@vm0/cli 5.8.0 → 5.9.0

package/index.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { Command as Command36 } from "commander";
-import chalk37 from "chalk";
+import { Command as Command40 } from "commander";
+import chalk40 from "chalk";
 
 // src/lib/api/auth.ts
 import chalk from "chalk";
@@ -192,7 +192,7 @@ import { parse as parseYaml2 } from "yaml";
 import prompts from "prompts";
 
 // ../../packages/core/src/variable-expander.ts
-var VARIABLE_PATTERN = /\$\{\{\s*(env|vars|secrets)\.([a-zA-Z_][a-zA-Z0-9_]*)\s*\}\}/g;
+var VARIABLE_PATTERN = /\$\{\{\s*(env|vars|secrets|credentials)\.([a-zA-Z_][a-zA-Z0-9_]*)\s*\}\}/g;
 function extractVariableReferencesFromString(value) {
   const refs = [];
   const matches = value.matchAll(VARIABLE_PATTERN);
@@ -237,7 +237,8 @@ function groupVariablesBySource(refs) {
   const groups = {
     env: [],
     vars: [],
-    secrets: []
+    secrets: [],
+    credentials: []
   };
   for (const ref of refs) {
     groups[ref.source].push(ref);
@@ -1646,43 +1647,137 @@ var scopeContract = c9.router({
   }
 });
 
-// ../../packages/core/src/contracts/sessions.ts
+// ../../packages/core/src/contracts/credentials.ts
 import { z as z12 } from "zod";
 var c10 = initContract();
-var sessionResponseSchema = z12.object({
-  id: z12.string(),
-  agentComposeId: z12.string(),
-  agentComposeVersionId: z12.string().nullable(),
-  conversationId: z12.string().nullable(),
-  artifactName: z12.string().nullable(),
-  vars: z12.record(z12.string(), z12.string()).nullable(),
-  secretNames: z12.array(z12.string()).nullable(),
-  volumeVersions: z12.record(z12.string(), z12.string()).nullable(),
+var credentialNameSchema = z12.string().min(1, "Credential name is required").max(255, "Credential name must be at most 255 characters").regex(
+  /^[A-Z][A-Z0-9_]*$/,
+  "Credential name must contain only uppercase letters, numbers, and underscores, and must start with a letter (e.g., MY_API_KEY)"
+);
+var credentialResponseSchema = z12.object({
+  id: z12.string().uuid(),
+  name: z12.string(),
+  description: z12.string().nullable(),
   createdAt: z12.string(),
   updatedAt: z12.string()
 });
-var agentComposeSnapshotSchema = z12.object({
-  agentComposeVersionId: z12.string(),
-  vars: z12.record(z12.string(), z12.string()).optional(),
-  secretNames: z12.array(z12.string()).optional()
+var credentialListResponseSchema = z12.object({
+  credentials: z12.array(credentialResponseSchema)
+});
+var setCredentialRequestSchema = z12.object({
+  name: credentialNameSchema,
+  value: z12.string().min(1, "Credential value is required"),
+  description: z12.string().max(1e3).optional()
+});
+var credentialsMainContract = c10.router({
+  /**
+   * GET /api/credentials
+   * List all credentials for the current user's scope (metadata only)
+   */
+  list: {
+    method: "GET",
+    path: "/api/credentials",
+    responses: {
+      200: credentialListResponseSchema,
+      401: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "List all credentials (metadata only)"
+  },
+  /**
+   * PUT /api/credentials
+   * Create or update a credential
+   */
+  set: {
+    method: "PUT",
+    path: "/api/credentials",
+    body: setCredentialRequestSchema,
+    responses: {
+      200: credentialResponseSchema,
+      201: credentialResponseSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Create or update a credential"
+  }
+});
+var credentialsByNameContract = c10.router({
+  /**
+   * GET /api/credentials/:name
+   * Get a credential by name (metadata only)
+   */
+  get: {
+    method: "GET",
+    path: "/api/credentials/:name",
+    pathParams: z12.object({
+      name: credentialNameSchema
+    }),
+    responses: {
+      200: credentialResponseSchema,
+      401: apiErrorSchema,
+      404: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Get credential metadata by name"
+  },
+  /**
+   * DELETE /api/credentials/:name
+   * Delete a credential by name
+   */
+  delete: {
+    method: "DELETE",
+    path: "/api/credentials/:name",
+    pathParams: z12.object({
+      name: credentialNameSchema
+    }),
+    responses: {
+      204: z12.undefined(),
+      401: apiErrorSchema,
+      404: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Delete a credential"
+  }
+});
+
+// ../../packages/core/src/contracts/sessions.ts
+import { z as z13 } from "zod";
+var c11 = initContract();
+var sessionResponseSchema = z13.object({
+  id: z13.string(),
+  agentComposeId: z13.string(),
+  agentComposeVersionId: z13.string().nullable(),
+  conversationId: z13.string().nullable(),
+  artifactName: z13.string().nullable(),
+  vars: z13.record(z13.string(), z13.string()).nullable(),
+  secretNames: z13.array(z13.string()).nullable(),
+  volumeVersions: z13.record(z13.string(), z13.string()).nullable(),
+  createdAt: z13.string(),
+  updatedAt: z13.string()
 });
-var artifactSnapshotSchema2 = z12.object({
-  artifactName: z12.string(),
-  artifactVersion: z12.string()
+var agentComposeSnapshotSchema = z13.object({
+  agentComposeVersionId: z13.string(),
+  vars: z13.record(z13.string(), z13.string()).optional(),
+  secretNames: z13.array(z13.string()).optional()
 });
-var volumeVersionsSnapshotSchema2 = z12.object({
-  versions: z12.record(z12.string(), z12.string())
+var artifactSnapshotSchema2 = z13.object({
+  artifactName: z13.string(),
+  artifactVersion: z13.string()
 });
-var checkpointResponseSchema = z12.object({
-  id: z12.string(),
-  runId: z12.string(),
-  conversationId: z12.string(),
+var volumeVersionsSnapshotSchema2 = z13.object({
+  versions: z13.record(z13.string(), z13.string())
+});
+var checkpointResponseSchema = z13.object({
+  id: z13.string(),
+  runId: z13.string(),
+  conversationId: z13.string(),
   agentComposeSnapshot: agentComposeSnapshotSchema,
   artifactSnapshot: artifactSnapshotSchema2.nullable(),
   volumeVersionsSnapshot: volumeVersionsSnapshotSchema2.nullable(),
-  createdAt: z12.string()
+  createdAt: z13.string()
 });
-var sessionsByIdContract = c10.router({
+var sessionsByIdContract = c11.router({
   /**
    * GET /api/agent/sessions/:id
    * Get session by ID
@@ -1690,8 +1785,8 @@ var sessionsByIdContract = c10.router({
   getById: {
     method: "GET",
     path: "/api/agent/sessions/:id",
-    pathParams: z12.object({
-      id: z12.string().min(1, "Session ID is required")
+    pathParams: z13.object({
+      id: z13.string().min(1, "Session ID is required")
     }),
     responses: {
       200: sessionResponseSchema,
@@ -1702,7 +1797,7 @@ var sessionsByIdContract = c10.router({
     summary: "Get session by ID"
   }
 });
-var checkpointsByIdContract = c10.router({
+var checkpointsByIdContract = c11.router({
   /**
    * GET /api/agent/checkpoints/:id
    * Get checkpoint by ID
@@ -1710,8 +1805,8 @@ var checkpointsByIdContract = c10.router({
   getById: {
     method: "GET",
     path: "/api/agent/checkpoints/:id",
-    pathParams: z12.object({
-      id: z12.string().min(1, "Checkpoint ID is required")
+    pathParams: z13.object({
+      id: z13.string().min(1, "Checkpoint ID is required")
     }),
     responses: {
       200: checkpointResponseSchema,
@@ -1724,91 +1819,91 @@ var checkpointsByIdContract = c10.router({
 });
 
 // ../../packages/core/src/contracts/schedules.ts
-import { z as z13 } from "zod";
-var c11 = initContract();
-var scheduleTriggerSchema = z13.object({
-  cron: z13.string().optional(),
-  at: z13.string().optional(),
-  timezone: z13.string().default("UTC")
+import { z as z14 } from "zod";
+var c12 = initContract();
+var scheduleTriggerSchema = z14.object({
+  cron: z14.string().optional(),
+  at: z14.string().optional(),
+  timezone: z14.string().default("UTC")
 }).refine((data) => data.cron && !data.at || !data.cron && data.at, {
   message: "Exactly one of 'cron' or 'at' must be specified"
 });
-var scheduleRunConfigSchema = z13.object({
-  agent: z13.string().min(1, "Agent reference required"),
-  prompt: z13.string().min(1, "Prompt required"),
-  vars: z13.record(z13.string(), z13.string()).optional(),
-  secrets: z13.record(z13.string(), z13.string()).optional(),
-  artifactName: z13.string().optional(),
-  artifactVersion: z13.string().optional(),
-  volumeVersions: z13.record(z13.string(), z13.string()).optional()
+var scheduleRunConfigSchema = z14.object({
+  agent: z14.string().min(1, "Agent reference required"),
+  prompt: z14.string().min(1, "Prompt required"),
+  vars: z14.record(z14.string(), z14.string()).optional(),
+  secrets: z14.record(z14.string(), z14.string()).optional(),
+  artifactName: z14.string().optional(),
+  artifactVersion: z14.string().optional(),
+  volumeVersions: z14.record(z14.string(), z14.string()).optional()
 });
-var scheduleDefinitionSchema = z13.object({
+var scheduleDefinitionSchema = z14.object({
   on: scheduleTriggerSchema,
   run: scheduleRunConfigSchema
 });
-var scheduleYamlSchema = z13.object({
-  version: z13.literal("1.0"),
-  schedules: z13.record(z13.string(), scheduleDefinitionSchema)
-});
-var deployScheduleRequestSchema = z13.object({
-  name: z13.string().min(1).max(64, "Schedule name max 64 chars"),
-  cronExpression: z13.string().optional(),
-  atTime: z13.string().optional(),
-  timezone: z13.string().default("UTC"),
-  prompt: z13.string().min(1, "Prompt required"),
-  vars: z13.record(z13.string(), z13.string()).optional(),
-  secrets: z13.record(z13.string(), z13.string()).optional(),
-  artifactName: z13.string().optional(),
-  artifactVersion: z13.string().optional(),
-  volumeVersions: z13.record(z13.string(), z13.string()).optional(),
+var scheduleYamlSchema = z14.object({
+  version: z14.literal("1.0"),
+  schedules: z14.record(z14.string(), scheduleDefinitionSchema)
+});
+var deployScheduleRequestSchema = z14.object({
+  name: z14.string().min(1).max(64, "Schedule name max 64 chars"),
+  cronExpression: z14.string().optional(),
+  atTime: z14.string().optional(),
+  timezone: z14.string().default("UTC"),
+  prompt: z14.string().min(1, "Prompt required"),
+  vars: z14.record(z14.string(), z14.string()).optional(),
+  secrets: z14.record(z14.string(), z14.string()).optional(),
+  artifactName: z14.string().optional(),
+  artifactVersion: z14.string().optional(),
+  volumeVersions: z14.record(z14.string(), z14.string()).optional(),
   // Resolved agent compose ID (CLI resolves scope/name:version → composeId)
-  composeId: z13.string().uuid("Invalid compose ID")
+  composeId: z14.string().uuid("Invalid compose ID")
 }).refine(
   (data) => data.cronExpression && !data.atTime || !data.cronExpression && data.atTime,
   {
     message: "Exactly one of 'cronExpression' or 'atTime' must be specified"
   }
 );
-var scheduleResponseSchema = z13.object({
-  id: z13.string().uuid(),
-  composeId: z13.string().uuid(),
-  composeName: z13.string(),
-  scopeSlug: z13.string(),
-  name: z13.string(),
-  cronExpression: z13.string().nullable(),
-  atTime: z13.string().nullable(),
-  timezone: z13.string(),
-  prompt: z13.string(),
-  vars: z13.record(z13.string(), z13.string()).nullable(),
+var scheduleResponseSchema = z14.object({
+  id: z14.string().uuid(),
+  composeId: z14.string().uuid(),
+  composeName: z14.string(),
+  scopeSlug: z14.string(),
+  name: z14.string(),
+  cronExpression: z14.string().nullable(),
+  atTime: z14.string().nullable(),
+  timezone: z14.string(),
+  prompt: z14.string(),
+  vars: z14.record(z14.string(), z14.string()).nullable(),
   // Secret names only (values are never returned)
-  secretNames: z13.array(z13.string()).nullable(),
-  artifactName: z13.string().nullable(),
-  artifactVersion: z13.string().nullable(),
-  volumeVersions: z13.record(z13.string(), z13.string()).nullable(),
-  enabled: z13.boolean(),
-  nextRunAt: z13.string().nullable(),
-  createdAt: z13.string(),
-  updatedAt: z13.string()
-});
-var runSummarySchema = z13.object({
-  id: z13.string().uuid(),
-  status: z13.enum(["pending", "running", "completed", "failed", "timeout"]),
-  createdAt: z13.string(),
-  completedAt: z13.string().nullable(),
-  error: z13.string().nullable()
-});
-var scheduleRunsResponseSchema = z13.object({
-  runs: z13.array(runSummarySchema)
-});
-var scheduleListResponseSchema = z13.object({
-  schedules: z13.array(scheduleResponseSchema)
-});
-var deployScheduleResponseSchema = z13.object({
+  secretNames: z14.array(z14.string()).nullable(),
+  artifactName: z14.string().nullable(),
+  artifactVersion: z14.string().nullable(),
+  volumeVersions: z14.record(z14.string(), z14.string()).nullable(),
+  enabled: z14.boolean(),
+  nextRunAt: z14.string().nullable(),
+  createdAt: z14.string(),
+  updatedAt: z14.string()
+});
+var runSummarySchema = z14.object({
+  id: z14.string().uuid(),
+  status: z14.enum(["pending", "running", "completed", "failed", "timeout"]),
+  createdAt: z14.string(),
+  completedAt: z14.string().nullable(),
+  error: z14.string().nullable()
+});
+var scheduleRunsResponseSchema = z14.object({
+  runs: z14.array(runSummarySchema)
+});
+var scheduleListResponseSchema = z14.object({
+  schedules: z14.array(scheduleResponseSchema)
+});
+var deployScheduleResponseSchema = z14.object({
   schedule: scheduleResponseSchema,
-  created: z13.boolean()
+  created: z14.boolean()
   // true if created, false if updated
 });
-var schedulesMainContract = c11.router({
+var schedulesMainContract = c12.router({
   /**
    * POST /api/agent/schedules
    * Deploy (create or update) a schedule
@@ -1844,7 +1939,7 @@ var schedulesMainContract = c11.router({
     summary: "List all schedules"
   }
 });
-var schedulesByNameContract = c11.router({
+var schedulesByNameContract = c12.router({
   /**
    * GET /api/agent/schedules/:name
    * Get schedule by name
@@ -1852,11 +1947,11 @@ var schedulesByNameContract = c11.router({
   getByName: {
     method: "GET",
     path: "/api/agent/schedules/:name",
-    pathParams: z13.object({
-      name: z13.string().min(1, "Schedule name required")
+    pathParams: z14.object({
+      name: z14.string().min(1, "Schedule name required")
     }),
-    query: z13.object({
-      composeId: z13.string().uuid("Compose ID required")
+    query: z14.object({
+      composeId: z14.string().uuid("Compose ID required")
     }),
     responses: {
       200: scheduleResponseSchema,
@@ -1872,21 +1967,21 @@ var schedulesByNameContract = c11.router({
   delete: {
     method: "DELETE",
     path: "/api/agent/schedules/:name",
-    pathParams: z13.object({
-      name: z13.string().min(1, "Schedule name required")
+    pathParams: z14.object({
+      name: z14.string().min(1, "Schedule name required")
     }),
-    query: z13.object({
-      composeId: z13.string().uuid("Compose ID required")
+    query: z14.object({
+      composeId: z14.string().uuid("Compose ID required")
     }),
     responses: {
-      204: z13.undefined(),
+      204: z14.undefined(),
       401: apiErrorSchema,
       404: apiErrorSchema
     },
     summary: "Delete schedule"
   }
 });
-var schedulesEnableContract = c11.router({
+var schedulesEnableContract = c12.router({
   /**
    * POST /api/agent/schedules/:name/enable
    * Enable a disabled schedule
@@ -1894,11 +1989,11 @@ var schedulesEnableContract = c11.router({
   enable: {
     method: "POST",
     path: "/api/agent/schedules/:name/enable",
-    pathParams: z13.object({
-      name: z13.string().min(1, "Schedule name required")
+    pathParams: z14.object({
+      name: z14.string().min(1, "Schedule name required")
     }),
-    body: z13.object({
-      composeId: z13.string().uuid("Compose ID required")
+    body: z14.object({
+      composeId: z14.string().uuid("Compose ID required")
     }),
     responses: {
       200: scheduleResponseSchema,
@@ -1914,11 +2009,11 @@ var schedulesEnableContract = c11.router({
   disable: {
     method: "POST",
     path: "/api/agent/schedules/:name/disable",
-    pathParams: z13.object({
-      name: z13.string().min(1, "Schedule name required")
+    pathParams: z14.object({
+      name: z14.string().min(1, "Schedule name required")
     }),
-    body: z13.object({
-      composeId: z13.string().uuid("Compose ID required")
+    body: z14.object({
+      composeId: z14.string().uuid("Compose ID required")
     }),
     responses: {
       200: scheduleResponseSchema,
@@ -1928,7 +2023,7 @@ var schedulesEnableContract = c11.router({
     summary: "Disable schedule"
   }
 });
-var scheduleRunsContract = c11.router({
+var scheduleRunsContract = c12.router({
   /**
    * GET /api/agent/schedules/:name/runs
    * List recent runs for a schedule
@@ -1936,12 +2031,12 @@ var scheduleRunsContract = c11.router({
   listRuns: {
     method: "GET",
     path: "/api/agent/schedules/:name/runs",
-    pathParams: z13.object({
-      name: z13.string().min(1, "Schedule name required")
+    pathParams: z14.object({
+      name: z14.string().min(1, "Schedule name required")
     }),
-    query: z13.object({
-      composeId: z13.string().uuid("Compose ID required"),
-      limit: z13.coerce.number().min(0).max(100).default(5)
+    query: z14.object({
+      composeId: z14.string().uuid("Compose ID required"),
+      limit: z14.coerce.number().min(0).max(100).default(5)
     }),
     responses: {
       200: scheduleRunsResponseSchema,
@@ -1953,8 +2048,8 @@ var scheduleRunsContract = c11.router({
 });
 
 // ../../packages/core/src/contracts/public/common.ts
-import { z as z14 } from "zod";
-var publicApiErrorTypeSchema = z14.enum([
+import { z as z15 } from "zod";
+var publicApiErrorTypeSchema = z15.enum([
   "api_error",
   // Internal server error (5xx)
   "invalid_request_error",
@@ -1966,55 +2061,55 @@ var publicApiErrorTypeSchema = z14.enum([
   "conflict_error"
   // Resource conflict (409)
 ]);
-var publicApiErrorSchema = z14.object({
-  error: z14.object({
+var publicApiErrorSchema = z15.object({
+  error: z15.object({
     type: publicApiErrorTypeSchema,
-    code: z14.string(),
-    message: z14.string(),
-    param: z14.string().optional(),
-    doc_url: z14.string().url().optional()
+    code: z15.string(),
+    message: z15.string(),
+    param: z15.string().optional(),
+    doc_url: z15.string().url().optional()
   })
 });
-var paginationSchema = z14.object({
-  has_more: z14.boolean(),
-  next_cursor: z14.string().nullable()
+var paginationSchema = z15.object({
+  has_more: z15.boolean(),
+  next_cursor: z15.string().nullable()
 });
 function createPaginatedResponseSchema(dataSchema) {
-  return z14.object({
-    data: z14.array(dataSchema),
+  return z15.object({
+    data: z15.array(dataSchema),
     pagination: paginationSchema
   });
 }
-var listQuerySchema = z14.object({
-  cursor: z14.string().optional(),
-  limit: z14.coerce.number().min(1).max(100).default(20)
+var listQuerySchema = z15.object({
+  cursor: z15.string().optional(),
+  limit: z15.coerce.number().min(1).max(100).default(20)
 });
-var requestIdSchema = z14.string().uuid();
-var timestampSchema = z14.string().datetime();
+var requestIdSchema = z15.string().uuid();
+var timestampSchema = z15.string().datetime();
 
 // ../../packages/core/src/contracts/public/agents.ts
-import { z as z15 } from "zod";
-var c12 = initContract();
-var publicAgentSchema = z15.object({
-  id: z15.string(),
-  name: z15.string(),
-  current_version_id: z15.string().nullable(),
+import { z as z16 } from "zod";
+var c13 = initContract();
+var publicAgentSchema = z16.object({
+  id: z16.string(),
+  name: z16.string(),
+  current_version_id: z16.string().nullable(),
   created_at: timestampSchema,
   updated_at: timestampSchema
 });
-var agentVersionSchema = z15.object({
-  id: z15.string(),
-  agent_id: z15.string(),
-  version_number: z15.number(),
+var agentVersionSchema = z16.object({
+  id: z16.string(),
+  agent_id: z16.string(),
+  version_number: z16.number(),
   created_at: timestampSchema
 });
 var publicAgentDetailSchema = publicAgentSchema;
 var paginatedAgentsSchema = createPaginatedResponseSchema(publicAgentSchema);
 var paginatedAgentVersionsSchema = createPaginatedResponseSchema(agentVersionSchema);
 var agentListQuerySchema = listQuerySchema.extend({
-  name: z15.string().optional()
+  name: z16.string().optional()
 });
-var publicAgentsListContract = c12.router({
+var publicAgentsListContract = c13.router({
   list: {
     method: "GET",
     path: "/v1/agents",
@@ -2028,12 +2123,12 @@ var publicAgentsListContract = c12.router({
     description: "List all agents in the current scope with pagination. Use the `name` query parameter to filter by agent name."
   }
 });
-var publicAgentByIdContract = c12.router({
+var publicAgentByIdContract = c13.router({
   get: {
     method: "GET",
     path: "/v1/agents/:id",
-    pathParams: z15.object({
-      id: z15.string().min(1, "Agent ID is required")
+    pathParams: z16.object({
+      id: z16.string().min(1, "Agent ID is required")
     }),
     responses: {
       200: publicAgentDetailSchema,
@@ -2045,12 +2140,12 @@ var publicAgentByIdContract = c12.router({
     description: "Get agent details by ID"
   }
 });
-var publicAgentVersionsContract = c12.router({
+var publicAgentVersionsContract = c13.router({
   list: {
     method: "GET",
     path: "/v1/agents/:id/versions",
-    pathParams: z15.object({
-      id: z15.string().min(1, "Agent ID is required")
+    pathParams: z16.object({
+      id: z16.string().min(1, "Agent ID is required")
     }),
     query: listQuerySchema,
     responses: {
@@ -2065,9 +2160,9 @@ var publicAgentVersionsContract = c12.router({
 });
 
 // ../../packages/core/src/contracts/public/runs.ts
-import { z as z16 } from "zod";
-var c13 = initContract();
-var publicRunStatusSchema = z16.enum([
+import { z as z17 } from "zod";
+var c14 = initContract();
+var publicRunStatusSchema = z17.enum([
   "pending",
   "running",
   "completed",
@@ -2075,56 +2170,56 @@ var publicRunStatusSchema = z16.enum([
   "timeout",
   "cancelled"
 ]);
-var publicRunSchema = z16.object({
-  id: z16.string(),
-  agent_id: z16.string(),
-  agent_name: z16.string(),
+var publicRunSchema = z17.object({
+  id: z17.string(),
+  agent_id: z17.string(),
+  agent_name: z17.string(),
   status: publicRunStatusSchema,
-  prompt: z16.string(),
+  prompt: z17.string(),
   created_at: timestampSchema,
   started_at: timestampSchema.nullable(),
   completed_at: timestampSchema.nullable()
 });
 var publicRunDetailSchema = publicRunSchema.extend({
-  error: z16.string().nullable(),
-  execution_time_ms: z16.number().nullable(),
-  checkpoint_id: z16.string().nullable(),
-  session_id: z16.string().nullable(),
-  artifact_name: z16.string().nullable(),
-  artifact_version: z16.string().nullable(),
-  volumes: z16.record(z16.string(), z16.string()).optional()
+  error: z17.string().nullable(),
+  execution_time_ms: z17.number().nullable(),
+  checkpoint_id: z17.string().nullable(),
+  session_id: z17.string().nullable(),
+  artifact_name: z17.string().nullable(),
+  artifact_version: z17.string().nullable(),
+  volumes: z17.record(z17.string(), z17.string()).optional()
 });
 var paginatedRunsSchema = createPaginatedResponseSchema(publicRunSchema);
-var createRunRequestSchema = z16.object({
+var createRunRequestSchema = z17.object({
   // Agent identification (one of: agent, agent_id, session_id, checkpoint_id)
-  agent: z16.string().optional(),
+  agent: z17.string().optional(),
   // Agent name
-  agent_id: z16.string().optional(),
+  agent_id: z17.string().optional(),
   // Agent ID
-  agent_version: z16.string().optional(),
+  agent_version: z17.string().optional(),
   // Version specifier (e.g., "latest", "v1", specific ID)
   // Continue session
-  session_id: z16.string().optional(),
+  session_id: z17.string().optional(),
   // Resume from checkpoint
-  checkpoint_id: z16.string().optional(),
+  checkpoint_id: z17.string().optional(),
   // Required
-  prompt: z16.string().min(1, "Prompt is required"),
+  prompt: z17.string().min(1, "Prompt is required"),
   // Optional configuration
-  variables: z16.record(z16.string(), z16.string()).optional(),
-  secrets: z16.record(z16.string(), z16.string()).optional(),
-  artifact_name: z16.string().optional(),
+  variables: z17.record(z17.string(), z17.string()).optional(),
+  secrets: z17.record(z17.string(), z17.string()).optional(),
+  artifact_name: z17.string().optional(),
   // Artifact name to mount
-  artifact_version: z16.string().optional(),
+  artifact_version: z17.string().optional(),
   // Artifact version (defaults to latest)
-  volumes: z16.record(z16.string(), z16.string()).optional()
+  volumes: z17.record(z17.string(), z17.string()).optional()
   // volume_name -> version
 });
 var runListQuerySchema = listQuerySchema.extend({
-  agent_id: z16.string().optional(),
+  agent_id: z17.string().optional(),
   status: publicRunStatusSchema.optional(),
   since: timestampSchema.optional()
 });
-var publicRunsListContract = c13.router({
+var publicRunsListContract = c14.router({
   list: {
     method: "GET",
     path: "/v1/runs",
@@ -2153,12 +2248,12 @@ var publicRunsListContract = c13.router({
     description: "Create and execute a new agent run. Returns 202 Accepted as runs execute asynchronously."
   }
 });
-var publicRunByIdContract = c13.router({
+var publicRunByIdContract = c14.router({
   get: {
     method: "GET",
     path: "/v1/runs/:id",
-    pathParams: z16.object({
-      id: z16.string().min(1, "Run ID is required")
+    pathParams: z17.object({
+      id: z17.string().min(1, "Run ID is required")
     }),
     responses: {
       200: publicRunDetailSchema,
@@ -2170,14 +2265,14 @@ var publicRunByIdContract = c13.router({
     description: "Get run details by ID"
   }
 });
-var publicRunCancelContract = c13.router({
+var publicRunCancelContract = c14.router({
   cancel: {
     method: "POST",
     path: "/v1/runs/:id/cancel",
-    pathParams: z16.object({
-      id: z16.string().min(1, "Run ID is required")
+    pathParams: z17.object({
+      id: z17.string().min(1, "Run ID is required")
     }),
-    body: z16.undefined(),
+    body: z17.undefined(),
     responses: {
       200: publicRunDetailSchema,
       400: publicApiErrorSchema,
@@ -2190,26 +2285,26 @@ var publicRunCancelContract = c13.router({
     description: "Cancel a pending or running execution"
   }
 });
-var logEntrySchema = z16.object({
+var logEntrySchema = z17.object({
   timestamp: timestampSchema,
-  type: z16.enum(["agent", "system", "network"]),
-  level: z16.enum(["debug", "info", "warn", "error"]),
-  message: z16.string(),
-  metadata: z16.record(z16.string(), z16.unknown()).optional()
+  type: z17.enum(["agent", "system", "network"]),
+  level: z17.enum(["debug", "info", "warn", "error"]),
+  message: z17.string(),
+  metadata: z17.record(z17.string(), z17.unknown()).optional()
 });
 var paginatedLogsSchema = createPaginatedResponseSchema(logEntrySchema);
 var logsQuerySchema = listQuerySchema.extend({
-  type: z16.enum(["agent", "system", "network", "all"]).default("all"),
+  type: z17.enum(["agent", "system", "network", "all"]).default("all"),
   since: timestampSchema.optional(),
   until: timestampSchema.optional(),
-  order: z16.enum(["asc", "desc"]).default("asc")
+  order: z17.enum(["asc", "desc"]).default("asc")
 });
-var publicRunLogsContract = c13.router({
+var publicRunLogsContract = c14.router({
   getLogs: {
     method: "GET",
     path: "/v1/runs/:id/logs",
-    pathParams: z16.object({
-      id: z16.string().min(1, "Run ID is required")
+    pathParams: z17.object({
+      id: z17.string().min(1, "Run ID is required")
     }),
     query: logsQuerySchema,
     responses: {
@@ -2222,29 +2317,29 @@ var publicRunLogsContract = c13.router({
     description: "Get unified logs for a run. Combines agent, system, and network logs."
   }
 });
-var metricPointSchema = z16.object({
+var metricPointSchema = z17.object({
   timestamp: timestampSchema,
-  cpu_percent: z16.number(),
-  memory_used_mb: z16.number(),
-  memory_total_mb: z16.number(),
-  disk_used_mb: z16.number(),
-  disk_total_mb: z16.number()
-});
-var metricsSummarySchema = z16.object({
-  avg_cpu_percent: z16.number(),
-  max_memory_used_mb: z16.number(),
-  total_duration_ms: z16.number().nullable()
-});
-var metricsResponseSchema2 = z16.object({
-  data: z16.array(metricPointSchema),
+  cpu_percent: z17.number(),
+  memory_used_mb: z17.number(),
+  memory_total_mb: z17.number(),
+  disk_used_mb: z17.number(),
+  disk_total_mb: z17.number()
+});
+var metricsSummarySchema = z17.object({
+  avg_cpu_percent: z17.number(),
+  max_memory_used_mb: z17.number(),
+  total_duration_ms: z17.number().nullable()
+});
+var metricsResponseSchema2 = z17.object({
+  data: z17.array(metricPointSchema),
   summary: metricsSummarySchema
 });
-var publicRunMetricsContract = c13.router({
+var publicRunMetricsContract = c14.router({
   getMetrics: {
     method: "GET",
     path: "/v1/runs/:id/metrics",
-    pathParams: z16.object({
-      id: z16.string().min(1, "Run ID is required")
+    pathParams: z17.object({
+      id: z17.string().min(1, "Run ID is required")
     }),
     responses: {
       200: metricsResponseSchema2,
@@ -2256,7 +2351,7 @@ var publicRunMetricsContract = c13.router({
     description: "Get CPU, memory, and disk metrics for a run"
   }
 });
-var sseEventTypeSchema = z16.enum([
+var sseEventTypeSchema = z17.enum([
   "status",
   // Run status change
   "output",
@@ -2268,25 +2363,25 @@ var sseEventTypeSchema = z16.enum([
   "heartbeat"
   // Keep-alive
 ]);
-var sseEventSchema = z16.object({
+var sseEventSchema = z17.object({
   event: sseEventTypeSchema,
-  data: z16.unknown(),
-  id: z16.string().optional()
+  data: z17.unknown(),
+  id: z17.string().optional()
   // For Last-Event-ID reconnection
 });
-var publicRunEventsContract = c13.router({
+var publicRunEventsContract = c14.router({
   streamEvents: {
     method: "GET",
     path: "/v1/runs/:id/events",
-    pathParams: z16.object({
-      id: z16.string().min(1, "Run ID is required")
+    pathParams: z17.object({
+      id: z17.string().min(1, "Run ID is required")
     }),
-    query: z16.object({
-      last_event_id: z16.string().optional()
+    query: z17.object({
+      last_event_id: z17.string().optional()
       // For reconnection
     }),
     responses: {
-      200: z16.any(),
+      200: z17.any(),
       // SSE stream - actual content is text/event-stream
       401: publicApiErrorSchema,
       404: publicApiErrorSchema,
@@ -2298,28 +2393,28 @@ var publicRunEventsContract = c13.router({
 });
 
 // ../../packages/core/src/contracts/public/artifacts.ts
-import { z as z17 } from "zod";
-var c14 = initContract();
-var publicArtifactSchema = z17.object({
-  id: z17.string(),
-  name: z17.string(),
-  current_version_id: z17.string().nullable(),
-  size: z17.number(),
+import { z as z18 } from "zod";
+var c15 = initContract();
+var publicArtifactSchema = z18.object({
+  id: z18.string(),
+  name: z18.string(),
+  current_version_id: z18.string().nullable(),
+  size: z18.number(),
   // Total size in bytes
-  file_count: z17.number(),
+  file_count: z18.number(),
   created_at: timestampSchema,
   updated_at: timestampSchema
 });
-var artifactVersionSchema = z17.object({
-  id: z17.string(),
+var artifactVersionSchema = z18.object({
+  id: z18.string(),
   // SHA-256 content hash
-  artifact_id: z17.string(),
-  size: z17.number(),
+  artifact_id: z18.string(),
+  size: z18.number(),
   // Size in bytes
-  file_count: z17.number(),
-  message: z17.string().nullable(),
+  file_count: z18.number(),
+  message: z18.string().nullable(),
   // Optional commit message
-  created_by: z17.string(),
+  created_by: z18.string(),
   created_at: timestampSchema
 });
 var publicArtifactDetailSchema = publicArtifactSchema.extend({
@@ -2329,7 +2424,7 @@ var paginatedArtifactsSchema = createPaginatedResponseSchema(publicArtifactSchem
 var paginatedArtifactVersionsSchema = createPaginatedResponseSchema(
   artifactVersionSchema
 );
-var publicArtifactsListContract = c14.router({
+var publicArtifactsListContract = c15.router({
   list: {
     method: "GET",
     path: "/v1/artifacts",
@@ -2343,12 +2438,12 @@ var publicArtifactsListContract = c14.router({
     description: "List all artifacts in the current scope with pagination"
   }
 });
-var publicArtifactByIdContract = c14.router({
+var publicArtifactByIdContract = c15.router({
   get: {
     method: "GET",
     path: "/v1/artifacts/:id",
-    pathParams: z17.object({
-      id: z17.string().min(1, "Artifact ID is required")
+    pathParams: z18.object({
+      id: z18.string().min(1, "Artifact ID is required")
     }),
     responses: {
       200: publicArtifactDetailSchema,
@@ -2360,12 +2455,12 @@ var publicArtifactByIdContract = c14.router({
     description: "Get artifact details by ID"
   }
 });
-var publicArtifactVersionsContract = c14.router({
+var publicArtifactVersionsContract = c15.router({
   list: {
     method: "GET",
     path: "/v1/artifacts/:id/versions",
-    pathParams: z17.object({
-      id: z17.string().min(1, "Artifact ID is required")
+    pathParams: z18.object({
+      id: z18.string().min(1, "Artifact ID is required")
     }),
     query: listQuerySchema,
     responses: {
@@ -2378,19 +2473,19 @@ var publicArtifactVersionsContract = c14.router({
     description: "List all versions of an artifact with pagination"
   }
 });
-var publicArtifactDownloadContract = c14.router({
+var publicArtifactDownloadContract = c15.router({
   download: {
     method: "GET",
     path: "/v1/artifacts/:id/download",
-    pathParams: z17.object({
-      id: z17.string().min(1, "Artifact ID is required")
+    pathParams: z18.object({
+      id: z18.string().min(1, "Artifact ID is required")
     }),
-    query: z17.object({
-      version_id: z17.string().optional()
+    query: z18.object({
+      version_id: z18.string().optional()
       // Defaults to current version
     }),
     responses: {
-      302: z17.undefined(),
+      302: z18.undefined(),
       // Redirect to presigned URL
       401: publicApiErrorSchema,
       404: publicApiErrorSchema,
@@ -2402,28 +2497,28 @@ var publicArtifactDownloadContract = c14.router({
 });
 
 // ../../packages/core/src/contracts/public/volumes.ts
-import { z as z18 } from "zod";
-var c15 = initContract();
-var publicVolumeSchema = z18.object({
-  id: z18.string(),
-  name: z18.string(),
-  current_version_id: z18.string().nullable(),
-  size: z18.number(),
+import { z as z19 } from "zod";
+var c16 = initContract();
+var publicVolumeSchema = z19.object({
+  id: z19.string(),
+  name: z19.string(),
+  current_version_id: z19.string().nullable(),
+  size: z19.number(),
   // Total size in bytes
-  file_count: z18.number(),
+  file_count: z19.number(),
   created_at: timestampSchema,
   updated_at: timestampSchema
 });
-var volumeVersionSchema = z18.object({
-  id: z18.string(),
+var volumeVersionSchema = z19.object({
+  id: z19.string(),
   // SHA-256 content hash
-  volume_id: z18.string(),
-  size: z18.number(),
+  volume_id: z19.string(),
+  size: z19.number(),
   // Size in bytes
-  file_count: z18.number(),
-  message: z18.string().nullable(),
+  file_count: z19.number(),
+  message: z19.string().nullable(),
   // Optional commit message
-  created_by: z18.string(),
+  created_by: z19.string(),
   created_at: timestampSchema
 });
 var publicVolumeDetailSchema = publicVolumeSchema.extend({
@@ -2431,7 +2526,7 @@ var publicVolumeDetailSchema = publicVolumeSchema.extend({
 });
 var paginatedVolumesSchema = createPaginatedResponseSchema(publicVolumeSchema);
 var paginatedVolumeVersionsSchema = createPaginatedResponseSchema(volumeVersionSchema);
-var publicVolumesListContract = c15.router({
+var publicVolumesListContract = c16.router({
   list: {
     method: "GET",
     path: "/v1/volumes",
@@ -2445,12 +2540,12 @@ var publicVolumesListContract = c15.router({
     description: "List all volumes in the current scope with pagination"
   }
 });
-var publicVolumeByIdContract = c15.router({
+var publicVolumeByIdContract = c16.router({
   get: {
     method: "GET",
     path: "/v1/volumes/:id",
-    pathParams: z18.object({
-      id: z18.string().min(1, "Volume ID is required")
+    pathParams: z19.object({
+      id: z19.string().min(1, "Volume ID is required")
     }),
     responses: {
       200: publicVolumeDetailSchema,
@@ -2462,12 +2557,12 @@ var publicVolumeByIdContract = c15.router({
     description: "Get volume details by ID"
   }
 });
-var publicVolumeVersionsContract = c15.router({
+var publicVolumeVersionsContract = c16.router({
   list: {
     method: "GET",
     path: "/v1/volumes/:id/versions",
-    pathParams: z18.object({
-      id: z18.string().min(1, "Volume ID is required")
+    pathParams: z19.object({
+      id: z19.string().min(1, "Volume ID is required")
     }),
     query: listQuerySchema,
     responses: {
@@ -2480,19 +2575,19 @@ var publicVolumeVersionsContract = c15.router({
     description: "List all versions of a volume with pagination"
   }
 });
-var publicVolumeDownloadContract = c15.router({
+var publicVolumeDownloadContract = c16.router({
   download: {
     method: "GET",
     path: "/v1/volumes/:id/download",
-    pathParams: z18.object({
-      id: z18.string().min(1, "Volume ID is required")
+    pathParams: z19.object({
+      id: z19.string().min(1, "Volume ID is required")
     }),
-    query: z18.object({
-      version_id: z18.string().optional()
+    query: z19.object({
+      version_id: z19.string().optional()
       // Defaults to current version
     }),
     responses: {
-      302: z18.undefined(),
+      302: z19.undefined(),
       // Redirect to presigned URL
       401: publicApiErrorSchema,
       404: publicApiErrorSchema,
@@ -3292,6 +3387,86 @@ var ApiClient = class {
     }
     return response.json();
   }
+  /**
+   * List credentials (metadata only, no values)
+   */
+  async listCredentials() {
+    const baseUrl = await this.getBaseUrl();
+    const headers = await this.getHeaders();
+    const client = initClient(credentialsMainContract, {
+      baseUrl,
+      baseHeaders: headers,
+      jsonQuery: true
+    });
+    const result = await client.list();
+    if (result.status === 200) {
+      return result.body;
+    }
+    const errorBody = result.body;
+    const message = errorBody.error?.message || "Failed to list credentials";
+    throw new Error(message);
+  }
+  /**
+   * Get credential by name (metadata only, no value)
+   */
+  async getCredential(name) {
+    const baseUrl = await this.getBaseUrl();
+    const headers = await this.getHeaders();
+    const client = initClient(credentialsByNameContract, {
+      baseUrl,
+      baseHeaders: headers,
+      jsonQuery: true
+    });
+    const result = await client.get({
+      params: { name }
+    });
+    if (result.status === 200) {
+      return result.body;
+    }
+    const errorBody = result.body;
+    const message = errorBody.error?.message || `Credential "${name}" not found`;
+    throw new Error(message);
+  }
+  /**
+   * Set (create or update) a credential
+   */
+  async setCredential(body) {
+    const baseUrl = await this.getBaseUrl();
+    const headers = await this.getHeaders();
+    const client = initClient(credentialsMainContract, {
+      baseUrl,
+      baseHeaders: headers,
+      jsonQuery: true
+    });
+    const result = await client.set({ body });
+    if (result.status === 200 || result.status === 201) {
+      return result.body;
+    }
+    const errorBody = result.body;
+    const message = errorBody.error?.message || "Failed to set credential";
+    throw new Error(message);
+  }
+  /**
+   * Delete a credential by name
+   */
+  async deleteCredential(name) {
+    const baseUrl = await this.getBaseUrl();
+    const headers = await this.getHeaders();
+    const client = initClient(credentialsByNameContract, {
+      baseUrl,
+      baseHeaders: headers,
+      jsonQuery: true
+    });
+    const result = await client.delete({
+      params: { name }
+    });
+    if (result.status === 204) {
+      return;
+    }
+    const errorBody = result.body;
+    const message = errorBody.error?.message || `Credential "${name}" not found`;
+    throw new Error(message);
+  }
   /**
    * Generic GET request
    */
@@ -3363,7 +3538,7 @@ var ApiClient = class {
 var apiClient = new ApiClient();
 
 // src/lib/domain/yaml-validator.ts
-import { z as z19 } from "zod";
+import { z as z20 } from "zod";
 
 // src/lib/domain/provider-config.ts
 var PROVIDER_DEFAULTS = {
@@ -3430,7 +3605,7 @@ function getDefaultImageWithApps(provider, apps) {
 }
 
 // src/lib/domain/yaml-validator.ts
-var cliAgentNameSchema = z19.string().min(3, "Agent name must be at least 3 characters").max(64, "Agent name must be 64 characters or less").regex(
+var cliAgentNameSchema = z20.string().min(3, "Agent name must be at least 3 characters").max(64, "Agent name must be 64 characters or less").regex(
   /^[a-zA-Z0-9]([a-zA-Z0-9-]{0,62}[a-zA-Z0-9])?$/,
   "Agent name must start and end with letter or number, and contain only letters, numbers, and hyphens"
 );
@@ -3443,14 +3618,14 @@ var cliAgentDefinitionSchema = agentDefinitionSchema.superRefine(
     const providerSupported = isProviderSupported(agent.provider);
     if (!agent.image && !providerSupported) {
       ctx.addIssue({
-        code: z19.ZodIssueCode.custom,
+        code: z20.ZodIssueCode.custom,
         message: "Missing agent.image (required when provider is not auto-configured)",
         path: ["image"]
       });
     }
     if (!agent.working_dir && !providerSupported) {
       ctx.addIssue({
-        code: z19.ZodIssueCode.custom,
+        code: z20.ZodIssueCode.custom,
         message: "Missing agent.working_dir (required when provider is not auto-configured)",
         path: ["working_dir"]
       });
@@ -3460,7 +3635,7 @@ var cliAgentDefinitionSchema = agentDefinitionSchema.superRefine(
         const skillUrl = agent.skills[i];
         if (skillUrl && !validateGitHubTreeUrl(skillUrl)) {
           ctx.addIssue({
-            code: z19.ZodIssueCode.custom,
+            code: z20.ZodIssueCode.custom,
             message: `Invalid skill URL: ${skillUrl}. Expected format: https://github.com/{owner}/{repo}/tree/{branch}/{path}`,
             path: ["skills", i]
           });
@@ -3469,15 +3644,15 @@ var cliAgentDefinitionSchema = agentDefinitionSchema.superRefine(
     }
   }
 );
-var cliComposeSchema = z19.object({
-  version: z19.string().min(1, "Missing config.version"),
-  agents: z19.record(cliAgentNameSchema, cliAgentDefinitionSchema),
-  volumes: z19.record(z19.string(), volumeConfigSchema).optional()
+var cliComposeSchema = z20.object({
+  version: z20.string().min(1, "Missing config.version"),
+  agents: z20.record(cliAgentNameSchema, cliAgentDefinitionSchema),
+  volumes: z20.record(z20.string(), volumeConfigSchema).optional()
 }).superRefine((config, ctx) => {
   const agentKeys = Object.keys(config.agents);
   if (agentKeys.length === 0) {
     ctx.addIssue({
-      code: z19.ZodIssueCode.custom,
+      code: z20.ZodIssueCode.custom,
       message: "agents must have at least one agent defined",
       path: ["agents"]
     });
@@ -3485,7 +3660,7 @@ var cliComposeSchema = z19.object({
   }
   if (agentKeys.length > 1) {
     ctx.addIssue({
-      code: z19.ZodIssueCode.custom,
+      code: z20.ZodIssueCode.custom,
       message: "Multiple agents not supported yet. Only one agent allowed.",
       path: ["agents"]
     });
@@ -3497,7 +3672,7 @@ var cliComposeSchema = z19.object({
   if (agentVolumes && agentVolumes.length > 0) {
     if (!config.volumes) {
       ctx.addIssue({
-        code: z19.ZodIssueCode.custom,
+        code: z20.ZodIssueCode.custom,
         message: "Agent references volumes but no volumes section defined. Each volume must have explicit name and version.",
         path: ["volumes"]
       });
@@ -3507,7 +3682,7 @@ var cliComposeSchema = z19.object({
       const parts = volDeclaration.split(":");
       if (parts.length !== 2) {
         ctx.addIssue({
-          code: z19.ZodIssueCode.custom,
+          code: z20.ZodIssueCode.custom,
           message: `Invalid volume declaration: ${volDeclaration}. Expected format: volume-key:/mount/path`,
           path: ["agents", agentName, "volumes"]
         });
@@ -3516,7 +3691,7 @@ var cliComposeSchema = z19.object({
       const volumeKey = parts[0].trim();
       if (!config.volumes[volumeKey]) {
         ctx.addIssue({
-          code: z19.ZodIssueCode.custom,
+          code: z20.ZodIssueCode.custom,
           message: `Volume "${volumeKey}" is not defined in volumes section. Each volume must have explicit name and version.`,
           path: ["volumes", volumeKey]
         });
@@ -4577,9 +4752,9 @@ var CodexEventParser = class {
       }
     }
     if (itemType === "file_change" && item.changes && item.changes.length > 0) {
-      const changes = item.changes.map((c16) => {
-        const action = c16.kind === "add" ? "Created" : c16.kind === "modify" ? "Modified" : "Deleted";
-        return `${action}: ${c16.path}`;
+      const changes = item.changes.map((c17) => {
+        const action = c17.kind === "add" ? "Created" : c17.kind === "modify" ? "Modified" : "Deleted";
+        return `${action}: ${c17.path}`;
       }).join("\n");
       return {
         type: "text",
@@ -4920,9 +5095,9 @@ var CodexEventRenderer = class {
       return;
     }
     if (itemType === "file_change" && item.changes && item.changes.length > 0) {
-      const summary = item.changes.map((c16) => {
-        const icon = c16.kind === "add" ? "+" : c16.kind === "delete" ? "-" : "~";
-        return `${icon}${c16.path}`;
+      const summary = item.changes.map((c17) => {
+        const icon = c17.kind === "add" ? "+" : c17.kind === "delete" ? "-" : "~";
+        return `${icon}${c17.path}`;
       }).join(", ");
       console.log(chalk4.green("[files]") + ` ${summary}`);
       return;
@@ -6772,7 +6947,7 @@ async function autoPullArtifact(runOutput, artifactDir) {
 var cookCmd = new Command17().name("cook").description("One-click agent preparation and execution from vm0.yaml");
 cookCmd.argument("[prompt]", "Prompt for the agent").option("-y, --yes", "Skip confirmation prompts").option("--debug-no-mock-claude").action(
   async (prompt, options) => {
-    const shouldExit = await checkAndUpgrade("5.8.0", prompt);
+    const shouldExit = await checkAndUpgrade("5.9.0", prompt);
     if (shouldExit) {
       process.exit(0);
     }
@@ -7473,7 +7648,7 @@ var listCommand3 = new Command22().name("list").alias("ls").description("List al
       );
       return;
     }
-    const nameWidth = Math.max(4, ...data.composes.map((c16) => c16.name.length));
+    const nameWidth = Math.max(4, ...data.composes.map((c17) => c17.name.length));
     const header = ["NAME".padEnd(nameWidth), "VERSION", "UPDATED"].join(
       "  "
     );
@@ -9627,11 +9802,152 @@ var usageCommand = new Command35().name("usage").description("View usage statist
   }
 });
 
+// src/commands/credential/index.ts
+import { Command as Command39 } from "commander";
+
+// src/commands/credential/list.ts
+import { Command as Command36 } from "commander";
+import chalk37 from "chalk";
+var listCommand5 = new Command36().name("list").description("List all credentials").option("--json", "Output in JSON format").action(async (options) => {
+  try {
+    const result = await apiClient.listCredentials();
+    if (options.json) {
+      console.log(JSON.stringify(result.credentials, null, 2));
+      return;
+    }
+    if (result.credentials.length === 0) {
+      console.log(chalk37.dim("No credentials found."));
+      console.log();
+      console.log("To add a credential:");
+      console.log(chalk37.cyan("  vm0 credential set MY_API_KEY <value>"));
+      return;
+    }
+    console.log(chalk37.bold("Credentials:"));
+    console.log();
+    for (const credential of result.credentials) {
+      console.log(`  ${chalk37.cyan(credential.name)}`);
+      if (credential.description) {
+        console.log(`    ${chalk37.dim(credential.description)}`);
+      }
+      console.log(
+        `    ${chalk37.dim(`Updated: ${new Date(credential.updatedAt).toLocaleString()}`)}`
+      );
+      console.log();
+    }
+    console.log(
+      chalk37.dim(`Total: ${result.credentials.length} credential(s)`)
+    );
+  } catch (error) {
+    if (error instanceof Error) {
+      if (error.message.includes("Not authenticated")) {
+        console.error(chalk37.red("\u2717 Not authenticated. Run: vm0 auth login"));
+      } else {
+        console.error(chalk37.red(`\u2717 ${error.message}`));
+      }
+    } else {
+      console.error(chalk37.red("\u2717 An unexpected error occurred"));
+    }
+    process.exit(1);
+  }
+});
+
+// src/commands/credential/set.ts
+import { Command as Command37 } from "commander";
+import chalk38 from "chalk";
+var setCommand2 = new Command37().name("set").description("Create or update a credential").argument("<name>", "Credential name (uppercase, e.g., MY_API_KEY)").argument("<value>", "Credential value").option("-d, --description <description>", "Optional description").action(
+  async (name, value, options) => {
+    try {
+      const credential = await apiClient.setCredential({
+        name,
+        value,
+        description: options.description
+      });
+      console.log(chalk38.green(`\u2713 Credential "${credential.name}" saved`));
+      console.log();
+      console.log("Use in vm0.yaml:");
+      console.log(chalk38.cyan(`  environment:`));
+      console.log(chalk38.cyan(`    ${name}: \${{ credentials.${name} }}`));
+    } catch (error) {
+      if (error instanceof Error) {
+        if (error.message.includes("Not authenticated")) {
+          console.error(
+            chalk38.red("\u2717 Not authenticated. Run: vm0 auth login")
+          );
+        } else if (error.message.includes("must contain only uppercase")) {
+          console.error(chalk38.red(`\u2717 ${error.message}`));
+          console.log();
+          console.log("Examples of valid credential names:");
+          console.log(chalk38.dim("  MY_API_KEY"));
+          console.log(chalk38.dim("  GITHUB_TOKEN"));
+          console.log(chalk38.dim("  AWS_ACCESS_KEY_ID"));
+        } else {
+          console.error(chalk38.red(`\u2717 ${error.message}`));
+        }
+      } else {
+        console.error(chalk38.red("\u2717 An unexpected error occurred"));
+      }
+      process.exit(1);
+    }
+  }
+);
+
+// src/commands/credential/delete.ts
+import { Command as Command38 } from "commander";
+import chalk39 from "chalk";
+var deleteCommand2 = new Command38().name("delete").description("Delete a credential").argument("<name>", "Credential name to delete").option("-y, --yes", "Skip confirmation prompt").action(async (name, options) => {
+  try {
+    try {
+      await apiClient.getCredential(name);
+    } catch {
+      console.error(chalk39.red(`\u2717 Credential "${name}" not found`));
+      process.exit(1);
+    }
+    if (!options.yes) {
+      const readline2 = await import("readline");
+      const rl = readline2.createInterface({
+        input: process.stdin,
+        output: process.stdout
+      });
+      const confirmed = await new Promise((resolve2) => {
+        rl.question(
+          chalk39.yellow(
+            `Are you sure you want to delete credential "${name}"? (y/N) `
+          ),
+          (answer) => {
+            rl.close();
+            resolve2(answer.toLowerCase() === "y");
+          }
+        );
+      });
+      if (!confirmed) {
+        console.log(chalk39.dim("Cancelled."));
+        return;
+      }
+    }
+    await apiClient.deleteCredential(name);
+    console.log(chalk39.green(`\u2713 Credential "${name}" deleted`));
+  } catch (error) {
+    if (error instanceof Error) {
+      if (error.message.includes("Not authenticated")) {
+        console.error(chalk39.red("\u2717 Not authenticated. Run: vm0 auth login"));
+      } else {
+        console.error(chalk39.red(`\u2717 ${error.message}`));
+      }
+    } else {
+      console.error(chalk39.red("\u2717 An unexpected error occurred"));
+    }
+    process.exit(1);
+  }
+});
+
+// src/commands/credential/index.ts
+var credentialCommand = new Command39().name("experimental-credential").description("[Experimental] Manage stored credentials for agent runs").addCommand(listCommand5).addCommand(setCommand2).addCommand(deleteCommand2);
+
 // src/index.ts
-var program = new Command36();
-program.name("vm0").description("VM0 CLI - A modern build tool").version("5.8.0");
+var program = new Command40();
+program.name("vm0").description("VM0 CLI - A modern build tool").version("5.9.0");
 program.command("info").description("Display environment information").action(async () => {
-  console.log(chalk37.bold("System Information:"));
+  console.log(chalk40.bold("System Information:"));
   console.log(`Node Version: ${process.version}`);
   console.log(`Platform: ${process.platform}`);
   console.log(`Architecture: ${process.arch}`);
@@ -9663,6 +9979,7 @@ program.addCommand(initCommand3);
 program.addCommand(setupGithubCommand);
 program.addCommand(scheduleCommand);
 program.addCommand(usageCommand);
+program.addCommand(credentialCommand);
 if (process.argv[1]?.endsWith("index.js") || process.argv[1]?.endsWith("index.ts") || process.argv[1]?.endsWith("vm0")) {
   program.parse();
 }