primitive-admin 1.0.61 → 1.0.63

package/dist/src/commands/integrations.js

@@ -1,23 +1,36 @@
-import { readFileSync } from "fs";
-import { parseConfigToml } from "../lib/config-toml.js";
 import chalk from "chalk";
 import { ApiClient } from "../lib/api-client.js";
 import { resolveAppId } from "../lib/config.js";
-import { success, error, info, warn, keyValue, result as printResult, formatTable, formatId, formatDate, formatStatus, formatDuration, json, divider, } from "../lib/output.js";
+import { success, error, info, keyValue, result as printResult, formatTable, formatId, formatDate, formatStatus, formatDuration, json, divider, } from "../lib/output.js";
+import { buildIntegrationEnvelope } from "../lib/log-inspection.js";
 import { confirmPrompt } from "../lib/confirm-prompt.js";
+import { parseStatusFilter } from "../lib/object-status-filter.js";
+import { testCaseInputVariables } from "../lib/test-case-variables.js";
+import { resolveIntegrationSelector } from "../lib/integration-selector.js";
 export function registerIntegrationsCommands(program) {
     const integrations = program
         .command("integrations")
-        .description("Configure external HTTP API connections and manage secrets")
+        .description("Configure external HTTP API connections")
         .addHelpText("after", `
 Examples:
   $ primitive integrations list
-  $ primitive integrations create --from-file weather-api.toml
+  $ primitive config create integration weather-api       # scaffold integrations/weather-api.toml
+  $ primitive config push --only integration/weather-api  # apply it
   $ primitive integrations test 01HXY...
+  $ primitive integrations archive 01HXY...             # retire it (soft delete)
 
-Storing secrets for an integration (integration secrets are deprecated):
+Storing credentials for an integration:
   $ primitive secrets set MY_API_KEY --value <value>
   # then reference it in integration config via {{secrets.MY_API_KEY}}
+`);
+    // Server-side configuration is authored in TOML and applied with `config push`
+    // (issue #2645) — this group no longer carries config-setting flags.
+    integrations.addHelpText("after", `
+Configuration lives in integrations/<key>.toml:
+  $ primitive config fields integration        # the file's keys, types and defaults
+  $ primitive config create integration <key>  # scaffold one locally
+  $ primitive config set integration/<key> <path>=<value>
+  $ primitive config push --only integration/<key>
 `);
     // List integrations
     integrations
@@ -25,14 +38,20 @@ Storing secrets for an integration (integration secrets are deprecated):
         .description("List integrations")
         .argument("[app-id]", "App ID (uses current app if not specified)")
         .option("--app <app-id>", "App ID")
-        .option("--status <status>", "Filter by status: draft, active, archived")
+        .option("--status <status>", "Filter by status: active, inactive, archived")
         .option("--json", "Output as JSON")
         .action(async (appId, options) => {
         const resolvedAppId = resolveAppId(appId, options);
         const client = new ApiClient();
         try {
+            // #2803 — `draft` is gone; refuse it by name rather than returning the
+            // empty list a canonical filter would produce.
             const { items } = await client.listIntegrations(resolvedAppId, {
-                status: options.status,
+                status: parseStatusFilter("integrations", options.status, [
+                    "active",
+                    "inactive",
+                    "archived",
+                ]),
             });
             if (options.json) {
                 json(items);
@@ -55,75 +74,112 @@ Storing secrets for an integration (integration secrets are deprecated):
             process.exit(1);
         }
     });
-    // Create integration
+    // #2645 criterion 9 / #2803 — the operational verbs. They are the only
+    // writers of `status`, which is server-owned and no longer a TOML key.
     integrations
-        .command("create")
-        .description("Create a new integration")
-        .argument("[app-id]", "App ID (uses current app if not specified)")
-        .option("--app <app-id>", "App ID")
-        .option("--key <key>", "Integration key (unique identifier)")
-        .option("--name <name>", "Display name")
-        .option("--description <desc>", "Description")
-        .option("--base-url <url>", "Base URL for API requests")
-        .option("--allowed-methods <methods>", "Comma-separated list of allowed HTTP methods")
-        .option("--allowed-paths <paths>", "Comma-separated list of allowed paths")
-        .option("--timeout-ms <ms>", "Request timeout in milliseconds")
-        .option("--from-file <path>", "Load integration from TOML file")
+        .command("disable")
+        .description("Take integration out of service now. Operational, not configuration: `status` is server-owned and 'config push' can neither set nor clear it.")
+        .argument("<integration-id>", "Integration ID")
+        .option("--app <app-id>", "App ID (uses current app if not specified)")
         .option("--json", "Output as JSON")
-        .action(async (appId, options) => {
-        const resolvedAppId = resolveAppId(appId, options);
+        .action(async (id, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
         const client = new ApiClient();
-        let payload;
-        if (options.fromFile) {
+        try {
+            const result = await client.setIntegrationAvailability(resolvedAppId, id, "disable");
+            if (options.json) {
+                json(result);
+                return;
+            }
+            success(`Integration disabled: ${result.integrationKey || id}`);
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    integrations
+        .command("enable")
+        .description("Put integration back in service.")
+        .argument("<integration-id>", "Integration ID")
+        .option("--app <app-id>", "App ID (uses current app if not specified)")
+        .option("--json", "Output as JSON")
+        .action(async (id, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        try {
+            const result = await client.setIntegrationAvailability(resolvedAppId, id, "enable");
+            if (options.json) {
+                json(result);
+                return;
+            }
+            success(`Integration enabled: ${result.integrationKey || id}`);
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    // #2907 — the delete flow's CLI spelling. Not a second writer of `status`:
+    // this is the plain `DELETE` the server has always answered by writing the
+    // tombstone, which until now only the admin API and the console could reach.
+    // Named `archive`, not `delete`, because a configuration noun gets no
+    // `delete` verb (docs/cli-design.md) and prune-by-push stays the only CLI
+    // hard-delete path.
+    integrations
+        .command("archive")
+        .description("Retire an integration (soft delete). Delete-lifecycle, not `disable`: the row is kept, goes on holding its key, and there is no un-archive.")
+        .argument("<integration-id>", "Integration ID")
+        .option("--app <app-id>", "App ID (uses current app if not specified)")
+        .option("-y, --yes", "Skip confirmation prompt")
+        .option("--json", "Output as JSON")
+        .addHelpText("after", `
+What archiving an integration costs:
+  The proxy refuses it, and so does every workflow step that calls it.
+  The archived row still holds its integrationKey, so a push cannot re-create
+  one under the same key.
+  \`primitive integrations enable\` refuses an archived integration; there is no
+  un-archive.
+
+Reclaiming the key means hard-deleting the row:
+  $ rm integrations/<key>.toml
+  $ primitive config push --prune     # confirmed; hard-deletes the row
+  # or hard-delete it in the console, then re-add the file and push.
+`)
+        .action(async (id, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        if (!options.yes) {
+            let confirmed;
             try {
-                const content = readFileSync(options.fromFile, "utf-8");
-                const tomlData = parseConfigToml(content);
-                payload = {
-                    integrationKey: tomlData.integration?.key || tomlData.key,
-                    displayName: tomlData.integration?.displayName || tomlData.displayName,
-                    description: tomlData.integration?.description || tomlData.description,
-                    requestConfig: tomlData.requestConfig || {},
-                    timeoutMs: tomlData.integration?.timeoutMs || tomlData.timeoutMs,
-                };
+                confirmed = await confirmPrompt(`Archive integration ${id}? It is retired, goes on holding its key, ` +
+                    `and there is no un-archive.`);
             }
             catch (err) {
-                error(`Failed to read TOML file: ${err.message}`);
+                error(err.message);
                 process.exit(1);
             }
-        }
-        else {
-            if (!options.key || !options.name || !options.baseUrl) {
-                error("Required: --key, --name, --base-url (or use --from-file)");
-                process.exit(1);
+            if (!confirmed) {
+                info("Cancelled.");
+                return;
             }
-            payload = {
-                integrationKey: options.key,
-                displayName: options.name,
-                description: options.description,
-                requestConfig: {
-                    baseUrl: options.baseUrl,
-                    allowedMethods: options.allowedMethods?.split(",").map((s) => s.trim()),
-                    allowedPaths: options.allowedPaths?.split(",").map((s) => s.trim()),
-                },
-                timeoutMs: options.timeoutMs ? parseInt(options.timeoutMs) : undefined,
-            };
         }
+        const client = new ApiClient();
         try {
-            const result = await client.createIntegration(resolvedAppId, payload);
+            // The soft delete: no `hard`, so the server writes the tombstone and
+            // keeps the row (and its canonical block mirror) in step.
+            const result = await client.deleteIntegration(resolvedAppId, id);
             if (options.json) {
                 json(result);
                 return;
             }
-            success(`Integration created: ${result.displayName}`);
-            keyValue("Integration ID", result.integrationId);
-            keyValue("Key", result.integrationKey);
+            success(`Integration archived: ${id}`);
+            info("It is retired and still holds its key — reclaim the key by removing its file and running a confirmed `primitive config push --prune`.");
         }
         catch (err) {
             error(err.message);
             process.exit(1);
         }
     });
-    // Get integration
     integrations
         .command("get")
         .description("Get integration details")
@@ -145,6 +201,12 @@ Storing secrets for an integration (integration secrets are deprecated):
             printResult("Description", result.description);
             printResult("Status", formatStatus(result.status));
             printResult("Timeout", result.timeoutMs ? `${result.timeoutMs}ms` : "-");
+            // #2631: no rule means every non-admin call is denied. Print that in
+            // words — a blank or "-" would read as "unrestricted" and hide an
+            // integration that was never given a rule.
+            printResult("Access Rule", typeof result.accessRule === "string" && result.accessRule !== ""
+                ? result.accessRule
+                : "(none — all non-admin calls are denied; set one to allow callers)");
             if (result.requestConfig) {
                 divider();
                 info("Request Config:");
@@ -167,82 +229,6 @@ Storing secrets for an integration (integration secrets are deprecated):
             process.exit(1);
         }
     });
-    // Update integration
-    integrations
-        .command("update")
-        .description("Update an integration")
-        .argument("<integration-id>", "Integration ID")
-        .option("--app <app-id>", "App ID (uses current app if not specified)")
-        .option("--name <name>", "Display name")
-        .option("--description <desc>", "Description")
-        .option("--status <status>", "Status: draft, active, archived")
-        .option("--timeout-ms <ms>", "Request timeout in milliseconds")
-        .option("--json", "Output as JSON")
-        .action(async (integrationId, options) => {
-        const resolvedAppId = resolveAppId(undefined, options);
-        const payload = {};
-        if (options.name)
-            payload.displayName = options.name;
-        if (options.description)
-            payload.description = options.description;
-        if (options.status)
-            payload.status = options.status;
-        if (options.timeoutMs)
-            payload.timeoutMs = parseInt(options.timeoutMs);
-        if (Object.keys(payload).length === 0) {
-            error("No update options specified.");
-            process.exit(1);
-        }
-        const client = new ApiClient();
-        try {
-            const result = await client.updateIntegration(resolvedAppId, integrationId, payload);
-            if (options.json) {
-                json(result);
-                return;
-            }
-            success("Integration updated.");
-        }
-        catch (err) {
-            error(err.message);
-            process.exit(1);
-        }
-    });
-    // Delete integration
-    integrations
-        .command("delete")
-        .description("Delete or archive an integration")
-        .argument("<integration-id>", "Integration ID")
-        .option("--app <app-id>", "App ID (uses current app if not specified)")
-        .option("--hard", "Permanently delete instead of archive")
-        .option("-y, --yes", "Skip confirmation prompt")
-        .action(async (integrationId, options) => {
-        const resolvedAppId = resolveAppId(undefined, options);
-        if (!options.yes) {
-            const action = options.hard ? "permanently delete" : "archive";
-            let confirm;
-            try {
-                confirm = await confirmPrompt(`Are you sure you want to ${action} integration ${integrationId}?`);
-            }
-            catch (err) {
-                error(err.message);
-                process.exit(1);
-            }
-            if (!confirm) {
-                info("Cancelled.");
-                return;
-            }
-        }
-        const client = new ApiClient();
-        try {
-            await client.deleteIntegration(resolvedAppId, integrationId, options.hard);
-            success(`Integration ${options.hard ? "deleted" : "archived"}.`);
-        }
-        catch (err) {
-            error(err.message);
-            process.exit(1);
-        }
-    });
-    // Test integration
     integrations
         .command("test")
         .description("Test an integration by making a request")
@@ -313,6 +299,9 @@ Storing secrets for an integration (integration secrets are deprecated):
         .option("--app <app-id>", "App ID (uses current app if not specified)")
         .option("--limit <n>", "Number of logs to show", "20")
         .option("--source <source>", "Filter by call source: user, admin, test, or workflow")
+        .option("--status <status>", "Filter by upstream HTTP status (e.g. 200, 500)")
+        .option("--from <iso>", "Only logs at or after this ISO timestamp")
+        .option("--to <iso>", "Only logs at or before this ISO timestamp")
         .option("--json", "Output as JSON")
         .action(async (integrationId, options) => {
         const resolvedAppId = resolveAppId(undefined, options);
@@ -326,9 +315,12 @@ Storing secrets for an integration (integration secrets are deprecated):
             const logs = await client.listIntegrationLogs(resolvedAppId, integrationId, {
                 limit: parseInt(options.limit),
                 ...(options.source && { source: options.source }),
+                ...(options.status && { status: options.status }),
+                ...(options.from && { from: options.from }),
+                ...(options.to && { to: options.to }),
             });
             if (options.json) {
-                json(logs);
+                json(buildIntegrationEnvelope(logs));
                 return;
             }
             if (!logs || logs.length === 0) {
@@ -352,115 +344,43 @@ Storing secrets for an integration (integration secrets are deprecated):
             process.exit(1);
         }
     });
-    // Secrets subcommand
-    //
-    // Integration secrets are deprecated. New secrets can no longer be created
-    // (the `add` subcommand below is hidden from help and the command manifest,
-    // but kept registered so scripted callers still get a clear deprecation
-    // error — see issue #1026). The modern path is App Secrets:
-    //   primitive secrets set <key> --value <value>
-    // then reference them in integration config via {{secrets.KEY}}.
-    const secrets = integrations
-        .command("secrets")
-        .description("Manage integration secrets (deprecated — use `primitive secrets set` and reference {{secrets.KEY}} in integration config instead)");
-    // List secrets
-    secrets
-        .command("list")
-        .description("List secrets for an integration")
-        .argument("<integration-id>", "Integration ID")
-        .option("--app <app-id>", "App ID (uses current app if not specified)")
-        .option("--json", "Output as JSON")
-        .action(async (integrationId, options) => {
-        const resolvedAppId = resolveAppId(undefined, options);
-        const client = new ApiClient();
-        try {
-            warn("Integration secrets are deprecated. Use App Secrets with {{secrets.KEY}} templates instead.");
-            const secretsList = await client.listIntegrationSecrets(resolvedAppId, integrationId);
-            if (options.json) {
-                json(secretsList);
-                return;
-            }
-            if (!secretsList || secretsList.length === 0) {
-                info("No secrets found.");
-                return;
-            }
-            console.log(formatTable(secretsList, [
-                { header: "ID", key: "secretId", format: formatId },
-                { header: "VERSION", key: "version" },
-                { header: "SUMMARY", key: "secretSummary" },
-                { header: "STATUS", key: "status", format: formatStatus },
-                { header: "CREATED", key: "createdAt", format: formatDate },
-            ]));
-        }
-        catch (err) {
-            error(err.message);
-            process.exit(1);
-        }
-    });
-    // Add secret
-    //
-    // Deprecated and disabled: hidden from `--help` and the command manifest
-    // (issue #1026) so the CLI no longer advertises a command that can never
-    // succeed, but still registered so an explicit/scripted invocation gets the
-    // clear deprecation error below rather than an "unknown command" error.
-    secrets
-        .command("add", { hidden: true })
-        .description("Add a secret to an integration (deprecated — use `primitive secrets set`)")
-        .argument("<integration-id>", "Integration ID")
-        .option("--app <app-id>", "App ID (uses current app if not specified)")
-        .option("--data <json>", "Secret data as JSON (e.g., '{\"apiKey\":\"...\"}' )")
-        .option("--summary <text>", "Description of the secret")
-        .option("--json", "Output as JSON")
-        .action(async () => {
-        error("Integration secrets are deprecated and can no longer be created.");
-        info("Use App Secrets with {{secrets.KEY}} templates in defaultHeaders or staticQuery instead.");
-        info("See: primitive secrets set <key> --value <value>");
-        process.exit(1);
-    });
-    // Archive secret
-    secrets
-        .command("archive")
-        .description("Archive a secret")
-        .argument("<integration-id>", "Integration ID")
-        .argument("<secret-id>", "Secret ID")
-        .option("--app <app-id>", "App ID (uses current app if not specified)")
-        .action(async (integrationId, secretId, options) => {
-        const resolvedAppId = resolveAppId(undefined, options);
-        const client = new ApiClient();
-        try {
-            await client.archiveIntegrationSecret(resolvedAppId, integrationId, secretId);
-            success("Secret archived.");
-        }
-        catch (err) {
-            error(err.message);
-            process.exit(1);
-        }
-    });
     // ============================================
     // TESTS SUBCOMMAND
     // ============================================
     const tests = integrations
         .command("tests")
-        .description("Manage and run integration test cases")
+        .description("Run and inspect integration test cases")
         .addHelpText("after", `
+Test cases are authored in TOML at integrations/<key>.tests/<name>.toml and
+applied with \`primitive config push\` (issue #2769); \`config fields integration\`
+lists the fields. Deleting a case is removing its file and running
+\`config push --prune\`.
+
+Every verb here takes the integration's KEY or its ID (#3000). An identifier
+that names no integration in the app fails; \`Total Tests: 0\` only ever means
+the integration exists and has no cases.
+
 Examples:
-  $ primitive integrations tests list <integration-id>
-  $ primitive integrations tests create <integration-id> --name "Basic test" --input '{"method":"GET","path":"/get"}'
-  $ primitive integrations tests run <integration-id> <test-case-id>
-  $ primitive integrations tests run-all <integration-id>
-  $ primitive integrations tests run-all <integration-id> --test-cases 01ABC,01DEF,01GHI
+  $ primitive integrations tests list <integration>
+  $ primitive integrations tests run <integration> <test-case-id>
+  $ primitive integrations tests run-all <integration>
+  $ primitive integrations tests run-all <integration> --test-cases 01ABC,01DEF,01GHI
 `);
     // List test cases
     tests
         .command("list")
         .description("List test cases for an integration")
-        .argument("<integration-id>", "Integration ID")
+        .argument("<integration>", "Integration key or ID")
         .option("--app <app-id>", "App ID (uses current app if not specified)")
         .option("--json", "Output as JSON")
-        .action(async (integrationId, options) => {
+        .action(async (integration, options) => {
         const resolvedAppId = resolveAppId(undefined, options);
         const client = new ApiClient();
         try {
+            // #3000 — resolve BEFORE listing: the test-case endpoint answers an
+            // unknown block with an empty page, so an unresolved identifier would
+            // print "No test cases found." and exit 0.
+            const { integrationId } = await resolveIntegrationSelector(client, resolvedAppId, integration);
             const { items } = await client.listTestCases(resolvedAppId, "integration", integrationId);
             if (options.json) {
                 json(items);
@@ -482,91 +402,19 @@ Examples:
             process.exit(1);
         }
     });
-    // Create test case
-    tests
-        .command("create")
-        .description("Create a test case for an integration")
-        .argument("<integration-id>", "Integration ID")
-        .option("--app <app-id>", "App ID (uses current app if not specified)")
-        .option("--name <name>", "Test case name (required)")
-        .option("--input <json>", "Input variables as JSON (required)")
-        .option("--pattern <regex>", "Expected output pattern (regex)")
-        .option("--contains <json>", "Expected strings to contain (JSON array)")
-        .option("--json-subset <json>", "Expected JSON subset to match")
-        .option("--config <config-id>", "Config ID to use for this test")
-        .option("--evaluator-prompt <prompt-id>", "Evaluator prompt ID")
-        .option("--evaluator-config <config-id>", "Evaluator config ID")
-        .option("--json", "Output as JSON")
-        .action(async (integrationId, options) => {
-        const resolvedAppId = resolveAppId(undefined, options);
-        if (!options.name || !options.input) {
-            error("Required: --name and --input");
-            process.exit(1);
-        }
-        let inputVariables;
-        try {
-            inputVariables = JSON.parse(options.input);
-        }
-        catch {
-            error("Invalid JSON in --input");
-            process.exit(1);
-        }
-        let expectedOutputContains;
-        if (options.contains) {
-            try {
-                expectedOutputContains = JSON.parse(options.contains);
-            }
-            catch {
-                error("Invalid JSON in --contains");
-                process.exit(1);
-            }
-        }
-        let expectedJsonSubset;
-        if (options.jsonSubset) {
-            try {
-                expectedJsonSubset = JSON.parse(options.jsonSubset);
-            }
-            catch {
-                error("Invalid JSON in --json-subset");
-                process.exit(1);
-            }
-        }
-        const client = new ApiClient();
-        try {
-            const result = await client.createTestCase(resolvedAppId, "integration", integrationId, {
-                name: options.name,
-                inputVariables,
-                expectedOutputPattern: options.pattern,
-                expectedOutputContains,
-                expectedJsonSubset,
-                configId: options.config,
-                evaluatorPromptId: options.evaluatorPrompt,
-                evaluatorConfigId: options.evaluatorConfig,
-            });
-            if (options.json) {
-                json(result);
-                return;
-            }
-            success(`Test case created: ${result.name}`);
-            keyValue("Test Case ID", result.testCaseId);
-        }
-        catch (err) {
-            error(err.message);
-            process.exit(1);
-        }
-    });
     // Get test case
     tests
         .command("get")
         .description("Get test case details")
-        .argument("<integration-id>", "Integration ID")
+        .argument("<integration>", "Integration key or ID")
         .argument("<test-case-id>", "Test Case ID")
         .option("--app <app-id>", "App ID (uses current app if not specified)")
         .option("--json", "Output as JSON")
-        .action(async (integrationId, testCaseId, options) => {
+        .action(async (integration, testCaseId, options) => {
         const resolvedAppId = resolveAppId(undefined, options);
         const client = new ApiClient();
         try {
+            const { integrationId } = await resolveIntegrationSelector(client, resolvedAppId, integration);
             const result = await client.getTestCase(resolvedAppId, "integration", integrationId, testCaseId);
             if (options.json) {
                 json(result);
@@ -578,13 +426,7 @@ Examples:
             printResult("Created", formatDate(result.createdAt));
             divider();
             info("Input Variables:");
-            try {
-                const vars = JSON.parse(result.inputVariables || "{}");
-                console.log(JSON.stringify(vars, null, 2));
-            }
-            catch {
-                console.log(result.inputVariables || "{}");
-            }
+            console.log(JSON.stringify(testCaseInputVariables(result.inputVariables), null, 2));
             if (result.expectedOutputPattern) {
                 divider();
                 printResult("Expected Pattern", result.expectedOutputPattern);
@@ -620,143 +462,27 @@ Examples:
             process.exit(1);
         }
     });
-    // Update test case
-    tests
-        .command("update")
-        .description("Update a test case")
-        .argument("<integration-id>", "Integration ID")
-        .argument("<test-case-id>", "Test Case ID")
-        .option("--app <app-id>", "App ID (uses current app if not specified)")
-        .option("--name <name>", "Test case name")
-        .option("--input <json>", "Input variables as JSON")
-        .option("--pattern <regex>", "Expected output pattern (regex)")
-        .option("--contains <json>", "Expected strings to contain (JSON array)")
-        .option("--json-subset <json>", "Expected JSON subset to match")
-        .option("--config <config-id>", "Config ID to use for this test")
-        .option("--clear-pattern", "Clear expected pattern")
-        .option("--clear-contains", "Clear expected contains")
-        .option("--clear-json-subset", "Clear expected JSON subset")
-        .option("--json", "Output as JSON")
-        .action(async (integrationId, testCaseId, options) => {
-        const resolvedAppId = resolveAppId(undefined, options);
-        const payload = {};
-        if (options.name)
-            payload.name = options.name;
-        if (options.input) {
-            try {
-                payload.inputVariables = JSON.parse(options.input);
-            }
-            catch {
-                error("Invalid JSON in --input");
-                process.exit(1);
-            }
-        }
-        if (options.clearPattern) {
-            payload.expectedOutputPattern = null;
-        }
-        else if (options.pattern) {
-            payload.expectedOutputPattern = options.pattern;
-        }
-        if (options.clearContains) {
-            payload.expectedOutputContains = null;
-        }
-        else if (options.contains) {
-            try {
-                payload.expectedOutputContains = JSON.parse(options.contains);
-            }
-            catch {
-                error("Invalid JSON in --contains");
-                process.exit(1);
-            }
-        }
-        if (options.clearJsonSubset) {
-            payload.expectedJsonSubset = null;
-        }
-        else if (options.jsonSubset) {
-            try {
-                payload.expectedJsonSubset = JSON.parse(options.jsonSubset);
-            }
-            catch {
-                error("Invalid JSON in --json-subset");
-                process.exit(1);
-            }
-        }
-        if (options.config)
-            payload.configId = options.config;
-        if (Object.keys(payload).length === 0) {
-            error("No update options specified.");
-            process.exit(1);
-        }
-        const client = new ApiClient();
-        try {
-            const result = await client.updateTestCase(resolvedAppId, "integration", integrationId, testCaseId, payload);
-            if (options.json) {
-                json(result);
-                return;
-            }
-            success("Test case updated.");
-        }
-        catch (err) {
-            error(err.message);
-            process.exit(1);
-        }
-    });
-    // Delete test case
-    tests
-        .command("delete")
-        .description("Delete a test case")
-        .argument("<integration-id>", "Integration ID")
-        .argument("<test-case-id>", "Test Case ID")
-        .option("--app <app-id>", "App ID (uses current app if not specified)")
-        .option("-y, --yes", "Skip confirmation prompt")
-        .action(async (integrationId, testCaseId, options) => {
-        const resolvedAppId = resolveAppId(undefined, options);
-        if (!options.yes) {
-            let confirm;
-            try {
-                confirm = await confirmPrompt(`Are you sure you want to delete test case ${testCaseId}?`);
-            }
-            catch (err) {
-                error(err.message);
-                process.exit(1);
-            }
-            if (!confirm) {
-                info("Cancelled.");
-                return;
-            }
-        }
-        const client = new ApiClient();
-        try {
-            await client.deleteTestCase(resolvedAppId, "integration", integrationId, testCaseId);
-            success("Test case deleted.");
-        }
-        catch (err) {
-            error(err.message);
-            process.exit(1);
-        }
-    });
     // Run a single test case
     tests
         .command("run")
         .description("Run a single test case")
-        .argument("<integration-id>", "Integration ID")
+        .argument("<integration>", "Integration key or ID")
         .argument("<test-case-id>", "Test Case ID")
         .option("--app <app-id>", "App ID (uses current app if not specified)")
         .option("--config <config-id>", "Override config ID")
         .option("--json", "Output as JSON")
-        .action(async (integrationId, testCaseId, options) => {
+        .action(async (integration, testCaseId, options) => {
         const resolvedAppId = resolveAppId(undefined, options);
         const client = new ApiClient();
         try {
+            const { integrationId } = await resolveIntegrationSelector(client, resolvedAppId, integration);
             // Get test case to retrieve its variables
             const testCase = await client.getTestCase(resolvedAppId, "integration", integrationId, testCaseId);
-            let variables = {};
-            try {
-                variables = JSON.parse(testCase.inputVariables || "{}");
-            }
-            catch {
-                // Use empty object if parsing fails
-            }
+            // #2968 — the case's variables ARE the request the run issues, so a
+            // dropped `inputVariables` here is the config's bare defaults instead
+            // of the case's method, path and body. The server hands them back
+            // parsed; older servers hand back JSON text.
+            const variables = testCaseInputVariables(testCase.inputVariables);
             const result = await client.executeBlockTest(resolvedAppId, "integration", integrationId, {
                 variables,
                 testCaseId,
@@ -813,15 +539,19 @@ Examples:
     tests
         .command("run-all")
         .description("Run all test cases for an integration, or a specific subset")
-        .argument("<integration-id>", "Integration ID")
+        .argument("<integration>", "Integration key or ID")
         .option("--app <app-id>", "App ID (uses current app if not specified)")
         .option("--config <config-id>", "Override config ID for all tests")
         .option("--test-cases <ids>", "Comma-separated list of test case IDs to run (runs only these)")
         .option("--json", "Output as JSON")
-        .action(async (integrationId, options) => {
+        .action(async (integration, options) => {
         const resolvedAppId = resolveAppId(undefined, options);
         const client = new ApiClient();
         try {
+            // #3000 — resolve BEFORE announcing the run: an unresolved identifier
+            // came back as `Total Tests: 0 / Failed: 0` and exit 0, which reads as
+            // a pass in CI.
+            const { integrationId } = await resolveIntegrationSelector(client, resolvedAppId, integration);
             // Parse test case IDs if provided
             let testCaseIds;
             if (options.testCases) {
@@ -879,15 +609,16 @@ Examples:
     tests
         .command("runs")
         .description("List recent test runs for an integration")
-        .argument("<integration-id>", "Integration ID")
+        .argument("<integration>", "Integration key or ID")
         .option("--app <app-id>", "App ID (uses current app if not specified)")
         .option("--limit <n>", "Maximum number of runs to show", "20")
         .option("--group <group>", "Filter by comparison group")
         .option("--json", "Output as JSON")
-        .action(async (integrationId, options) => {
+        .action(async (integration, options) => {
         const resolvedAppId = resolveAppId(undefined, options);
         const client = new ApiClient();
         try {
+            const { integrationId } = await resolveIntegrationSelector(client, resolvedAppId, integration);
             const { items } = await client.listTestRuns(resolvedAppId, "integration", integrationId, {
                 limit: parseInt(options.limit),
                 comparisonGroup: options.group,