun run type-check && bun run test:unit && bun run docs:check && bun run format:check && bun run build && bun run smoke:package && bun run smoke:binaries",
+    build: "node scripts/build.mjs",
+    prepack: "bun run build",
+    "docs:generate": "bun scripts/generate-docs.mjs",
+    "docs:check": "bun scripts/generate-docs.mjs --check",
+    "smoke:staging": "node scripts/staging-smoke.mjs",
+    "smoke:package": "node scripts/package-smoke.mjs",
+    "smoke:mcp-pin": "node scripts/mcp-pin-smoke.mjs",
+    "smoke:registry": "node scripts/registry-smoke.mjs",
+    "build:binaries": "node scripts/build-binaries.mjs",
+    "build:binaries:matrix": "node scripts/build-binaries.mjs --all",
+    "smoke:binaries": "node scripts/binary-smoke.mjs"
+  },
+  devDependencies: {
+    "@uru/platform-operations": "workspace:*",
+    "@types/node": "24.13.3",
+    "bun-types": "1.3.13",
+    typescript: "7.0.2"
+  },
+  packageManager: "bun@1.3.13",
+  engines: {
+    node: ">=24"
+  },
+  files: [
+    "dist",
+    "README.md"
+  ],
+  publishConfig: {
+    access: "public"
+  }
+};
 
 // src/types.ts
 var DEFAULT_API_URL = "https://api.uruintelligence.com";
-var CLI_VERSION = "0.3.55";
+var CLI_VERSION = package_default.version;
 var ExitCode = {
   Ok: 0,
   Failure: 1,
@@ -92,7 +152,7 @@ function parseArgs(argv) {
     }
     if (parsingFlags && arg.startsWith("--")) {
       const [flagName, inlineValue] = splitFlag(arg);
-      if (command.length > 0 && flagName === "--output") {
+      if (command.length > 0 && (flagName === "--output" || flagName === "--version")) {
         command.push(arg);
         continue;
       }
@@ -193,8 +253,8 @@ function applyValueFlag(flags, flag, value) {
   }
 }
 
-// ../../packages/platform-operations/src/operation_groups.ts
-function buildOperationGroups(op) {
+// ../../packages/platform-operations/src/operation_groups_gems.ts
+function buildGemOperations(op) {
   const gemOperations = [
     op("gem.init", "gems", "Create a Gem project at a visible library/<name>.gem path.", "gem_control_plane", "init", "write"),
     op("gem.inspect", "gems", "Inspect Gem release readiness, bindings, secrets, and setup checks.", "gem_query", "inspect", "read"),
@@ -203,49 +263,70 @@ function buildOperationGroups(op) {
     op("gem.fs_write", "gems", "Write a file inside a Gem project directory.", "gem_control_plane", "fs_write", "write"),
     op("gem.fs_batch_write", "gems", "Write multiple Gem files atomically through the server source layer.", "gem_control_plane", "fs_batch_write", "write"),
     op("gem.fs_sync", "gems", "Synchronize Gem files and deletions atomically through the server source layer.", "gem_control_plane", "fs_sync", "write"),
-    op("gem.fs_patch", "gems", "Apply a patch to Gem source files.", "gem_control_plane", "fs_patch", "write"),
+    op("gem.fs_patch", "gems", "Apply a complete Codex patch to Gem source files atomically.", "gem_control_plane", "fs_patch", "write"),
+    op("gem.fs_patch_preview", "gems", "Preview a complete Codex Gem source patch without mutation.", "gem_query", "fs_patch_preview", "read"),
     op("gem.fs_mkdir", "gems", "Create a directory inside a Gem project.", "gem_control_plane", "fs_mkdir", "write"),
     op("gem.fs_rm", "gems", "Remove a file or directory from a Gem project.", "gem_control_plane", "fs_rm", "destructive"),
     op("gem.fs_mv", "gems", "Move or rename a Gem project file.", "gem_control_plane", "fs_mv", "write"),
     op("gem.fs_cp", "gems", "Copy a Gem project file.", "gem_control_plane", "fs_cp", "write"),
     op("gem.fs_status", "gems", "Compare current Gem source against live, last build, or another version.", "gem_query", "fs_status", "read"),
     op("gem.fs_diff", "gems", "Read a git-like diff for Gem source changes.", "gem_query", "fs_diff", "read"),
-    op("gem.validate", "gems", "Validate and build-check the current Gem source without publishing.", "gem_control_plane", "validate", "read"),
+    op("gem.validate", "gems", "Validate and build-check the current Gem source without creating a Version, Release, or changing any Link.", "gem_control_plane", "validate", "read"),
     op("gem.build", "gems", "Create or reuse a ready server-side Gem build.", "gem_control_plane", "build", "write"),
-    op("gem.version_upload", "gems", "Create an immutable Gem version from a ready server-side build.", "gem_control_plane", "version_upload", "write", ["cli", "docs"]),
+    op("gem.edits_list", "gems", "List coherent Gem source edits.", "gem_query", "edits_list", "read"),
+    op("gem.edit_get", "gems", "Inspect one coherent Gem Edit.", "gem_query", "edit_get", "read"),
+    op("gem.versions_list", "gems", "List frozen Gem Versions.", "gem_query", "versions_list", "read"),
+    op("gem.version_get", "gems", "Inspect one frozen Gem Version.", "gem_query", "version_get", "read"),
+    op("gem.version_diff", "gems", "Compare two frozen Gem Versions.", "gem_query", "version_diff", "read"),
+    op("gem.version_save", "gems", "Save the current Draft as a frozen Version without changing Links.", "gem_control_plane", "version_save", "write"),
+    op("gem.version_restore", "gems", "Restore one Version into the Draft as a new Edit without changing Links.", "gem_control_plane", "version_restore", "write"),
+    op("gem.version_preview", "gems", "Open or provision an isolated preview for one Version without changing Links.", "gem_control_plane", "version_preview", "write"),
     op("gem.build_logs", "gems", "Read build diagnostics for a Gem build.", "gem_query", "build_logs", "read"),
     op("gem.build_inspect", "gems", "Inspect a Gem runtime contract and release overview.", "gem_query", "build_inspect", "read"),
     op("gem.upsert_binding", "gems", "Bind a declared Gem need to an approved platform resource.", "gem_control_plane", "upsert_binding", "write"),
     op("gem.resolve_safe_bindings", "gems", "Resolve deterministic safe bindings for a ready Gem build.", "gem_control_plane", "resolve_safe_bindings", "write"),
     op("gem.store_secret", "gems", "Store a user-supplied Gem secret value server-side.", "gem_control_plane", "store_secret", "write"),
-    op("gem.deploy", "gems", "Deploy a Gem using the server-side build/deploy/publish lifecycle.", "gem_control_plane", "deploy", "write"),
-    op("gem.version_deploy", "gems", "Deploy an immutable Gem version through the Gem control plane.", "gem_control_plane", "version_deploy", "write", ["cli", "docs"]),
+    op("gem.releases_list", "gems", "List logical hosted Releases.", "gem_query", "releases_list", "read"),
+    op("gem.release_get", "gems", "Inspect one Release and its attempts.", "gem_query", "release_get", "read"),
+    op("gem.release_create", "gems", "Create or reuse a hosted Release for one Version without changing Links.", "gem_control_plane", "release_create", "write"),
+    op("gem.release_retry", "gems", "Append a new attempt to a failed logical Release without changing Links.", "gem_control_plane", "release_retry", "write"),
     op("gem.status", "gems", "Read Gem deployment status, checks, runtime runs, and recent logs.", "gem_query", "deployment_status", "read"),
     op("gem.checks", "gems", "Inspect registered checks for a Gem deployment or immutable version.", "gem_query", "checks", "read", ["cli", "docs"]),
     op("gem.logs", "gems", "Read server-side Gem runtime logs with filters.", "gem_query", "logs", "read"),
     op("gem.browser_verify", "gems", "Run browser verification for a Gem deployment.", "gem_control_plane", "browser_verify", "write"),
     op("gem.security_scan", "gems", "Run a Gem security scan.", "gem_control_plane", "security_scan", "write"),
-    op("gem.promote", "gems", "Promote a published Gem link to a deployment.", "gem_control_plane", "promote", "write"),
-    op("gem.rollback", "gems", "Repoint a published Gem link to a previous immutable deployment.", "gem_control_plane", "rollback", "destructive"),
-    op("gem.publish", "gems", "Publish or repoint a Gem link to a source version or deployment.", "gem_control_plane", "publish", "write"),
-    op("gem.unpublish", "gems", "Remove the published primary link for a Gem.", "gem_control_plane", "unpublish", "destructive"),
     op("gem.links_list", "gems", "List published links for a Gem.", "gem_query", "links_list", "read"),
-    op("gem.links_create", "gems", "Create an additional published Gem link.", "gem_control_plane", "links_create", "write"),
-    op("gem.set_access", "gems", "Update access gates for a Gem link.", "gem_control_plane", "set_access", "write"),
+    op("gem.link_create", "gems", "Create a Link selecting one explicit Version.", "gem_control_plane", "link_create", "write"),
+    op("gem.link_set_version", "gems", "Move one explicit Link to one explicit Version.", "gem_control_plane", "link_set_version", "write"),
+    op("gem.link_set_access", "gems", "Update the access policy for one explicit Link.", "gem_control_plane", "link_set_access", "write"),
+    op("gem.link_set_notifications", "gems", "Update view notifications for one explicit Link.", "gem_control_plane", "link_set_notifications", "write"),
+    op("gem.link_rotate", "gems", "Rotate the URL token for one explicit Link.", "gem_control_plane", "link_rotate", "destructive"),
+    op("gem.link_revoke", "gems", "Revoke one explicit Link.", "gem_control_plane", "link_revoke", "destructive"),
+    op("gem.runs_list", "gems", "List bounded server Gem executions.", "gem_query", "runs_list", "read"),
+    op("gem.run_get", "gems", "Inspect one bounded Gem execution.", "gem_query", "run_get", "read"),
+    op("gem.run_cancel", "gems", "Cancel one running Gem execution when supported.", "gem_control_plane", "run_cancel", "destructive"),
+    op("gem.run_retry", "gems", "Retry one failed Gem execution when supported.", "gem_control_plane", "run_retry", "write"),
     op("gem.analytics", "gems", "Read Gem view analytics.", "gem_query", "get_gem_analytics", "read"),
     op("gem.domains_set", "gems", "Attach or update a custom domain for a Gem.", "gem_control_plane", "domains_set", "write"),
     op("gem.domains_list", "gems", "List custom domains for a Gem.", "gem_query", "domains_list", "read"),
     op("gem.components_list", "gems", "List verified Gem component templates.", "GEM_COMPONENTS_LIST", undefined, "read"),
     op("gem.components_get", "gems", "Fetch one verified Gem component definition.", "GEM_COMPONENTS_GET", undefined, "read")
   ];
+  return gemOperations;
+}
+
+// ../../packages/platform-operations/src/operation_groups.ts
+function buildOperationGroups(op) {
+  const gemOperations = buildGemOperations(op);
   const libraryOperations = [
     op("library.ls", "library", "List visible Library folders and resources.", "library_query", "ls", "read"),
     op("library.stat", "library", "Read metadata for a visible Library path.", "library_query", "stat", "read"),
     op("library.read", "library", "Read a visible text-backed Library resource by path.", "library_query", "read", "read"),
     op("library.search", "library", "Search visible Library resources server-side.", "library_query", "search", "read"),
+    op("library.patch_preview", "library", "Preview a Codex patch against visible typed Library text without mutation.", "library_query", "patch_preview", "read"),
     op("library.mkdir", "library", "Create a Library folder.", "library_fs", "mkdir", "write"),
     op("library.write", "library", "Create or replace a text-backed Library resource by path.", "library_fs", "write", "write"),
-    op("library.patch", "library", "Replace text content for a text-backed Library resource by path.", "library_fs", "patch", "write"),
+    op("library.patch", "library", "Apply Codex patch text to visible typed Library text resources; use write for full replacement.", "library_fs", "patch", "write"),
     op("library.cp", "library", "Copy a supported Library item when the backing resource supports copy semantics.", "library_fs", "cp", "write"),
     op("library.mv", "library", "Move or rename a Library item.", "library_fs", "mv", "write"),
     op("library.move_workspace", "library", "Move a Library item to another workspace.", "library_fs", "move_workspace", "destructive"),
@@ -773,14 +854,14 @@ function errorDetails(payload) {
   if (changedPaths.length > 0) {
     details.push(`Changed paths: ${changedPaths.join(", ")}`);
   }
-  const currentSourceVersion = pickString(payload, [
-    "current_source_version_id",
-    "currentSourceVersionId",
-    "source_version_id",
-    "sourceVersionId"
+  const currentSourceRevision = pickString(payload, [
+    "current_source_revision_id",
+    "currentSourceRevisionId",
+    "source_revision_id",
+    "sourceRevisionId"
   ]);
-  if (currentSourceVersion !== undefined) {
-    details.push(`Current source version: ${currentSourceVersion}`);
+  if (currentSourceRevision !== undefined) {
+    details.push(`Current source version: ${currentSourceRevision}`);
   }
   const code = pickString(payload, ["code", "errorCode", "error_code"]);
   if (code !== undefined) {
@@ -999,19 +1080,18 @@ CORE
 GEMS
   uru init <library/name.gem>                       Initialize a Gem project
   uru build [library/name.gem] --dry-run --outdir   Build/validate and export build manifest
-  uru deploy [library/name.gem] [--prod] [--dry-run] Server-side build/deploy/publish
-  uru deploy [library/name.gem] --skip-promote      Deploy without promoting the published link
-  uru promote <version-id> [library/name.gem]      Promote a staged Gem version/deployment
   uru status [library/name.gem]                     Local source status versus source lock
   uru logs [library/name.gem] [--limit 100] [--follow]
                                                     Runtime logs
-  uru open [library/name.gem]                       Print first published URL
-  uru rollback [<version-id>] [library/name.gem] --yes
-                                                    Roll back a live Gem link
+  uru open [library/name.gem] --link <id|name>       Print one explicit Link URL
   uru gems inspect|validate|build|status [library/name.gem]
-  uru gems versions upload [library/name.gem]       Create an immutable Gem version
-  uru gems versions deploy <version-id> [library/name.gem]
-  uru gems checks <version-id> [library/name.gem] [--deployment-id <id>]
+  uru gems edits list|show [library/name.gem]
+  uru gems versions save [library/name.gem] [--name "..."] [--message "..."]
+  uru gems versions list|show|diff|restore|preview [library/name.gem]
+  uru gems releases list|show|create|retry [library/name.gem]
+  uru gems links list|create|set-version|set-access|set-notifications|rotate|revoke
+  uru gems runs list|show|cancel|retry [library/name.gem]
+  uru gems logs [library/name.gem] [--release <id>|--run <id>]
   uru gems read <library/name.gem> <file>
   uru gems write <library/name.gem> <file> --file ./local.html
 
@@ -1163,23 +1243,7 @@ Initialize a Gem project in Library and link the current directory.
   build: `Usage: uru build [library/name.gem] [--dry-run] [--outdir <dir>] [--json]
 
 Validate/build the current Gem through the server-side build pipeline. Use
---dry-run --outdir to inspect the build manifest without deploying.
-`,
-  deploy: `Usage: uru deploy [library/name.gem] [--prod] [--skip-promote] [--no-wait] [--dry-run] [--json]
-
-Build and deploy a Gem through Uru's server-side lifecycle. The backend chooses
-Cloudflare/Fly/fallback from the Gem's compiled runtime contract; the CLI does
-not let users hand-pick providers. Deploy publishes/promotes by default unless
---skip-promote is supplied. Use --prod --skip-promote for a staged production
-deployment that can be promoted after checks; --prod cannot be combined with
---no-publish.
-`,
-  promote: `Usage: uru promote <version-id> [library/name.gem] [--link-id <published-link-id>] [--no-wait]
-       uru promote --deployment-id <deployment-id> [library/name.gem] [--link-id <published-link-id>] [--no-wait]
-
-Promote an already-staged immutable Gem version or ready deployment. With
---link-id, this is a published-link pointer flip after checks pass. If --link-id
-is omitted, Uru promotes through the default clean Gem link.
+--dry-run --outdir to inspect the build manifest without creating a Version.
 `,
   pull: `Usage: uru pull [library/name.gem] [--force]
 
@@ -1200,43 +1264,63 @@ Upload local Gem source with source-version CAS. Without a matching lock, push
 fails instead of silently overwriting remote edits. Generated directories,
 node_modules, VCS metadata, and local env files are excluded.
 `,
-  logs: `Usage: uru logs [library/name.gem] [--limit 100] [--follow]
+  logs: `Usage: uru logs [library/name.gem] [--release <id>|--run <id>] [--limit 100] [--follow]
 
-Print runtime/build logs for the Gem through the control plane. With --follow,
+Print bounded runtime logs for the Gem, one logical Release, or one Run. With --follow,
 the CLI polls for a bounded 5 minutes; text status goes to stderr and log lines
 go to stdout. Use global --output stream-json or --output-format stream-json
 before the command to emit NDJSON events.
 `,
-  open: `Usage: uru open [library/name.gem]
+  open: `Usage: uru open [library/name.gem] [--link <link-id-or-name>]
 
-Print the first available hosted/published Gem URL.
+Print one explicit active Link URL. When a Gem has more than one active Link,
+use --link to choose the Link rather than guessing which URL you mean.
 `,
-  rollback: `Usage: uru rollback [<version-id>] [library/name.gem] [--deployment-id <deployment-id>] [--link-id <published-link-id>] --yes
-
-Rollback retargets a live link to an already-materialized older Gem version or
-deployment after server-side rollback preflight passes. Requires --yes because it
-mutates live traffic. If --link-id is omitted, Uru rolls back through the active
-Primary Gem link.
-`,
-  gems: `Usage: uru gems <inspect|validate|build|status|read|write|versions|checks> [...]
+  gems: `Usage: uru gems <inspect|validate|build|status|read|write|edits|versions|releases|links|runs|logs> [...]
 
 Dedicated Gem lifecycle and filesystem commands. These are adapters over the
 same platform operations used by MCP and the web UI.
 `,
-  "gems versions": `Usage: uru gems versions upload [library/name.gem]
-       uru gems versions deploy <version-id> [library/name.gem] [--pct 100]
+  "gems versions": `Usage: uru gems versions save [library/name.gem] [--name "..."] [--message "..."]
+       uru gems versions list [library/name.gem]
+       uru gems versions show [library/name.gem] <version>
+       uru gems versions diff [library/name.gem] <from-version> <to-version>
+       uru gems versions restore [library/name.gem] <version>
+       uru gems versions preview [library/name.gem] <version>
+
+Save and inspect frozen Gem checkpoints. Name and message are optional. Saving,
+restoring, previewing, and comparing Versions do not change any Link.
+`,
+  "gems edits": `Usage: uru gems edits list [library/name.gem]
+       uru gems edits show [library/name.gem] <edit>
 
-Create immutable Gem versions and deploy them through the Gem control plane.
-Upload accepts --message, --tag/--tags, and --preview-alias. Non-100
-percentages are accepted only with --skip-promote to stage rollout intent; live
-promote/rollback requires 100 until weighted link routing is enabled.
+Inspect coherent changes in Edit history. Internal source snapshots are available
+only through diagnostics and are not a normal lifecycle command.
 `,
-  "gems checks": `Usage: uru gems checks <version-id> [library/name.gem] [--deployment-id <id>]
-       uru gems checks run browser|security [library/name.gem] [--deployment-id <id>] [--blocking]
+  "gems releases": `Usage: uru gems releases list [library/name.gem] [--cursor <cursor>] [--limit <n>]
+       uru gems releases show [library/name.gem] <release>
+       uru gems releases create [library/name.gem] <version>
+       uru gems releases retry [library/name.gem] <release>
 
-Inspect registered publish/deployment checks for an immutable Gem version, or run
-a browser/security check through the Gem control plane. Pass --blocking to make
-the check a release gate; security also accepts --deep.
+Create and inspect hosted Releases for explicit Versions. A Release never changes
+a Link. Embedded Gems are link-ready without a Release.
+`,
+  "gems links": `Usage: uru gems links list [library/name.gem]
+       uru gems links create [library/name.gem] --name <name> --version <version>
+       uru gems links set-version [library/name.gem] <link> <version>
+       uru gems links set-access [library/name.gem] <link> --gate <gate>
+       uru gems links set-notifications [library/name.gem] <link> <mode>
+       uru gems links rotate|revoke [library/name.gem] <link>
+
+Each Link independently selects one frozen Version. Changing one Link does not
+move any other Link.
+`,
+  "gems runs": `Usage: uru gems runs list [library/name.gem] [--cursor <cursor>] [--limit <n>] [--status <status>]
+       uru gems runs show [library/name.gem] <run>
+       uru gems runs cancel|retry [library/name.gem] <run>
+
+Inspect and control bounded Gem executions. Builds and Release attempts are not
+Runs. Gems without a bounded execution capability do not have Runs.
 `,
   library: `Usage: uru library ls [path]
        uru library search <query>
@@ -1537,43 +1621,6 @@ function stringField(record, keys) {
   }
   return;
 }
-function firstUrl(value) {
-  if (typeof value === "string" && /^https?:\/\//.test(value)) {
-    return value;
-  }
-  if (Array.isArray(value)) {
-    for (const item of value) {
-      const found = firstUrl(item);
-      if (found !== undefined) {
-        return found;
-      }
-    }
-    return;
-  }
-  if (!isJsonObject2(value)) {
-    return;
-  }
-  for (const key of [
-    "published_url",
-    "publishedUrl",
-    "preview_url",
-    "previewUrl",
-    "url",
-    "href"
-  ]) {
-    const candidate = value[key];
-    if (typeof candidate === "string" && /^https?:\/\//.test(candidate)) {
-      return candidate;
-    }
-  }
-  for (const candidate of Object.values(value)) {
-    const found = firstUrl(candidate);
-    if (found !== undefined) {
-      return found;
-    }
-  }
-  return;
-}
 function isJsonObject2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -1934,7 +1981,6 @@ function windowsCredentialNativePowerShell() {
 Add-Type -TypeDefinition @"
 using System;
 using System.Runtime.InteropServices;
-using System.Runtime.InteropServices.ComTypes;
 
 public static class UruCredentialNative
 {
@@ -1945,7 +1991,7 @@ public static class UruCredentialNative
         public UInt32 Type;
         public string TargetName;
         public string Comment;
-        public FILETIME LastWritten;
+        public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
         public UInt32 CredentialBlobSize;
         public IntPtr CredentialBlob;
         public UInt32 Persist;
@@ -2059,6 +2105,12 @@ var ERROR_TIPS = {
   oauth_request_failed: "Check the API URL and network access, then retry `uru login`; use `uru login --device` from SSH/headless environments.",
   oauth_device_failed: "Restart `uru login --device` and complete authorization in the browser before the code expires.",
   oauth_device_timeout: "Run `uru login --device` again and complete browser authorization before the timeout.",
+  oauth_refresh_invalid: "Run `uru login` again; the stored renewable login has expired or was revoked.",
+  oauth_refresh_token_missing: "Run `uru login` again; the OAuth server did not issue the renewable credential required by the CLI.",
+  oauth_resource_mismatch: "Check the configured API URL, then restart `uru login`; the OAuth server returned a different protected resource.",
+  oauth_invalid_token_type: "Restart `uru login`; the OAuth server returned an unsupported access-token type.",
+  oauth_logout_revocation_failed: "Local credentials were cleared. Check network access before logging in again if remote revocation must be confirmed.",
+  stored_oauth_credential_invalid: "Run `uru logout`, then `uru login` to replace the unreadable stored OAuth credential.",
   cancelled: "The command was cancelled; rerun it only if you still want the operation to continue."
 };
 function cliErrorJson(error) {
@@ -2130,8 +2182,8 @@ async function readSourceLock(cwd) {
       return {};
     }
     const lock = {};
-    if (typeof parsed["sourceVersionId"] === "string") {
-      lock.sourceVersionId = parsed["sourceVersionId"];
+    if (typeof parsed["sourceRevisionId"] === "string") {
+      lock.sourceRevisionId = parsed["sourceRevisionId"];
     }
     if (isRecord(parsed["files"])) {
       lock.files = Object.fromEntries(Object.entries(parsed["files"]).flatMap(([key, value]) => typeof value === "string" ? [[key, value]] : []));
@@ -2150,7 +2202,7 @@ async function readSourceLock(cwd) {
 async function writeSourceLock(cwd, lock) {
   const path = sourceLockPath(cwd);
   const sanitized = {
-    ...lock.sourceVersionId === undefined ? {} : { sourceVersionId: lock.sourceVersionId },
+    ...lock.sourceRevisionId === undefined ? {} : { sourceRevisionId: lock.sourceRevisionId },
     files: stableStringRecord(lock.files ?? {}),
     ...lock.checkedOutAt === undefined ? {} : { checkedOutAt: lock.checkedOutAt }
   };
@@ -2437,11 +2489,9 @@ var BOOLEAN_LOCAL_FLAGS = new Set([
   "--force-build",
   "--hard-delete",
   "--no-create",
-  "--no-publish",
   "--no-wait",
   "--permanent",
   "--prod",
-  "--skip-promote",
   "--stdin",
   "--value-stdin",
   "--yes"
@@ -2713,6 +2763,19 @@ async function registerOAuthClient(args) {
     scope: optionalStringField(response, "scope") ?? "mcp"
   };
 }
+async function discoverOAuthResource(args) {
+  const response = await fetchOAuthGet({
+    apiUrl: args.apiUrl,
+    path: "/.well-known/oauth-protected-resource",
+    ...args.fetch === undefined ? {} : { fetch: args.fetch }
+  });
+  if (!isRecord(response)) {
+    throw new CliError("Unexpected OAuth protected-resource metadata response.");
+  }
+  const resource = stringField2(response, "resource");
+  assertHttpUrl(resource, "OAuth protected resource");
+  return resource;
+}
 async function exchangeAuthorizationCode(args) {
   const body = new URLSearchParams;
   body.set("grant_type", "authorization_code");
@@ -2731,6 +2794,33 @@ async function exchangeAuthorizationCode(args) {
   });
   return normalizeOAuthTokenResponse(response);
 }
+async function refreshOAuthToken(args) {
+  const body = new URLSearchParams;
+  body.set("grant_type", "refresh_token");
+  body.set("client_id", args.clientId);
+  body.set("refresh_token", args.refreshToken);
+  body.set("resource", args.resource);
+  const response = await fetchOAuthForm({
+    apiUrl: args.apiUrl,
+    path: "/oauth/token",
+    body,
+    rejectedGrantErrorCode: "oauth_refresh_invalid",
+    ...args.fetch === undefined ? {} : { fetch: args.fetch }
+  });
+  return normalizeOAuthTokenResponse(response);
+}
+async function revokeOAuthToken(args) {
+  const body = new URLSearchParams;
+  body.set("token", args.token);
+  body.set("token_type_hint", "refresh_token");
+  body.set("client_id", args.clientId);
+  await fetchOAuthForm({
+    apiUrl: args.apiUrl,
+    path: "/oauth/revoke",
+    body,
+    ...args.fetch === undefined ? {} : { fetch: args.fetch }
+  });
+}
 async function exchangeOAuthForCliSession(args) {
   const body = {};
   if (args.workspaceId !== undefined && args.workspaceId.trim() !== "") {
@@ -2755,6 +2845,7 @@ async function exchangeOAuthForCliSession(args) {
     accessToken: stringField2(response, "access_token"),
     tokenType,
     expiresIn: numberField(response, "expires_in"),
+    oauthResource: stringField2(response, "oauth_resource"),
     ...workspaceId === undefined ? {} : { workspaceId }
   };
 }
@@ -2832,6 +2923,18 @@ async function fetchOAuthJson(args) {
   }
   return payload;
 }
+async function fetchOAuthGet(args) {
+  const fetchImpl = args.fetch ?? fetch;
+  const response = await fetchImpl(`${normalizeApiUrl(args.apiUrl)}${args.path}`, {
+    method: "GET",
+    headers: { Accept: "application/json" }
+  });
+  const payload = parseJsonResponse(await response.text());
+  if (!response.ok) {
+    throw oauthHttpError(response.status, payload);
+  }
+  return payload;
+}
 function tokenUrlSafe(byteLength) {
   return randomBytes(byteLength).toString("base64url");
 }
@@ -2850,10 +2953,7 @@ async function fetchOAuthForm(args) {
   });
   const payload = parseJsonResponse(await response.text());
   if (!response.ok && !(args.allowOAuthError === true && isOAuthError(payload))) {
-    throw new CliError(errorMessage2(payload) ?? `OAuth request failed: HTTP ${response.status}`, {
-      code: response.status === 401 || response.status === 403 ? ExitCode.AuthRequired : ExitCode.Failure,
-      errorCode: "oauth_request_failed"
-    });
+    throw oauthHttpError(response.status, payload, args.rejectedGrantErrorCode);
   }
   return payload;
 }
@@ -2908,14 +3008,47 @@ function normalizeOAuthTokenResponse(value) {
   const refreshToken = optionalStringField(value, "refresh_token");
   const scope = optionalStringField(value, "scope");
   const expiresInRaw = value["expires_in"];
+  const tokenType = stringField2(value, "token_type");
+  if (tokenType !== "Bearer") {
+    throw new CliError("OAuth token response used an unsupported token type.", {
+      code: ExitCode.AuthRequired,
+      errorCode: "oauth_invalid_token_type"
+    });
+  }
   return {
     accessToken: stringField2(value, "access_token"),
-    tokenType: stringField2(value, "token_type"),
+    tokenType,
     ...typeof expiresInRaw === "number" ? { expiresIn: expiresInRaw } : {},
     ...refreshToken === undefined ? {} : { refreshToken },
     ...scope === undefined ? {} : { scope }
   };
 }
+function oauthHttpError(status, payload, rejectedGrantErrorCode) {
+  const oauthError = isRecord(payload) && typeof payload["error"] === "string" ? payload["error"] : null;
+  const authRequired = status === 400 || status === 401 || status === 403 || status === 409;
+  const grantRejected = rejectedGrantErrorCode !== undefined && (oauthError === "invalid_grant" || oauthError === "invalid_target" || oauthError === "invalid_client");
+  return new CliError(errorMessage2(payload) ?? `OAuth request failed: HTTP ${status}`, {
+    code: authRequired ? ExitCode.AuthRequired : ExitCode.Failure,
+    errorCode: grantRejected ? rejectedGrantErrorCode : "oauth_request_failed"
+  });
+}
+function assertHttpUrl(value, label) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch (error) {
+    throw new CliError(`${label} is not a valid URL.`, {
+      errorCode: "oauth_invalid_response",
+      cause: error
+    });
+  }
+  const loopbackHostname = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopbackHostname)) {
+    throw new CliError(`${label} must use HTTPS except on loopback.`, {
+      errorCode: "oauth_invalid_response"
+    });
+  }
+}
 function stringField2(value, key) {
   const field = value[key];
   if (typeof field !== "string" || field.trim() === "") {
@@ -2952,12 +3085,203 @@ function defaultSleep(milliseconds) {
   return new Promise((resolve2) => setTimeout(resolve2, milliseconds));
 }
 
+// src/oauth-credential.ts
+var OAUTH_CREDENTIAL_PREFIX = "uru_cli_oauth_v1:";
+var SESSION_REFRESH_LEEWAY_MS = 5 * 60 * 1000;
+function createStoredCliOAuthCredential(args) {
+  const nowMs = args.nowMs ?? Date.now();
+  if (!Number.isFinite(args.sessionExpiresIn) || args.sessionExpiresIn <= 0) {
+    throw invalidStoredCredential("CLI session lifetime is invalid.");
+  }
+  return {
+    version: 1,
+    sessionAccessToken: requiredSecret(args.sessionAccessToken, "CLI session access token"),
+    sessionExpiresAt: nowMs + args.sessionExpiresIn * 1000,
+    oauthRefreshToken: requiredSecret(args.oauthRefreshToken, "OAuth refresh token"),
+    oauthClientId: requiredValue(args.oauthClientId, "OAuth client id"),
+    oauthResource: requiredHttpsResource(args.oauthResource),
+    ...args.workspaceId === undefined || args.workspaceId.trim() === "" ? {} : { workspaceId: args.workspaceId.trim() }
+  };
+}
+function serializeStoredCliOAuthCredential(credential) {
+  return `${OAUTH_CREDENTIAL_PREFIX}${Buffer.from(JSON.stringify(credential), "utf8").toString("base64url")}`;
+}
+function parseStoredCliOAuthCredential(storedValue) {
+  if (!storedValue.startsWith(OAUTH_CREDENTIAL_PREFIX)) {
+    return null;
+  }
+  let parsed;
+  try {
+    const encoded = storedValue.slice(OAUTH_CREDENTIAL_PREFIX.length);
+    parsed = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+  } catch (error) {
+    throw invalidStoredCredential("Stored CLI OAuth credential is unreadable.", error);
+  }
+  if (!isRecord(parsed) || parsed["version"] !== 1) {
+    throw invalidStoredCredential("Stored CLI OAuth credential version is invalid.");
+  }
+  const sessionAccessToken = recordString(parsed, "sessionAccessToken");
+  const oauthRefreshToken = recordString(parsed, "oauthRefreshToken");
+  const oauthClientId = recordString(parsed, "oauthClientId");
+  const oauthResource = recordString(parsed, "oauthResource");
+  const sessionExpiresAt = parsed["sessionExpiresAt"];
+  const workspaceId = optionalRecordString(parsed, "workspaceId");
+  if (sessionAccessToken === null || oauthRefreshToken === null || oauthClientId === null || oauthResource === null || typeof sessionExpiresAt !== "number" || !Number.isFinite(sessionExpiresAt) || sessionExpiresAt <= 0) {
+    throw invalidStoredCredential("Stored CLI OAuth credential is incomplete.");
+  }
+  return {
+    version: 1,
+    sessionAccessToken,
+    sessionExpiresAt,
+    oauthRefreshToken,
+    oauthClientId,
+    oauthResource: requiredHttpsResource(oauthResource),
+    ...workspaceId === null ? {} : { workspaceId }
+  };
+}
+function cliOAuthCredentialNeedsRefresh(credential, workspaceId, nowMs = Date.now()) {
+  const requestedWorkspace = workspaceId?.trim();
+  if (requestedWorkspace !== undefined && requestedWorkspace !== "" && requestedWorkspace !== credential.workspaceId) {
+    return true;
+  }
+  return credential.sessionExpiresAt <= nowMs + SESSION_REFRESH_LEEWAY_MS;
+}
+function recordString(value, key) {
+  const item = value[key];
+  return typeof item === "string" && item.trim() !== "" ? item : null;
+}
+function optionalRecordString(value, key) {
+  const item = value[key];
+  return typeof item === "string" && item.trim() !== "" ? item.trim() : null;
+}
+function requiredSecret(value, label) {
+  return requiredValue(value, label);
+}
+function requiredValue(value, label) {
+  const normalized = value.trim();
+  if (normalized === "") {
+    throw invalidStoredCredential(`${label} is missing.`);
+  }
+  return normalized;
+}
+function requiredHttpsResource(value) {
+  const normalized = requiredValue(value, "OAuth resource");
+  let resource;
+  try {
+    resource = new URL(normalized);
+  } catch (error) {
+    throw invalidStoredCredential("OAuth resource is not a valid URL.", error);
+  }
+  const loopbackHostname = resource.hostname === "localhost" || resource.hostname === "127.0.0.1" || resource.hostname === "[::1]";
+  if (resource.protocol !== "https:" && !(resource.protocol === "http:" && loopbackHostname)) {
+    throw invalidStoredCredential("OAuth resource must use HTTPS.");
+  }
+  return normalized;
+}
+function invalidStoredCredential(message, cause) {
+  return new CliError(message, {
+    code: ExitCode.AuthRequired,
+    errorCode: "stored_oauth_credential_invalid",
+    ...cause === undefined ? {} : { cause }
+  });
+}
+
 // src/auth-commands.ts
 var OAUTH_CALLBACK_PATH = "/oauth/callback";
 var OAUTH_CALLBACK_TIMEOUT_MS = 5 * 60 * 1000;
 var DEVICE_MAX_POLLS = 120;
-async function resolveStoredToken(credentialStore, apiUrl, config) {
-  return await credentialStore.readToken(apiUrl) ?? (config.insecureStorage === true ? config.token : undefined);
+async function resolveStoredToken(options) {
+  const keychainValue = await options.credentialStore.readToken(options.apiUrl);
+  const source = keychainValue === undefined ? "config" : "keychain";
+  const storedValue = keychainValue ?? (options.config.insecureStorage === true ? options.config.token : undefined);
+  if (storedValue === undefined) {
+    return;
+  }
+  let credential;
+  try {
+    credential = parseStoredCliOAuthCredential(storedValue);
+  } catch (error) {
+    if (options.recoverInvalidCredential === true) {
+      return;
+    }
+    throw error;
+  }
+  if (credential === null) {
+    return storedValue;
+  }
+  if (!cliOAuthCredentialNeedsRefresh(credential, options.workspaceId)) {
+    return credential.sessionAccessToken;
+  }
+  try {
+    const refreshed = await refreshOAuthToken({
+      apiUrl: options.apiUrl,
+      clientId: credential.oauthClientId,
+      refreshToken: credential.oauthRefreshToken,
+      resource: credential.oauthResource,
+      ...options.fetch === undefined ? {} : { fetch: options.fetch }
+    });
+    const rotatedRefreshToken = requireRefreshToken(refreshed);
+    await persistResolvedCredential(options, source, serializeStoredCliOAuthCredential({
+      ...credential,
+      oauthRefreshToken: rotatedRefreshToken
+    }));
+    const session = await exchangeOAuthForCliSession({
+      apiUrl: options.apiUrl,
+      oauthAccessToken: refreshed.accessToken,
+      ...options.workspaceId === undefined ? {} : { workspaceId: options.workspaceId },
+      ...options.fetch === undefined ? {} : { fetch: options.fetch }
+    });
+    if (session.oauthResource !== credential.oauthResource) {
+      throw new CliError("Refreshed CLI session OAuth resource did not match the stored credential.", {
+        code: ExitCode.AuthRequired,
+        errorCode: "oauth_resource_mismatch"
+      });
+    }
+    const nextCredential = createStoredCliOAuthCredential({
+      sessionAccessToken: session.accessToken,
+      sessionExpiresIn: session.expiresIn,
+      oauthRefreshToken: rotatedRefreshToken,
+      oauthClientId: credential.oauthClientId,
+      oauthResource: session.oauthResource,
+      ...session.workspaceId === undefined ? {} : { workspaceId: session.workspaceId }
+    });
+    await persistResolvedCredential(options, source, serializeStoredCliOAuthCredential(nextCredential));
+    return nextCredential.sessionAccessToken;
+  } catch (error) {
+    if (!isStoredRefreshRejected(error)) {
+      throw error;
+    }
+    await clearResolvedCredential(options, source);
+    return;
+  }
+}
+async function revokeStoredOAuthLogin(args) {
+  const storedValue = await args.credentialStore.readToken(args.apiUrl) ?? (args.config.insecureStorage === true ? args.config.token : undefined);
+  if (storedValue === undefined) {
+    return;
+  }
+  const credential = parseStoredCliOAuthCredential(storedValue);
+  if (credential === null) {
+    return;
+  }
+  const sessionClient = new UruApiClient({
+    apiUrl: args.apiUrl,
+    token: credential.sessionAccessToken,
+    ...args.fetch === undefined ? {} : { fetch: args.fetch }
+  });
+  const revocations = await Promise.allSettled([
+    sessionClient.api("/api/auth/logout", { method: "POST" }),
+    revokeOAuthToken({
+      apiUrl: args.apiUrl,
+      clientId: credential.oauthClientId,
+      token: credential.oauthRefreshToken,
+      ...args.fetch === undefined ? {} : { fetch: args.fetch }
+    })
+  ]);
+  const rejected = revocations.find((result) => result.status === "rejected");
+  if (rejected !== undefined) {
+    throw rejected.reason;
+  }
 }
 async function resolveFlagToken(flags, stdin) {
   if (flags.token !== undefined) {
@@ -2991,20 +3315,26 @@ async function resolveFlagToken(flags, stdin) {
 }
 async function login(ctx, options = {}) {
   const existingToken = ctx.token === undefined || ctx.token.trim() === "" ? undefined : ctx.token;
-  let token = existingToken ?? await obtainLoginSessionToken(ctx);
+  const existingStoredValue = existingToken !== undefined && !ctx.tokenIsExplicit ? await readStoredLoginValue(ctx) : undefined;
+  let usedExistingToken = existingToken !== undefined;
+  let loginToken = existingToken === undefined ? await obtainLoginSessionToken(ctx) : {
+    accessToken: existingToken,
+    storedValue: existingStoredValue ?? existingToken
+  };
   let result;
   try {
-    result = await validateSessionToken(ctx, token);
+    result = await validateSessionToken(ctx, loginToken.accessToken);
   } catch (error) {
     const storedTokenIsStale = existingToken !== undefined && !ctx.tokenIsExplicit && isAuthRequiredError(error);
     if (!storedTokenIsStale) {
       throw error;
     }
-    token = await obtainLoginSessionToken(ctx);
-    result = await validateSessionToken(ctx, token);
+    loginToken = await obtainLoginSessionToken(ctx);
+    usedExistingToken = false;
+    result = await validateSessionToken(ctx, loginToken.accessToken);
   }
   const selectedWorkspace = selectWorkspace(result, ctx.workspace);
-  await persistLoginToken(ctx, token, selectedWorkspace);
+  await persistLoginToken(ctx, loginToken.storedValue, selectedWorkspace);
   if (options.silentSuccess === true) {
     return;
   }
@@ -3017,12 +3347,15 @@ async function login(ctx, options = {}) {
       workspaceId: selectedWorkspace,
       workspaceSelectionRequired: result.workspaceSelectionRequired,
       storage: ctx.insecureStorage ? "insecure_file" : "keychain",
-      auth: ctx.token === token ? "token" : ctx.device ? "device_oauth" : "browser_oauth"
+      auth: usedExistingToken ? "token" : ctx.device ? "device_oauth" : "browser_oauth"
     });
   } else {
     writeText(ctx.io, ctx.insecureStorage ? "Logged in (token stored in local config)" : "Logged in");
   }
 }
+async function readStoredLoginValue(ctx) {
+  return await ctx.credentialStore.readToken(ctx.apiUrl) ?? (ctx.config.insecureStorage === true ? ctx.config.token : undefined);
+}
 async function validateSessionToken(ctx, token) {
   const loginClient = new UruApiClient({
     apiUrl: ctx.apiUrl,
@@ -3035,6 +3368,9 @@ async function validateSessionToken(ctx, token) {
 function isAuthRequiredError(error) {
   return error instanceof CliError && error.exitCode === ExitCode.AuthRequired;
 }
+function isStoredRefreshRejected(error) {
+  return error instanceof CliError && error.errorCode === "oauth_refresh_invalid";
+}
 async function readAllStdin(input) {
   const chunks = [];
   for await (const chunk of input) {
@@ -3052,6 +3388,10 @@ async function obtainLoginSessionToken(ctx) {
   return loginWithBrowser(ctx);
 }
 async function loginWithDeviceCode(ctx) {
+  const resource = await discoverOAuthResource({
+    apiUrl: ctx.apiUrl,
+    ...ctx.fetch === undefined ? {} : { fetch: ctx.fetch }
+  });
   const clientRegistration = await registerOAuthClient({
     apiUrl: ctx.apiUrl,
     redirectUri: buildLoopbackRedirectUri({
@@ -3070,6 +3410,7 @@ async function loginWithDeviceCode(ctx) {
     apiUrl: ctx.apiUrl,
     clientId: clientRegistration.clientId,
     scope: clientRegistration.scope,
+    resource,
     ...ctx.fetch !== undefined ? { fetch: ctx.fetch } : {}
   });
   const complete = authorization.verificationUriComplete ?? authorization.verificationUri;
@@ -3086,7 +3427,7 @@ async function loginWithDeviceCode(ctx) {
     maxPolls: Math.min(DEVICE_MAX_POLLS, Math.ceil(authorization.expiresIn / Math.max(1, authorization.interval))),
     ...ctx.fetch !== undefined ? { fetch: ctx.fetch } : {}
   });
-  return exchangeOAuthTokenForSession(ctx, token);
+  return exchangeOAuthTokenForSession(ctx, token, clientRegistration.clientId, resource);
 }
 async function loginWithBrowser(ctx) {
   const callbackHost = ctx.callbackHost;
@@ -3095,6 +3436,10 @@ async function loginWithBrowser(ctx) {
     ...ctx.callbackPort === undefined ? {} : { port: ctx.callbackPort }
   });
   try {
+    const resource = await discoverOAuthResource({
+      apiUrl: ctx.apiUrl,
+      ...ctx.fetch === undefined ? {} : { fetch: ctx.fetch }
+    });
     const redirectUri = buildLoopbackRedirectUri({
       host: callbackHost,
       port: callback.port,
@@ -3113,7 +3458,8 @@ async function loginWithBrowser(ctx) {
       redirectUri,
       scope: clientRegistration.scope,
       state,
-      codeChallenge: pkce.challenge
+      codeChallenge: pkce.challenge,
+      resource
     });
     await maybeCopyLoginUrl(ctx, authorizationUrl);
     if (ctx.noOpen) {
@@ -3132,21 +3478,40 @@ async function loginWithBrowser(ctx) {
       code: authorization.code,
       redirectUri,
       codeVerifier: pkce.verifier,
+      resource,
       ...ctx.fetch !== undefined ? { fetch: ctx.fetch } : {}
     });
-    return exchangeOAuthTokenForSession(ctx, token);
+    return exchangeOAuthTokenForSession(ctx, token, clientRegistration.clientId, resource);
   } finally {
     callback.close();
   }
 }
-async function exchangeOAuthTokenForSession(ctx, token) {
+async function exchangeOAuthTokenForSession(ctx, token, clientId, resource) {
+  const refreshToken = requireRefreshToken(token);
   const session = await exchangeOAuthForCliSession({
     apiUrl: ctx.apiUrl,
     oauthAccessToken: token.accessToken,
     ...ctx.workspace !== undefined ? { workspaceId: ctx.workspace } : {},
     ...ctx.fetch !== undefined ? { fetch: ctx.fetch } : {}
   });
-  return session.accessToken;
+  if (session.oauthResource !== resource) {
+    throw new CliError("CLI session OAuth resource did not match discovery.", {
+      code: ExitCode.AuthRequired,
+      errorCode: "oauth_resource_mismatch"
+    });
+  }
+  const credential = createStoredCliOAuthCredential({
+    sessionAccessToken: session.accessToken,
+    sessionExpiresIn: session.expiresIn,
+    oauthRefreshToken: refreshToken,
+    oauthClientId: clientId,
+    oauthResource: session.oauthResource,
+    ...session.workspaceId === undefined ? {} : { workspaceId: session.workspaceId }
+  });
+  return {
+    accessToken: session.accessToken,
+    storedValue: serializeStoredCliOAuthCredential(credential)
+  };
 }
 async function persistLoginToken(ctx, token, selectedWorkspace) {
   if (ctx.insecureStorage) {
@@ -3173,6 +3538,40 @@ async function persistLoginToken(ctx, token, selectedWorkspace) {
   };
   await ctx.store.write(nextConfig);
 }
+function requireRefreshToken(token) {
+  const refreshToken = token.refreshToken?.trim();
+  if (refreshToken === undefined || refreshToken === "") {
+    throw new CliError("OAuth server did not issue a refresh token for the CLI.", {
+      code: ExitCode.AuthRequired,
+      errorCode: "oauth_refresh_token_missing"
+    });
+  }
+  return refreshToken;
+}
+async function persistResolvedCredential(options, source, storedValue) {
+  if (source === "keychain") {
+    await options.credentialStore.writeToken(options.apiUrl, storedValue);
+    return;
+  }
+  await options.store.write({
+    ...options.config,
+    apiUrl: options.apiUrl,
+    token: storedValue,
+    insecureStorage: true
+  });
+}
+async function clearResolvedCredential(options, source) {
+  if (source === "keychain") {
+    await options.credentialStore.clearToken(options.apiUrl);
+    return;
+  }
+  const {
+    token: _token,
+    insecureStorage: _insecureStorage,
+    ...safeConfig
+  } = options.config;
+  await options.store.write(safeConfig);
+}
 async function maybeCopyLoginUrl(ctx, url) {
   if (!ctx.clipboard) {
     return;
@@ -3276,6 +3675,7 @@ async function switchWorkspace(ctx, workspaceId) {
 // src/local-commands.ts
 import { mkdir as mkdir3, readFile as readFile4, writeFile as writeFile3 } from "node:fs/promises";
 import { dirname as dirname3, resolve as resolve2 } from "node:path";
+var DEFAULT_MCP_PACKAGE = package_default.uru.mcpPackage;
 var GENERIC_FAMILY_COMMANDS = {
   workspace: "workspace",
   sharing: "sharing",
@@ -3304,15 +3704,12 @@ var TOP_LEVEL_COMMANDS = [
   "tools",
   "init",
   "build",
-  "deploy",
-  "promote",
   "pull",
   "status",
   "diff",
   "push",
   "logs",
   "open",
-  "rollback",
   "gems",
   "automations",
   "library",
@@ -3405,7 +3802,7 @@ async function dispatchMcp(ctx, sub, args) {
   const config = mcpServerConfig({
     apiKey: flags.values["--api-key"] ?? ctx.token,
     serverName: flags.values["--server-name"] ?? "uru",
-    packageName: flags.values["--package"] ?? "uru-mcp@latest"
+    packageName: flags.values["--package"] ?? DEFAULT_MCP_PACKAGE
   });
   if (sub === "config") {
     writeJson(ctx.io, config);
@@ -3769,7 +4166,7 @@ function mcpServerConfig(args) {
     mcpServers: {
       [args.serverName]: {
         command: "npx",
-        args: [args.packageName],
+        args: ["-y", args.packageName],
         env: { URU_API_KEY: apiKey }
       }
     }
@@ -3818,129 +4215,414 @@ function levenshtein(left, right) {
 import { mkdir as mkdir4, readFile as readFile5, writeFile as writeFile4 } from "node:fs/promises";
 import { setTimeout as sleep } from "node:timers/promises";
 import { join as join3, resolve as resolve3 } from "node:path";
-async function dispatchGems(ctx, sub, args, linkedProject) {
-  const flags = parseLocalFlags(args);
-  const gemPath = () => gemPathFromArgs(flags, linkedProject);
-  if (sub === "inspect") {
-    await emitGemTool(ctx, "gem.inspect", { path: gemPath() });
-    return;
+
+// src/gem-lifecycle-resource-commands.ts
+async function dispatchGemLifecycleResourceCommand(ctx, sub, args, linkedProject) {
+  if (sub === "versions") {
+    await dispatchGemVersions(ctx, args, linkedProject);
+    return true;
   }
-  if (sub === "validate") {
-    await emitGemTool(ctx, "gem.validate", { path: gemPath() });
-    return;
+  if (sub === "edits") {
+    await dispatchGemEdits(ctx, args, linkedProject);
+    return true;
   }
-  if (sub === "build") {
-    await gemBuild(ctx, args, linkedProject);
-    return;
+  if (sub === "releases") {
+    await dispatchGemReleases(ctx, args, linkedProject);
+    return true;
   }
-  if (sub === "versions") {
-    await dispatchGemVersions(ctx, args, linkedProject);
-    return;
+  if (sub === "links") {
+    await dispatchGemLinks(ctx, args, linkedProject);
+    return true;
   }
-  if (sub === "checks") {
-    await gemChecks(ctx, args, linkedProject);
+  if (sub === "runs") {
+    await dispatchGemRuns(ctx, args, linkedProject);
+    return true;
+  }
+  return false;
+}
+async function dispatchGemVersions(ctx, args, linkedProject) {
+  const [verb, ...rest] = args;
+  if (verb === "save") {
+    await gemVersionSave(ctx, rest, linkedProject);
     return;
   }
-  if (sub === "status") {
-    await emitGemTool(ctx, "gem.status", { path: gemPath() });
+  if (verb === "list") {
+    const flags = parseLocalFlags(rest);
+    const params = {
+      path: gemPathFromArgs(flags, linkedProject)
+    };
+    copyStringFlag(flags, params, "--cursor", "cursor");
+    copyOptionalIntegerFlag(flags, params, "--limit", "limit");
+    await emitGemTool(ctx, "gem.versions_list", params);
     return;
   }
-  if (sub === "read") {
-    const [path, file] = args;
-    await emitGemTool(ctx, "gem.fs_read", {
-      path: gemFilePath(requireCommandValue(path, "Usage: uru gems read <gem-path> <file>"), requireCommandValue(file, "Usage: uru gems read <gem-path> <file>"))
-    });
+  if (verb === "show" || verb === "restore" || verb === "preview") {
+    const flags = parseLocalFlags(rest);
+    const version = lifecycleResourceArg(flags, `Usage: uru gems versions ${verb} <gem> <version>`);
+    const path = gemPathFromArgs(flags, linkedProject);
+    await emitGemTool(ctx, verb === "show" ? "gem.version_get" : verb === "restore" ? "gem.version_restore" : "gem.version_preview", { path, version_id: version }, verb === "restore" ? { textExtractor: extractVersionRestoreSummary } : undefined);
     return;
   }
-  if (sub === "write") {
-    await gemWrite(ctx, args);
+  if (verb === "diff") {
+    const flags = parseLocalFlags(rest);
+    const [fromVersion, toVersion] = lifecycleResourceArgs(flags, 2, "Usage: uru gems versions diff <gem> <from-version> <to-version>");
+    await emitGemTool(ctx, "gem.version_diff", {
+      path: gemPathFromArgs(flags, linkedProject),
+      from_version_id: requireCommandValue(fromVersion, "Missing from-version"),
+      to_version_id: requireCommandValue(toVersion, "Missing to-version")
+    });
     return;
   }
-  throw new CliError("Usage: uru gems inspect|validate|build|versions|checks|status|read|write");
+  throw new CliError("Usage: uru gems versions list <gem> | save <gem> [--name ...] [--message ...] | show <gem> <version> | diff <gem> <from> <to> | restore <gem> <version> | preview <gem> <version>");
 }
-async function gemInit(ctx, args) {
+async function gemVersionSave(ctx, args, linkedProject) {
   const flags = parseLocalFlags(args);
-  const path = requireCommandValue(flags.positionals[0], "Usage: uru init <library/name.gem> [--entrypoint main.html] [--file ./main.html]");
-  const params = { path };
+  assertAllowedLocalFlags(flags, ["--gem", "--idempotency-key", "--message", "--name", "--path"], "uru gems versions save");
+  const gemPath = gemPathFromArgs(flags, linkedProject);
+  const params = { path: gemPath };
   copyStringFlag(flags, params, "--name", "name");
-  copyStringFlag(flags, params, "--description", "description");
-  copyStringFlag(flags, params, "--entrypoint", "entrypoint");
-  copyStringFlag(flags, params, "--runtime", "runtime");
-  copyStringFlag(flags, params, "--visibility", "visibility");
-  if (flags.values["--content"] !== undefined) {
-    params["content"] = flags.values["--content"];
+  copyStringFlag(flags, params, "--message", "message");
+  copyStringFlag(flags, params, "--idempotency-key", "idempotency_key");
+  await emitGemTool(ctx, "gem.version_save", params, {
+    streamStart: { operation: "gem.version_save", path: gemPath },
+    textExtractor: extractVersionSaveSummary
+  });
+}
+async function dispatchGemEdits(ctx, args, linkedProject) {
+  const [verb, ...rest] = args;
+  const flags = parseLocalFlags(rest);
+  if (verb === "list") {
+    const params = {
+      path: gemPathFromArgs(flags, linkedProject)
+    };
+    copyStringFlag(flags, params, "--cursor", "cursor");
+    copyOptionalIntegerFlag(flags, params, "--limit", "limit");
+    await emitGemTool(ctx, "gem.edits_list", params);
+    return;
   }
-  if (flags.values["--file"] !== undefined) {
-    params["content"] = await readFile5(flags.values["--file"], "utf8");
+  if (verb === "show") {
+    const editId = requireCommandValue(lifecycleResourceArg(flags, "Usage: uru gems edits show <gem> <edit>"), "Usage: uru gems edits show <gem> <edit>");
+    await emitGemTool(ctx, "gem.edit_get", {
+      path: gemPathFromArgs(flags, linkedProject),
+      edit_id: editId
+    });
+    return;
   }
-  await emitGemTool(ctx, "gem.init", params);
+  throw new CliError("Usage: uru gems edits list <gem> | show <gem> <edit>");
 }
-async function gemDeploy(ctx, args, linkedProject) {
-  const flags = parseLocalFlags(args);
-  rejectUnsupportedLocalFlags(flags, ["--runtime-provider", "--provider-deployment-id"], "Provider routing is chosen by the Gem runtime contract; the CLI does not accept provider-internal deploy flags.");
-  assertAllowedLocalFlags(flags, [
-    "--build-id",
-    "--dry-run",
-    "--force-build",
-    "--gem",
-    "--link-id",
-    "--no-publish",
-    "--no-wait",
-    "--path",
-    "--prod",
-    "--skip-promote",
-    "--source-version-id"
-  ], "uru deploy");
-  if (flags.booleans.has("--prod") && flags.booleans.has("--no-publish")) {
-    throw new CliError("uru deploy --prod cannot be combined with --no-publish. Use --skip-promote for a staged production deployment.");
-  }
-  if (flags.booleans.has("--dry-run")) {
-    const buildArgs = [...flags.positionals, "--dry-run"];
-    for (const flag of ["--path", "--gem"]) {
-      const value = flags.values[flag];
-      if (value !== undefined) {
-        buildArgs.push(flag, value);
+async function dispatchGemReleases(ctx, args, linkedProject) {
+  const [verb, ...rest] = args;
+  const flags = parseLocalFlags(rest);
+  if (verb === "list") {
+    const params = {
+      path: gemPathFromArgs(flags, linkedProject)
+    };
+    copyStringFlag(flags, params, "--cursor", "cursor");
+    copyOptionalIntegerFlag(flags, params, "--limit", "limit");
+    await emitGemTool(ctx, "gem.releases_list", params);
+    return;
+  }
+  if (verb === "create") {
+    const versionId = lifecycleResourceArg(flags, "Usage: uru gems releases create <gem> <version>");
+    const path = gemPathFromArgs(flags, linkedProject);
+    await emitGemTool(ctx, "gem.release_create", {
+      path,
+      version_id: versionId
+    }, {
+      streamStart: { operation: "gem.release_create", path },
+      textExtractor: extractReleaseSummary
+    });
+    return;
+  }
+  if (verb === "show" || verb === "retry") {
+    const releaseId = lifecycleResourceArg(flags, `Usage: uru gems releases ${verb} <gem> <release>`);
+    const path = gemPathFromArgs(flags, linkedProject);
+    const params = { path, release_id: releaseId };
+    await emitGemTool(ctx, verb === "show" ? "gem.release_get" : "gem.release_retry", params, verb === "retry" ? { textExtractor: extractReleaseSummary } : undefined);
+    return;
+  }
+  throw new CliError("Usage: uru gems releases list|show|create|retry");
+}
+async function dispatchGemLinks(ctx, args, linkedProject) {
+  const [verb, ...rest] = args;
+  const flags = parseLocalFlags(rest);
+  if (verb === "list") {
+    await emitGemTool(ctx, "gem.links_list", {
+      path: gemPathFromArgs(flags, linkedProject)
+    });
+    return;
+  }
+  if (verb === "create") {
+    const path = gemPathFromArgs(flags, linkedProject);
+    await emitGemTool(ctx, "gem.link_create", {
+      path,
+      name: requireCommandValue(flags.values["--name"], "links create requires --name"),
+      version_id: requireCommandValue(flags.values["--version"], "links create requires --version")
+    }, { textExtractor: extractLinkCreateSummary });
+    return;
+  }
+  if (verb === "set-version") {
+    const [linkId, versionId] = lifecycleResourceArgs(flags, 2, "Usage: uru gems links set-version <gem> <link> <version>");
+    await emitGemTool(ctx, "gem.link_set_version", {
+      path: gemPathFromArgs(flags, linkedProject),
+      link_id: requireCommandValue(linkId, "Missing Link"),
+      version_id: requireCommandValue(versionId, "Missing Version")
+    }, {
+      textExtractor: extractLinkVersionSummary
+    });
+    return;
+  }
+  if (verb === "set-access") {
+    const linkId = lifecycleResourceArg(flags, "Usage: uru gems links set-access <gem> <link> --gate <public|password|email>");
+    const params = {
+      path: gemPathFromArgs(flags, linkedProject),
+      link_id: linkId,
+      gate_type: requireCommandValue(flags.values["--gate"], "links set-access requires --gate")
+    };
+    copyStringFlag(flags, params, "--passcode", "passcode");
+    const emailAllowlist = flags.values["--email-allowlist"];
+    if (emailAllowlist !== undefined) {
+      params["email_allowlist"] = emailAllowlist.split(",").map((email) => email.trim()).filter((email) => email.length > 0);
+    }
+    copyStringFlag(flags, params, "--expires-at", "expires_at");
+    await emitGemTool(ctx, "gem.link_set_access", params);
+    return;
+  }
+  if (verb === "set-notifications") {
+    const [linkId, mode] = lifecycleResourceArgs(flags, 2, "Usage: uru gems links set-notifications <gem> <link> <mode>");
+    await emitGemTool(ctx, "gem.link_set_notifications", {
+      path: gemPathFromArgs(flags, linkedProject),
+      link_id: requireCommandValue(linkId, "Missing Link"),
+      view_notification_mode: requireCommandValue(mode, "Missing notification mode")
+    });
+    return;
+  }
+  if (verb === "rotate" || verb === "revoke") {
+    const linkId = lifecycleResourceArg(flags, `Usage: uru gems links ${verb} <gem> <link>`);
+    await emitGemTool(ctx, verb === "rotate" ? "gem.link_rotate" : "gem.link_revoke", {
+      path: gemPathFromArgs(flags, linkedProject),
+      link_id: linkId
+    });
+    return;
+  }
+  throw new CliError("Usage: uru gems links list|create|set-version|set-access|set-notifications|rotate|revoke");
+}
+async function dispatchGemRuns(ctx, args, linkedProject) {
+  const [verb, ...rest] = args;
+  const flags = parseLocalFlags(rest);
+  if (verb === "list") {
+    const params = {
+      path: gemPathFromArgs(flags, linkedProject)
+    };
+    copyStringFlag(flags, params, "--cursor", "cursor");
+    copyStringFlag(flags, params, "--status", "status");
+    copyOptionalIntegerFlag(flags, params, "--limit", "limit");
+    await emitGemTool(ctx, "gem.runs_list", params);
+    return;
+  }
+  if (verb === "show" || verb === "cancel" || verb === "retry") {
+    const runId = lifecycleResourceArg(flags, `Usage: uru gems runs ${verb} <gem> <run>`);
+    await emitGemTool(ctx, verb === "show" ? "gem.run_get" : verb === "cancel" ? "gem.run_cancel" : "gem.run_retry", {
+      path: gemPathFromArgs(flags, linkedProject),
+      run_id: runId
+    });
+    return;
+  }
+  throw new CliError("Usage: uru gems runs list <gem> | show|cancel|retry <gem> <run>");
+}
+function extractVersionSaveSummary(value) {
+  const objects = collectJsonObjects(value);
+  const version = versionLabel(objects);
+  return `Saved Version${version === null ? "" : ` ${version}`}. No Links changed.`;
+}
+function extractVersionRestoreSummary(value) {
+  const version = versionLabel(collectJsonObjects(value));
+  return `Restored Version${version === null ? "" : ` ${version}`} to Draft. No Links changed.`;
+}
+function extractReleaseSummary(value) {
+  const objects = collectJsonObjects(value);
+  const version = versionLabel(objects);
+  const state = stringFieldFromJsonObjects(objects, [
+    "state",
+    "status",
+    "release_state",
+    "release_status"
+  ]);
+  const stateLabel = state === null || state === "ready" || state === "succeeded" ? "ready" : state === "queued" || state === "building" || state === "preparing" ? "preparing" : state.replaceAll("_", " ").toLowerCase();
+  return `Release ${stateLabel} for Version${version === null ? "" : ` ${version}`}. No Links changed.`;
+}
+function extractLinkCreateSummary(value) {
+  const objects = collectJsonObjects(value);
+  const name = stringFieldFromJsonObjects(objects, ["name", "link_name"]);
+  const version = versionLabel(objects);
+  return `Created ${name ?? "Link"}. It opens Version${version === null ? "" : ` ${version}`}. Other Links did not change.`;
+}
+function extractLinkVersionSummary(value) {
+  const objects = collectJsonObjects(value);
+  const name = stringFieldFromJsonObjects(objects, ["name", "link_name"]);
+  const version = versionLabel(objects);
+  return `${name ?? "Link"} now opens Version${version === null ? "" : ` ${version}`}. Other Links did not change.`;
+}
+function versionLabel(objects) {
+  for (const object of objects) {
+    for (const key of [
+      "version_number",
+      "versionNumber",
+      "gem_version_number",
+      "gemVersionNumber"
+    ]) {
+      const value = object[key];
+      if (typeof value === "number") {
+        if (Number.isSafeInteger(value) && value > 0) {
+          return String(value);
+        }
+        throw new CliError(`Invalid unsafe Version number: ${value}`);
+      }
+      if (typeof value === "string") {
+        const normalized = value.trim();
+        if (/^[1-9]\d*$/u.test(normalized) && BigInt(normalized) <= BigInt(Number.MAX_SAFE_INTEGER)) {
+          return normalized;
+        }
+        throw new CliError(`Invalid unsafe Version number: ${value}`);
       }
     }
-    if (flags.booleans.has("--force-build")) {
-      buildArgs.push("--force");
+  }
+  return null;
+}
+function collectJsonObjects(value) {
+  const objects = [];
+  collectJsonObjectsInto(value, objects);
+  return objects;
+}
+function collectJsonObjectsInto(value, objects) {
+  if (Array.isArray(value)) {
+    for (const item of value) {
+      collectJsonObjectsInto(item, objects);
     }
-    const sourceVersionId = flags.values["--source-version-id"];
-    if (sourceVersionId !== undefined) {
-      buildArgs.push("--source-version-id", sourceVersionId);
+    return;
+  }
+  const object = jsonObjectOrNull(value);
+  if (object === null) {
+    return;
+  }
+  objects.push(object);
+  for (const child of Object.values(object)) {
+    collectJsonObjectsInto(child, objects);
+  }
+}
+function lifecycleResourceArg(flags, usage) {
+  return lifecycleResourceArgs(flags, 1, usage)[0];
+}
+function lifecycleResourceArgs(flags, count, usage) {
+  const resources = flags.positionals.filter((positional) => !positional.startsWith("library/"));
+  if (resources.length !== count) {
+    throw new CliError(usage);
+  }
+  return resources;
+}
+function copyOptionalIntegerFlag(flags, params, flag, key) {
+  if (flags.values[flag] === undefined) {
+    return;
+  }
+  const value = integerFlag(flags, flag, 0);
+  if (value <= 0) {
+    throw new CliError(`${flag} must be greater than zero`);
+  }
+  params[key] = value;
+}
+function assertAllowedLocalFlags(flags, allowedFlags, commandName) {
+  const allowed = new Set(allowedFlags);
+  const unexpected = Object.keys(flags.values).filter((flag) => flags.values[flag] !== undefined && !allowed.has(flag));
+  if (unexpected.length > 0) {
+    throw new CliError(`${commandName} does not support ${unexpected.join(", ")}.`);
+  }
+}
+function stringFieldFromJsonObjects(objects, fields) {
+  for (const object of objects) {
+    for (const field of fields) {
+      const value = object[field];
+      if (typeof value === "string" && value.trim().length > 0) {
+        return value.trim();
+      }
     }
-    await gemBuild(ctx, buildArgs, linkedProject);
+  }
+  return null;
+}
+function jsonObjectOrNull(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return null;
+  }
+  return value;
+}
+
+// src/gem-lifecycle-commands.ts
+async function dispatchGems(ctx, sub, args, linkedProject) {
+  const flags = parseLocalFlags(args);
+  const gemPath = () => gemPathFromArgs(flags, linkedProject);
+  if (sub === "inspect") {
+    await emitGemTool(ctx, "gem.inspect", { path: gemPath() });
     return;
   }
-  const gemPath = gemPathFromArgs(flags, linkedProject);
-  const publish = !flags.booleans.has("--no-publish") && !flags.booleans.has("--skip-promote");
-  const params = {
-    path: gemPath,
-    publish
-  };
-  if (flags.booleans.has("--prod")) {
-    params["metadata"] = {
-      deployment_intent: "production",
-      promotion_strategy: publish ? "immediate" : "staged"
-    };
+  if (sub === "validate") {
+    await emitGemTool(ctx, "gem.validate", { path: gemPath() });
+    return;
   }
-  copyStringFlag(flags, params, "--build-id", "build_id");
-  copyStringFlag(flags, params, "--link-id", "link_id");
-  copyStringFlag(flags, params, "--source-version-id", "source_version_id");
-  if (flags.booleans.has("--force-build")) {
-    params["force_build"] = true;
+  if (sub === "build") {
+    await gemBuild(ctx, args, linkedProject);
+    return;
   }
-  if (flags.booleans.has("--no-wait")) {
-    params["wait"] = false;
+  if (await dispatchGemLifecycleResourceCommand(ctx, sub, args, linkedProject)) {
+    return;
   }
-  await emitGemTool(ctx, "gem.deploy", params, {
-    streamStart: { operation: "gem.deploy", path: gemPath },
-    textExtractor: extractDeploymentUrl
-  });
+  if (sub === "checks") {
+    const versionId = requireCommandValue(flags.positionals[0], "Usage: uru gems checks <version> [gem]");
+    await emitGemTool(ctx, "gem.checks", {
+      path: gemPathFromArgs(shiftPositionals(flags, 1), linkedProject),
+      version_id: versionId
+    });
+    return;
+  }
+  if (sub === "logs") {
+    await gemLogs(ctx, args, linkedProject);
+    return;
+  }
+  if (sub === "status") {
+    await emitGemTool(ctx, "gem.status", { path: gemPath() });
+    return;
+  }
+  if (sub === "read") {
+    const [path, file] = args;
+    await emitGemTool(ctx, "gem.fs_read", {
+      path: gemFilePath(requireCommandValue(path, "Usage: uru gems read <gem-path> <file>"), requireCommandValue(file, "Usage: uru gems read <gem-path> <file>"))
+    });
+    return;
+  }
+  if (sub === "write") {
+    await gemWrite(ctx, args);
+    return;
+  }
+  throw new CliError("Usage: uru gems inspect|validate|build|edits|versions|releases|links|runs|checks|status|read|write");
+}
+async function gemInit(ctx, args) {
+  const flags = parseLocalFlags(args);
+  const path = requireCommandValue(flags.positionals[0], "Usage: uru init <library/name.gem> [--entrypoint main.html] [--file ./main.html]");
+  const params = { path };
+  copyStringFlag(flags, params, "--name", "name");
+  copyStringFlag(flags, params, "--description", "description");
+  copyStringFlag(flags, params, "--entrypoint", "entrypoint");
+  copyStringFlag(flags, params, "--runtime", "runtime");
+  copyStringFlag(flags, params, "--visibility", "visibility");
+  if (flags.values["--content"] !== undefined) {
+    params["content"] = flags.values["--content"];
+  }
+  if (flags.values["--file"] !== undefined) {
+    params["content"] = await readFile5(flags.values["--file"], "utf8");
+  }
+  await emitGemTool(ctx, "gem.init", params);
 }
 async function gemBuild(ctx, args, linkedProject) {
   const flags = parseLocalFlags(args);
-  assertAllowedLocalFlags(flags, ["--dry-run", "--force", "--gem", "--outdir", "--path", "--source-version-id"], "uru build");
+  assertAllowedLocalFlags2(flags, ["--dry-run", "--force", "--gem", "--outdir", "--path", "--source-revision-id"], "uru build");
   const gemPath = gemPathFromArgs(flags, linkedProject);
   const params = {
     path: gemPath
@@ -3951,7 +4633,7 @@ async function gemBuild(ctx, args, linkedProject) {
   if (flags.booleans.has("--dry-run")) {
     params["dry_run"] = true;
   }
-  copyStringFlag(flags, params, "--source-version-id", "source_version_id");
+  copyStringFlag(flags, params, "--source-revision-id", "source_revision_id");
   if (ctx.outputFormat === "stream-json") {
     writeStreamJson(ctx.io, "started", { operation: "gem.build", path: gemPath });
     writeStreamJson(ctx.io, "phase", {
@@ -3974,63 +4656,9 @@ async function gemBuild(ctx, args, linkedProject) {
     writeText(ctx.io, JSON.stringify(unwrapped, null, 2));
   }
 }
-async function gemPromote(ctx, args, linkedProject) {
-  const flags = parseLocalFlags(args);
-  assertAllowedLocalFlags(flags, ["--deployment-id", "--gem", "--link-id", "--no-wait", "--path", "--pct"], "uru promote");
-  await deployVersionToPublishedLink(ctx, flags, linkedProject, {
-    operation: "promote",
-    usage: "Usage: uru promote <version-id> [library/name.gem] [--link-id <published-link-id>] | uru promote --deployment-id <deployment-id> [library/name.gem]"
-  });
-}
-async function gemChecks(ctx, args, linkedProject) {
-  const flags = parseLocalFlags(args);
-  if (flags.positionals[0] === "run") {
-    await gemRunCheck(ctx, flags, linkedProject);
-    return;
-  }
-  assertAllowedLocalFlags(flags, ["--deployment-id", "--gem", "--path"], "uru gems checks");
-  const explicitDeploymentId = flags.values["--deployment-id"];
-  const gemPathFlags = explicitDeploymentId === undefined ? shiftPositionals(flags, 1) : flags;
-  const params = {
-    path: gemPathFromArgs(gemPathFlags, linkedProject)
-  };
-  if (explicitDeploymentId !== undefined) {
-    params["deployment_id"] = explicitDeploymentId;
-  } else if (flags.positionals[0] !== undefined) {
-    params["version_id"] = flags.positionals[0];
-  }
-  await emitGemTool(ctx, "gem.checks", params);
-}
-async function gemRunCheck(ctx, flags, linkedProject) {
-  assertAllowedLocalFlags(flags, ["--blocking", "--deep", "--deployment-id", "--gem", "--path"], "uru gems checks run");
-  const kind = requireCommandValue(flags.positionals[1], "Usage: uru gems checks run browser|security [library/name.gem] [--deployment-id <id>] [--blocking]");
-  const params = {
-    path: gemPathFromArgs(shiftPositionals(flags, 2), linkedProject)
-  };
-  copyStringFlag(flags, params, "--deployment-id", "deployment_id");
-  if (flags.booleans.has("--blocking")) {
-    params["blocking"] = true;
-  }
-  if (kind === "browser" || kind === "browser_verify") {
-    if (flags.booleans.has("--deep")) {
-      throw new CliError("--deep is only valid for `uru gems checks run security`.");
-    }
-    await emitGemTool(ctx, "gem.browser_verify", params);
-    return;
-  }
-  if (kind === "security" || kind === "security_scan") {
-    if (flags.booleans.has("--deep")) {
-      params["deep"] = true;
-    }
-    await emitGemTool(ctx, "gem.security_scan", params);
-    return;
-  }
-  throw new CliError("Unknown Gem check runner. Use `uru gems checks run browser` or `uru gems checks run security`.");
-}
 async function gemLogs(ctx, args, linkedProject) {
   const flags = parseLocalFlags(args);
-  assertAllowedLocalFlags(flags, [
-    "--deployment-id",
+  assertAllowedLocalFlags2(flags, [
     "--follow",
     "--follow-duration-ms",
     "--gem",
@@ -4038,15 +4666,16 @@ async function gemLogs(ctx, args, linkedProject) {
     "--limit",
     "--path",
     "--poll-interval-ms",
-    "--request-id"
+    "--release",
+    "--run"
   ], "uru logs");
   const params = {
     path: gemPathFromArgs(flags, linkedProject),
     limit: integerFlag(flags, "--limit", 100)
   };
   copyStringFlag(flags, params, "--level", "level");
-  copyStringFlag(flags, params, "--deployment-id", "deployment_id");
-  copyStringFlag(flags, params, "--request-id", "request_id");
+  copyStringFlag(flags, params, "--release", "release_id");
+  copyStringFlag(flags, params, "--run", "run_id");
   if (flags.booleans.has("--follow")) {
     await followGemLogs(ctx, params, {
       durationMs: boundedIntegerFlag(flags, "--follow-duration-ms", DEFAULT_LOG_FOLLOW_DURATION_MS, MAX_LOG_FOLLOW_DURATION_MS),
@@ -4139,13 +4768,13 @@ function emitFollowLogEntry(ctx, entry) {
   writeText(ctx.io, formatLogEntry(entry));
 }
 function normalizeLogEntries(value) {
-  const root = jsonObjectOrNull(value);
+  const root = jsonObjectOrNull2(value);
   const candidate = root === null ? value : root["logs"];
   if (!Array.isArray(candidate)) {
     return [];
   }
   return candidate.flatMap((entry, index) => {
-    const object = jsonObjectOrNull(entry);
+    const object = jsonObjectOrNull2(entry);
     if (object === null) {
       return [];
     }
@@ -4188,36 +4817,6 @@ function boundedIntegerFlag(flags, name, fallback, maximum) {
   }
   return Math.min(value, maximum);
 }
-async function gemOpen(ctx, args, linkedProject) {
-  const flags = parseLocalFlags(args);
-  const result = await executeOperation(ctx, "gem.links_list", {
-    path: gemPathFromArgs(flags, linkedProject)
-  });
-  const url = firstUrl(unwrapToolResult(result));
-  if (url === undefined) {
-    throw new CliError("No published URL found for this Gem. Run `uru deploy` first.");
-  }
-  ctx.json ? writeJson(ctx.io, { url }) : writeText(ctx.io, url);
-}
-async function gemRollback(ctx, args, linkedProject) {
-  const flags = parseLocalFlags(args);
-  assertAllowedLocalFlags(flags, [
-    "--deployment-id",
-    "--gem",
-    "--link-id",
-    "--no-wait",
-    "--path",
-    "--pct",
-    "--yes"
-  ], "uru rollback");
-  if (!ctx.yes && !flags.booleans.has("--yes")) {
-    throw new CliError("Rollback requires --yes to confirm the link pointer change.");
-  }
-  await deployVersionToPublishedLink(ctx, flags, linkedProject, {
-    operation: "rollback",
-    usage: "Usage: uru rollback [<version-id>] [library/name.gem] [--deployment-id <deployment-id>] [--link-id <published-link-id>] --yes"
-  });
-}
 async function gemWrite(ctx, args) {
   const flags = parseLocalFlags(args);
   const gemPath = requireCommandValue(flags.positionals[0], "Usage: uru gems write <gem-path> <file> --content <text>|--file <local-file>");
@@ -4237,142 +4836,13 @@ function gemFilePath(gemPath, filePath) {
   const normalizedFilePath = trimLeadingSlashes(filePath);
   return `${normalizedGemPath}/${normalizedFilePath}`;
 }
-async function dispatchGemVersions(ctx, args, linkedProject) {
-  const [verb, ...rest] = args;
-  if (verb === "upload") {
-    await gemVersionUpload(ctx, rest, linkedProject);
-    return;
-  }
-  if (verb === "deploy") {
-    const flags = parseLocalFlags(rest);
-    rejectUnsupportedLocalFlags(flags, ["--runtime-provider", "--provider-deployment-id"], "Provider routing is chosen by the Gem runtime contract; version deploy does not accept provider-internal flags.");
-    assertAllowedLocalFlags(flags, ["--gem", "--link-id", "--no-wait", "--path", "--pct", "--skip-promote"], "uru gems versions deploy");
-    const version = requireCommandValue(flags.positionals[0], "Usage: uru gems versions deploy <version-id> [library/name.gem] [--pct 100] [--skip-promote]");
-    const [versionId, trafficPercent] = version.split("@", 2);
-    const gemPath = gemPathFromArgs(shiftPositionals(flags, 1), linkedProject);
-    const pct = flags.values["--pct"] ?? trafficPercent;
-    const trafficPercentValue = pct === undefined || pct === "" ? 100 : parseTrafficPercent(pct);
-    const publish = !flags.booleans.has("--skip-promote");
-    if (publish && trafficPercentValue !== 100) {
-      throw new CliError("Gradual Gem traffic shifts are not enabled yet. Use --skip-promote to create the deployment without changing live traffic, or deploy with --pct 100.");
-    }
-    const params = {
-      path: gemPath,
-      version_id: requireCommandValue(versionId, "Usage: uru gems versions deploy <version-id> [library/name.gem] [--pct 100] [--skip-promote]"),
-      traffic_percent: trafficPercentValue,
-      publish
-    };
-    copyStringFlag(flags, params, "--link-id", "link_id");
-    if (flags.booleans.has("--no-wait")) {
-      params["wait"] = false;
-    }
-    await emitGemTool(ctx, "gem.version_deploy", params, {
-      streamStart: { operation: "gem.version_deploy", path: gemPath },
-      textExtractor: extractDeploymentUrl
-    });
-    return;
-  }
-  throw new CliError("Usage: uru gems versions upload [library/name.gem] | deploy <version-id> [library/name.gem]");
-}
-async function gemVersionUpload(ctx, args, linkedProject) {
-  const flags = parseLocalFlags(args);
-  assertAllowedLocalFlags(flags, [
-    "--force",
-    "--gem",
-    "--message",
-    "--path",
-    "--preview-alias",
-    "--source-version-id",
-    "--tag",
-    "--tags"
-  ], "uru gems versions upload");
-  const gemPath = gemPathFromArgs(flags, linkedProject);
-  const params = {
-    path: gemPath
-  };
-  if (flags.booleans.has("--force")) {
-    params["force"] = true;
-  }
-  copyStringFlag(flags, params, "--source-version-id", "source_version_id");
-  copyStringFlag(flags, params, "--message", "message");
-  const previewAlias = flags.values["--preview-alias"];
-  if (previewAlias !== undefined) {
-    params["preview_alias"] = validatePreviewAlias(previewAlias);
-  }
-  const tags = tagsFromFlags(flags);
-  if (tags.length > 0) {
-    params["tags"] = tags;
-  }
-  await emitGemTool(ctx, "gem.version_upload", params, {
-    streamStart: { operation: "gem.version_upload", path: gemPath },
-    textExtractor: extractVersionUploadSummary
-  });
-}
-function parseTrafficPercent(raw) {
-  const value = Number(raw);
-  if (!Number.isFinite(value) || value < 0 || value > 100) {
-    throw new CliError("--pct or @pct must be a number from 0 through 100");
-  }
-  return value;
-}
-async function deployVersionToPublishedLink(ctx, flags, linkedProject, options) {
-  const deploymentId = flags.values["--deployment-id"];
-  const firstPositional = flags.positionals[0];
-  const versionId = deploymentId === undefined && firstPositional !== undefined ? firstPositional.startsWith("library/") ? undefined : firstPositional : undefined;
-  if (deploymentId === undefined && versionId === undefined) {
-    throw new CliError(options.usage);
-  }
-  const gemPath = gemPathFromArgs(versionId === undefined ? flags : shiftPositionals(flags, 1), linkedProject);
-  const trafficPercent = parseTrafficPercent(flags.values["--pct"] ?? "100");
-  if (trafficPercent !== 100) {
-    throw new CliError(`${options.operation} does not support partial traffic shifts yet. Deploy the version with --skip-promote for validation, or ${options.operation} with --pct 100.`);
-  }
-  const params = {
-    path: gemPath
-  };
-  if (deploymentId === undefined) {
-    params["version_id"] = requireCommandValue(versionId, options.usage);
-  } else {
-    params["app_deployment_id"] = deploymentId;
-  }
-  copyStringFlag(flags, params, "--link-id", "link_id");
-  if (flags.booleans.has("--no-wait")) {
-    params["wait"] = false;
-  }
-  const operation = `gem.${options.operation}`;
-  await emitGemTool(ctx, operation, params, {
-    streamStart: { operation, path: gemPath },
-    textExtractor: extractDeploymentUrl
-  });
-}
-function tagsFromFlags(flags) {
-  const raw = flags.values["--tags"] ?? flags.values["--tag"];
-  if (raw === undefined) {
-    return [];
-  }
-  return raw.split(",").map((tag) => tag.trim()).filter((tag) => tag.length > 0);
-}
-function validatePreviewAlias(rawAlias) {
-  const alias = rawAlias.trim();
-  if (alias.length === 0 || alias.length > 63 || !/^[a-z][a-z0-9-]*[a-z0-9]$/u.test(alias)) {
-    throw new CliError("--preview-alias must be a DNS-safe label: 1-63 characters, start with a lowercase letter, contain only lowercase letters, numbers, and dashes, and not end with a dash.");
-  }
-  return alias;
-}
-function assertAllowedLocalFlags(flags, allowedFlags, commandName) {
+function assertAllowedLocalFlags2(flags, allowedFlags, commandName) {
   const allowed = new Set(allowedFlags);
   const unexpected = localFlagNames(flags).filter((flag) => !allowed.has(flag));
   if (unexpected.length > 0) {
     throw new CliError(`${commandName} does not support ${unexpected.join(", ")}.`);
   }
 }
-function rejectUnsupportedLocalFlags(flags, unsupportedFlags, message) {
-  const unsupported = new Set(unsupportedFlags);
-  const found = localFlagNames(flags).filter((flag) => unsupported.has(flag));
-  if (found.length > 0) {
-    throw new CliError(`${message} Unsupported flag(s): ${found.join(", ")}.`);
-  }
-}
 function localFlagNames(flags) {
   return [...new Set([...Object.keys(flags.values), ...flags.booleans])];
 }
@@ -4387,10 +4857,10 @@ async function writeBuildManifest(ctx, outdir, buildResult) {
 `, { mode: 384 });
 }
 function gemBuildManifestFromBuildResult(buildResult) {
-  const root = jsonObjectOrNull(buildResult);
-  const build = jsonObjectOrNull(root?.["build"]);
-  const buildResultDetails = jsonObjectOrNull(build?.["build_result"]);
-  const buildMetadata = jsonObjectOrNull(buildResultDetails?.["metadata"]);
+  const root = jsonObjectOrNull2(buildResult);
+  const build = jsonObjectOrNull2(root?.["build"]);
+  const buildResultDetails = jsonObjectOrNull2(build?.["build_result"]);
+  const buildMetadata = jsonObjectOrNull2(buildResultDetails?.["metadata"]);
   const candidates = [
     root?.["gem_build_manifest"],
     root?.["gemBuildManifest"],
@@ -4410,7 +4880,7 @@ function gemBuildManifestFromBuildResult(buildResult) {
   throw new CliError("Build result did not include a GemBuildManifestV1. Re-run after the backend build manifest projection is deployed, or use --force to create a fresh ready build.");
 }
 function normalizeGemBuildManifest(value) {
-  const manifest = jsonObjectOrNull(value);
+  const manifest = jsonObjectOrNull2(value);
   if (manifest === null) {
     return null;
   }
@@ -4437,10 +4907,10 @@ function normalizeGemBuildManifest(value) {
   };
 }
 function gemProviderDecisionFromBuildResult(buildResult, manifest) {
-  const root = jsonObjectOrNull(buildResult);
-  const build = jsonObjectOrNull(root?.["build"]);
-  const buildResultDetails = jsonObjectOrNull(build?.["build_result"]);
-  const buildMetadata = jsonObjectOrNull(buildResultDetails?.["metadata"]);
+  const root = jsonObjectOrNull2(buildResult);
+  const build = jsonObjectOrNull2(root?.["build"]);
+  const buildResultDetails = jsonObjectOrNull2(build?.["build_result"]);
+  const buildMetadata = jsonObjectOrNull2(buildResultDetails?.["metadata"]);
   const runtimeProfile = firstJsonObject([
     root?.["runtime_profile"],
     root?.["runtimeProfile"],
@@ -4477,8 +4947,8 @@ function gemProviderDecisionFromBuildResult(buildResult, manifest) {
     schema: "uru.gem.provider_decision.v1",
     schema_version: 1,
     manifest_kind: "gem_provider_decision",
-    provider: stringFieldFromJsonObjects([providerDecision, runtimeProfile, manifest], ["provider", "runtime_provider", "runtimeProvider", "selected_provider"]),
-    runtime_class: stringFieldFromJsonObjects([providerDecision, runtimeProfile, manifest], ["runtime_class", "runtimeClass", "class", "serving_mode"]),
+    provider: stringFieldFromJsonObjects2([providerDecision, runtimeProfile, manifest], ["provider", "runtime_provider", "runtimeProvider", "selected_provider"]),
+    runtime_class: stringFieldFromJsonObjects2([providerDecision, runtimeProfile, manifest], ["runtime_class", "runtimeClass", "class", "serving_mode"]),
     runtime_profile: runtimeProfile,
     provider_decision: providerDecision,
     runtime_contract: runtimeContract,
@@ -4492,14 +4962,14 @@ function gemProviderDecisionFromBuildResult(buildResult, manifest) {
 }
 function firstJsonObject(values) {
   for (const value of values) {
-    const object = jsonObjectOrNull(value);
+    const object = jsonObjectOrNull2(value);
     if (object !== null) {
       return object;
     }
   }
   return null;
 }
-function stringFieldFromJsonObjects(objects, keys) {
+function stringFieldFromJsonObjects2(objects, keys) {
   for (const object of objects) {
     for (const key of keys) {
       const value = object[key];
@@ -4510,57 +4980,12 @@ function stringFieldFromJsonObjects(objects, keys) {
   }
   return null;
 }
-function jsonObjectOrNull(value) {
+function jsonObjectOrNull2(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
     return null;
   }
   return value;
 }
-function extractDeploymentUrl(value) {
-  return firstUrl(value);
-}
-function extractVersionUploadSummary(value) {
-  const objects = collectJsonObjects(value);
-  const versionId = stringFieldFromJsonObjects(objects, [
-    "version_id",
-    "versionId",
-    "id"
-  ]);
-  const previewUrl = stringFieldFromJsonObjects(objects, [
-    "preview_url",
-    "previewUrl",
-    "preview_alias_url",
-    "previewAliasUrl",
-    "url"
-  ]) ?? firstUrl(value);
-  const lines = [
-    versionId === null ? null : `Version: ${versionId}`,
-    previewUrl === undefined || previewUrl === null ? null : `Preview: ${previewUrl}`
-  ].filter((line) => line !== null);
-  return lines.length === 0 ? undefined : lines.join(`
-`);
-}
-function collectJsonObjects(value) {
-  const objects = [];
-  collectJsonObjectsInto(value, objects);
-  return objects;
-}
-function collectJsonObjectsInto(value, objects) {
-  if (Array.isArray(value)) {
-    for (const item of value) {
-      collectJsonObjectsInto(item, objects);
-    }
-    return;
-  }
-  const object = jsonObjectOrNull(value);
-  if (object === null) {
-    return;
-  }
-  objects.push(object);
-  for (const child of Object.values(object)) {
-    collectJsonObjectsInto(child, objects);
-  }
-}
 function trimTrailingSlashes(value) {
   let end = value.length;
   while (end > 0 && value.charCodeAt(end - 1) === 47) {
@@ -4576,6 +5001,62 @@ function trimLeadingSlashes(value) {
   return value.slice(start);
 }
 
+// src/gem-open-command.ts
+async function gemOpen(ctx, args, linkedProject) {
+  const flags = parseLocalFlags(args);
+  const result = await executeOperation(ctx, "gem.links_list", {
+    path: gemPathFromArgs(flags, linkedProject)
+  });
+  const selector = flags.values["--link"]?.trim();
+  const links = publicLinks(unwrapToolResult(result));
+  const selected = selector === undefined || selector === "" ? links.length === 1 ? links[0] : null : links.find((link) => link.id === selector || link.name === selector) ?? null;
+  if (selected === null || selected === undefined) {
+    if (links.length === 0) {
+      throw new CliError("No active Link found. Create a Version, then create a Link for the Version.");
+    }
+    if (selector === undefined || selector === "") {
+      throw new CliError("This Gem has multiple active Links. Run `uru gems links list`, then use `uru open --link <link-id-or-name>`.");
+    }
+    throw new CliError(`No active Link matches '${selector}'. Run \`uru gems links list\`.`);
+  }
+  if (ctx.json) {
+    writeJson(ctx.io, {
+      linkId: selected.id,
+      name: selected.name,
+      url: selected.url
+    });
+    return;
+  }
+  writeText(ctx.io, selected.url);
+}
+function publicLinks(value) {
+  const root = jsonObjectOrNull3(value);
+  const candidates = root === null ? [] : root["links"];
+  if (!Array.isArray(candidates)) {
+    return [];
+  }
+  return candidates.flatMap((candidate) => {
+    const link = jsonObjectOrNull3(candidate);
+    const id = link === null ? undefined : stringField3(link, ["id", "link_id"]);
+    const name = link === null ? undefined : stringField3(link, ["name"]);
+    const url = link === null ? undefined : stringField3(link, ["publish_url", "publishUrl", "url"]);
+    const status = link === null ? undefined : stringField3(link, ["status"]);
+    return id !== undefined && name !== undefined && url !== undefined && status === "active" ? [{ id, name, url }] : [];
+  });
+}
+function jsonObjectOrNull3(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function stringField3(entry, keys) {
+  for (const key of keys) {
+    const value = entry[key];
+    if (typeof value === "string" && value.trim() !== "") {
+      return value.trim();
+    }
+  }
+  return;
+}
+
 // src/gem-source-commands.ts
 import { mkdir as mkdir5, rm as rm3, writeFile as writeFile5 } from "node:fs/promises";
 import { dirname as dirname4, join as join4, resolve as resolve4 } from "node:path";
@@ -4599,14 +5080,14 @@ async function gemSourcePull(ctx, args, linkedProject) {
   if (filePaths.length === 0) {
     throw new CliError(`No source files found for ${gemPath}.`);
   }
-  let sourceVersionId = findSourceVersionId(tree);
+  let sourceRevisionId = findSourceRevisionId(tree);
   const files = {};
   const pulledFiles = [];
   for (const filePath of filePaths) {
     const readResult = unwrapToolResult(await executeOperation(ctx, "gem.fs_read", {
       path: gemFilePath(gemPath, filePath)
     }));
-    sourceVersionId = sourceVersionId ?? findSourceVersionId(readResult);
+    sourceRevisionId = sourceRevisionId ?? findSourceRevisionId(readResult);
     const content = extractRemoteFileContent(readResult, filePath);
     pulledFiles.push({ path: filePath, content });
     files[filePath] = sha256Hex(content);
@@ -4616,7 +5097,7 @@ async function gemSourcePull(ctx, args, linkedProject) {
   }
   const pruned = await pruneRemoteDeletedSourceFiles(ctx.cwd, previousLock, localFilesBeforePull, new Set(filePaths));
   const lock = {
-    ...sourceVersionId === undefined ? {} : { sourceVersionId },
+    ...sourceRevisionId === undefined ? {} : { sourceRevisionId },
     files,
     checkedOutAt: new Date().toISOString()
   };
@@ -4627,7 +5108,7 @@ async function gemSourcePull(ctx, args, linkedProject) {
     files: filePaths,
     prunedFiles: pruned.deleted,
     preservedFiles: pruned.preserved,
-    ...sourceVersionId === undefined ? {} : { sourceVersionId }
+    ...sourceRevisionId === undefined ? {} : { sourceRevisionId }
   }, formatPullSummary(gemPath, filePaths.length, pruned));
 }
 async function gemSourceStatus(ctx, args, linkedProject) {
@@ -4638,7 +5119,7 @@ async function gemSourceStatus(ctx, args, linkedProject) {
   const localStatus = compareSourceLock(lock, localFiles);
   const remote = await remoteSourceOperation(ctx, "gem.fs_status", {
     path: gemPath,
-    ...lock.sourceVersionId === undefined ? {} : { base: lock.sourceVersionId }
+    ...lock.sourceRevisionId === undefined ? {} : { base: lock.sourceRevisionId }
   });
   const report = sourceStatusReport(gemPath, lock, localStatus, remote);
   if (ctx.outputFormat === "stream-json") {
@@ -4659,7 +5140,7 @@ async function gemSourceDiff(ctx, args, linkedProject) {
   const remote = await remoteSourceOperation(ctx, "gem.fs_diff", {
     path: gemPath,
     mode,
-    ...lock.sourceVersionId === undefined ? {} : { base: lock.sourceVersionId }
+    ...lock.sourceRevisionId === undefined ? {} : { base: lock.sourceRevisionId }
   });
   const report = sourceStatusReport(gemPath, lock, localStatus, remote);
   if (ctx.outputFormat === "stream-json") {
@@ -4681,11 +5162,11 @@ async function gemSourcePush(ctx, args, linkedProject) {
   if (sortedFiles.length === 0 && localStatus.deleted.length === 0) {
     throw new CliError("No local Gem source files to push.");
   }
-  if (lock.sourceVersionId === undefined && !force) {
-    throw new CliError("No .uru/source-lock.json sourceVersionId found. Run `uru pull` first, or re-run `uru push --force` to explicitly overwrite the remote Gem source.", { code: ExitCode.Conflict });
+  if (lock.sourceRevisionId === undefined && !force) {
+    throw new CliError("No .uru/source-lock.json sourceRevisionId found. Run `uru pull` first, or re-run `uru push --force` to explicitly overwrite the remote Gem source.", { code: ExitCode.Conflict });
   }
   let sourceCas = {
-    ...lock.sourceVersionId === undefined ? {} : { sourceVersionId: lock.sourceVersionId }
+    ...lock.sourceRevisionId === undefined ? {} : { sourceRevisionId: lock.sourceRevisionId }
   };
   try {
     const syncResult = unwrapToolResult(await executeOperation(ctx, "gem.fs_sync", {
@@ -4707,9 +5188,9 @@ async function gemSourcePush(ctx, args, linkedProject) {
     }
     throw error;
   }
-  const nextSourceVersionId = sourceCas.sourceVersionId;
+  const nextSourceRevisionId = sourceCas.sourceRevisionId;
   await writeSourceLock(ctx.cwd, {
-    ...nextSourceVersionId === undefined ? {} : { sourceVersionId: nextSourceVersionId },
+    ...nextSourceRevisionId === undefined ? {} : { sourceRevisionId: nextSourceRevisionId },
     files: sourceHashesFromLocalFiles(localFiles),
     checkedOutAt: new Date().toISOString()
   });
@@ -4718,7 +5199,7 @@ async function gemSourcePush(ctx, args, linkedProject) {
     path: gemPath,
     files: sortedFiles.map((file) => file.path),
     deletedFiles: [...localStatus.deleted],
-    ...nextSourceVersionId === undefined ? {} : { sourceVersionId: nextSourceVersionId }
+    ...nextSourceRevisionId === undefined ? {} : { sourceRevisionId: nextSourceRevisionId }
   }, formatPushSummary(gemPath, sortedFiles.length, localStatus.deleted.length));
 }
 function localFileBatchWritePayload(file) {
@@ -4766,17 +5247,17 @@ function formatPullSummary(gemPath, writtenCount, pruned) {
   return parts.join("; ");
 }
 function sourceMutationCasParams(cas, force) {
-  if (force || cas.sourceVersionId === undefined) {
+  if (force || cas.sourceRevisionId === undefined) {
     return { force: true };
   }
   return {
-    base_source_version_id: cas.sourceVersionId
+    base_source_revision_id: cas.sourceRevisionId
   };
 }
 function nextSourceMutationCas(current, result) {
-  const sourceVersionId = findSourceVersionId(result) ?? current.sourceVersionId;
+  const sourceRevisionId = findSourceRevisionId(result) ?? current.sourceRevisionId;
   return {
-    ...sourceVersionId === undefined ? {} : { sourceVersionId }
+    ...sourceRevisionId === undefined ? {} : { sourceRevisionId }
   };
 }
 function formatPushSummary(gemPath, writtenCount, deletedCount) {
@@ -4792,7 +5273,7 @@ function formatPushSummary(gemPath, writtenCount, deletedCount) {
 function sourceStatusReport(path, lock, local, remote) {
   return {
     path,
-    sourceVersionId: lock.sourceVersionId ?? null,
+    sourceRevisionId: lock.sourceRevisionId ?? null,
     local,
     remote
   };
@@ -4800,7 +5281,7 @@ function sourceStatusReport(path, lock, local, remote) {
 function sourceStatusReportJson(report) {
   return {
     path: report.path,
-    sourceVersionId: report.sourceVersionId,
+    sourceRevisionId: report.sourceRevisionId,
     local: localSourceStatusJson(report.local),
     remote: remoteSourceOperationResultJson(report.remote)
   };
@@ -4828,7 +5309,7 @@ function remoteSourceOperationResultJson(remote) {
 function formatSourceStatus(report) {
   const lines = [
     `Gem: ${report.path}`,
-    `Source version: ${report.sourceVersionId ?? "unknown"}`,
+    `Source version: ${report.sourceRevisionId ?? "unknown"}`,
     `Local source: ${report.local.clean ? "clean" : "dirty"}`,
     ...formatLocalStatusEntries(report.local),
     `Remote source: ${formatRemoteSummary(report.remote)}`
@@ -4840,7 +5321,7 @@ function formatSourceDiff(report) {
   const localLines = formatLocalStatusEntries(report.local);
   const lines = [
     `Gem: ${report.path}`,
-    `Source version: ${report.sourceVersionId ?? "unknown"}`,
+    `Source version: ${report.sourceRevisionId ?? "unknown"}`,
     "Local changes since .uru/source-lock.json:",
     ...localLines.length === 0 ? ["  clean"] : localLines.map((line) => `  ${line}`),
     "Remote diff:",
@@ -4977,17 +5458,17 @@ function safeProjectPath(path) {
   }
   return parts.join("/");
 }
-function findSourceVersionId(value) {
+function findSourceRevisionId(value) {
   let found;
   visitJson(value, (candidate) => {
     if (!isJsonObject2(candidate)) {
       return;
     }
     const valueAtKey = stringField(candidate, [
-      "currentSourceVersionId",
-      "current_source_version_id",
-      "sourceVersionId",
-      "source_version_id"
+      "currentSourceRevisionId",
+      "current_source_revision_id",
+      "sourceRevisionId",
+      "source_revision_id"
     ]);
     if (valueAtKey !== undefined) {
       found = valueAtKey;
@@ -5012,7 +5493,7 @@ function visitJson(value, visitor) {
 }
 function isConflictLikeError(error) {
   const message = error instanceof Error ? error.message.toLowerCase() : "";
-  return message.includes("409") || message.includes("conflict") || message.includes("stale") || message.includes("base_source_version") || message.includes("current_source_version") || message.includes("version mismatch");
+  return message.includes("409") || message.includes("conflict") || message.includes("stale") || message.includes("base_source_revision") || message.includes("current_source_revision") || message.includes("version mismatch");
 }
 
 // src/token-env-secret-commands.ts
@@ -5478,11 +5959,21 @@ async function runCli(options) {
     const envGemId = nonEmptyString(options.env?.["URU_GEM_ID"]);
     const explicitGemRef = parsed.flags.gem ?? envGemId;
     const apiUrl = parsed.flags.apiUrl ?? envApiUrl ?? config.apiUrl ?? DEFAULT_API_URL;
-    const token = flagToken ?? envToken ?? await resolveStoredToken(credentialStore, apiUrl, config);
     const cwd = parsed.flags.cwd ?? process.cwd();
     const linkedProjectFromDisk = await readLinkedProject(cwd);
     const linkedProject = explicitGemRef === undefined ? linkedProjectFromDisk : linkedProjectWithExplicitGemRef(linkedProjectFromDisk, explicitGemRef);
     const workspace = parsed.flags.workspace ?? envWorkspace ?? linkedProject.workspaceId ?? config.workspace;
+    const storedToken = flagToken === undefined && envToken === undefined && shouldResolveStoredToken(parsed.command) ? await resolveStoredToken({
+      credentialStore,
+      store,
+      apiUrl,
+      config,
+      ...workspace === undefined ? {} : { workspaceId: workspace },
+      ...options.fetch === undefined ? {} : { fetch: options.fetch },
+      ...parsed.command[0] === "login" ? { recoverInvalidCredential: true } : {}
+    }) : undefined;
+    const token = flagToken ?? envToken ?? storedToken;
+    const runtimeConfig = await store.read();
     const outputFormat = parsed.flags.outputFormat ?? (parsed.flags.json ? "json" : "text");
     const callbackHost = parsed.flags.callbackHost ?? "127.0.0.1";
     const callbackPort = parseCallbackPort(parsed.flags.callbackPort);
@@ -5496,7 +5987,7 @@ async function runCli(options) {
     const ctx = {
       io,
       store,
-      config,
+      config: runtimeConfig,
       credentialStore,
       apiUrl,
       ...token !== undefined ? { token } : {},
@@ -5602,11 +6093,18 @@ async function dispatchWithImplicitLogin(ctx, command, linkedProject) {
   }
   await login(ctx, { silentSuccess: true });
   const nextConfig = await ctx.store.read();
-  const nextToken = await resolveStoredToken(ctx.credentialStore, ctx.apiUrl, nextConfig);
+  const selectedWorkspace = ctx.workspace ?? nextConfig.workspace;
+  const nextToken = await resolveStoredToken({
+    credentialStore: ctx.credentialStore,
+    store: ctx.store,
+    apiUrl: ctx.apiUrl,
+    config: nextConfig,
+    ...selectedWorkspace === undefined ? {} : { workspaceId: selectedWorkspace },
+    ...ctx.fetch === undefined ? {} : { fetch: ctx.fetch }
+  });
   if (nextToken === undefined) {
     throw new CliError("Login completed but no CLI session token was stored. Re-run `uru login` or pass --token.", { code: ExitCode.AuthRequired });
   }
-  const selectedWorkspace = ctx.workspace ?? nextConfig.workspace;
   const nextCtx = {
     ...ctx,
     config: nextConfig,
@@ -5616,7 +6114,14 @@ async function dispatchWithImplicitLogin(ctx, command, linkedProject) {
   await dispatch(nextCtx, command, linkedProject);
 }
 function shouldStartImplicitLogin(ctx, error) {
-  return error.exitCode === ExitCode.AuthRequired && ctx.token === undefined && !ctx.noInput && !ctx.terminal.ci && ctx.terminal.stdinIsTty && ctx.terminal.stderrIsTty;
+  return error.exitCode === ExitCode.AuthRequired && !ctx.tokenIsExplicit && !ctx.noInput && !ctx.terminal.ci && ctx.terminal.stdinIsTty && ctx.terminal.stderrIsTty;
+}
+function shouldResolveStoredToken(command) {
+  const [head, sub] = command;
+  if (head === "operations" && (sub === "ls" || sub === "list")) {
+    return false;
+  }
+  return !["logout", "link", "unlink", "docs", "help", "complete", "update"].includes(head ?? "");
 }
 function terminalStdin(stdin) {
   return stdin === undefined ? process.stdin : stdin;
@@ -5628,8 +6133,26 @@ async function dispatch(ctx, command, linkedProject) {
     return;
   }
   if (head === "logout") {
-    await ctx.credentialStore.clearToken(ctx.apiUrl);
-    await ctx.store.clear();
+    let revocationFailure;
+    try {
+      await revokeStoredOAuthLogin({
+        credentialStore: ctx.credentialStore,
+        apiUrl: ctx.apiUrl,
+        config: ctx.config,
+        ...ctx.fetch === undefined ? {} : { fetch: ctx.fetch }
+      });
+    } catch (error) {
+      revocationFailure = error;
+    } finally {
+      await ctx.credentialStore.clearToken(ctx.apiUrl);
+      await ctx.store.clear();
+    }
+    if (revocationFailure !== undefined) {
+      throw new CliError("Logged out locally, but server-side credential revocation could not be confirmed.", {
+        errorCode: "oauth_logout_revocation_failed",
+        cause: revocationFailure
+      });
+    }
     emit(ctx, { ok: true }, "Logged out");
     return;
   }
@@ -5698,16 +6221,6 @@ async function dispatch(ctx, command, linkedProject) {
     await gemBuild(ctx, command.slice(1), linkedProject);
     return;
   }
-  if (head === "deploy") {
-    await withWorkspace(ctx);
-    await gemDeploy(ctx, command.slice(1), linkedProject);
-    return;
-  }
-  if (head === "promote") {
-    await withWorkspace(ctx);
-    await gemPromote(ctx, command.slice(1), linkedProject);
-    return;
-  }
   if (head === "pull") {
     await withWorkspace(ctx);
     await gemSourcePull(ctx, command.slice(1), linkedProject);
@@ -5738,11 +6251,6 @@ async function dispatch(ctx, command, linkedProject) {
     await gemOpen(ctx, command.slice(1), linkedProject);
     return;
   }
-  if (head === "rollback") {
-    await withWorkspace(ctx);
-    await gemRollback(ctx, command.slice(1), linkedProject);
-    return;
-  }
   if (head === "gems") {
     await withWorkspace(ctx);
     await dispatchGems(ctx, sub, command.slice(2), linkedProject);