primitive-admin 1.1.0-alpha.9 → 1.1.0

package/dist/src/commands/integrations.js

@@ -1,18 +1,38 @@
-import { readFileSync } from "fs";
-import * as TOML from "@iarna/toml";
+import chalk from "chalk";
 import { ApiClient } from "../lib/api-client.js";
 import { resolveAppId } from "../lib/config.js";
-import { success, error, info, keyValue, formatTable, formatId, formatDate, formatStatus, formatDuration, json, divider, } from "../lib/output.js";
+import { success, error, info, keyValue, result as printResult, formatTable, formatId, formatDate, formatStatus, formatDuration, json, divider, } from "../lib/output.js";
+import { buildIntegrationEnvelope } from "../lib/log-inspection.js";
+import { confirmPrompt } from "../lib/confirm-prompt.js";
+import { parseStatusFilter } from "../lib/object-status-filter.js";
+import { requireTestCaseInputVariables, testCaseInputVariables, } from "../lib/test-case-variables.js";
+import { resolveIntegrationSelector } from "../lib/integration-selector.js";
+import { normalizeCliListEnvelope } from "../lib/paginate.js";
+import { pageCursorOption, pageLimitOption, parsePageLimit, printEmptyPage, printPageHint, } from "../lib/list-options.js";
 export function registerIntegrationsCommands(program) {
     const integrations = program
         .command("integrations")
-        .description("Configure external HTTP API connections and manage secrets")
+        .description("Configure external HTTP API connections")
         .addHelpText("after", `
 Examples:
   $ primitive integrations list
-  $ primitive integrations create --from-file weather-api.toml
+  $ primitive config create integration weather-api       # scaffold integrations/weather-api.toml
+  $ primitive config push --only integration/weather-api  # apply it
   $ primitive integrations test 01HXY...
-  $ primitive integrations secrets add 01HXY... --data '{"apiKey":"..."}'
+  $ primitive integrations archive 01HXY...             # retire it (soft delete)
+
+Storing credentials for an integration:
+  $ primitive secrets set MY_API_KEY --value <value>
+  # then reference it in integration config via {{secrets.MY_API_KEY}}
+`);
+    // Server-side configuration is authored in TOML and applied with `config push`
+    // (issue #2645) — this group no longer carries config-setting flags.
+    integrations.addHelpText("after", `
+Configuration lives in integrations/<key>.toml:
+  $ primitive config fields integration        # the file's keys, types and defaults
+  $ primitive config create integration <key>  # scaffold one locally
+  $ primitive config set integration/<key> <path>=<value>
+  $ primitive config push --only integration/<key>
 `);
     // List integrations
     integrations
@@ -20,21 +40,33 @@ Examples:
         .description("List integrations")
         .argument("[app-id]", "App ID (uses current app if not specified)")
         .option("--app <app-id>", "App ID")
-        .option("--status <status>", "Filter by status: draft, active, archived")
+        .option("--status <status>", "Filter by status: active, inactive, archived")
+        .addOption(pageLimitOption())
+        .addOption(pageCursorOption())
         .option("--json", "Output as JSON")
         .action(async (appId, options) => {
+        const limit = parsePageLimit(options.limit);
         const resolvedAppId = resolveAppId(appId, options);
         const client = new ApiClient();
         try {
-            const { items } = await client.listIntegrations(resolvedAppId, {
-                status: options.status,
-            });
+            // #2803 — `draft` is gone; refuse it by name rather than returning the
+            // empty list a canonical filter would produce.
+            const page = normalizeCliListEnvelope(await client.listIntegrations(resolvedAppId, {
+                status: parseStatusFilter("integrations", options.status, [
+                    "active",
+                    "inactive",
+                    "archived",
+                ]),
+                limit,
+                cursor: options.cursor,
+            }));
+            const items = page.items;
             if (options.json) {
-                json(items);
+                json(page);
                 return;
             }
-            if (!items || items.length === 0) {
-                info("No integrations found.");
+            if (items.length === 0) {
+                printEmptyPage(page, "integrations");
                 return;
             }
             console.log(formatTable(items, [
@@ -44,201 +76,168 @@ Examples:
                 { header: "STATUS", key: "status", format: formatStatus },
                 { header: "MODIFIED", key: "modifiedAt", format: formatDate },
             ]));
+            printPageHint(page);
         }
         catch (err) {
             error(err.message);
             process.exit(1);
         }
     });
-    // Create integration
+    // #2645 criterion 9 / #2803 — the operational verbs. They are the only
+    // writers of `status`, which is server-owned and no longer a TOML key.
     integrations
-        .command("create")
-        .description("Create a new integration")
-        .argument("[app-id]", "App ID (uses current app if not specified)")
-        .option("--app <app-id>", "App ID")
-        .option("--key <key>", "Integration key (unique identifier)")
-        .option("--name <name>", "Display name")
-        .option("--description <desc>", "Description")
-        .option("--base-url <url>", "Base URL for API requests")
-        .option("--allowed-methods <methods>", "Comma-separated list of allowed HTTP methods")
-        .option("--allowed-paths <paths>", "Comma-separated list of allowed paths")
-        .option("--timeout-ms <ms>", "Request timeout in milliseconds")
-        .option("--from-file <path>", "Load integration from TOML file")
+        .command("disable")
+        .description("Take integration out of service now. Operational, not configuration: `status` is server-owned and 'config push' can neither set nor clear it.")
+        .argument("<integration-id>", "Integration ID")
+        .option("--app <app-id>", "App ID (uses current app if not specified)")
         .option("--json", "Output as JSON")
-        .action(async (appId, options) => {
-        const resolvedAppId = resolveAppId(appId, options);
+        .action(async (id, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
         const client = new ApiClient();
-        let payload;
-        if (options.fromFile) {
-            try {
-                const content = readFileSync(options.fromFile, "utf-8");
-                const tomlData = TOML.parse(content);
-                payload = {
-                    integrationKey: tomlData.integration?.key || tomlData.key,
-                    displayName: tomlData.integration?.displayName || tomlData.displayName,
-                    description: tomlData.integration?.description || tomlData.description,
-                    requestConfig: tomlData.requestConfig || {},
-                    timeoutMs: tomlData.integration?.timeoutMs || tomlData.timeoutMs,
-                };
-            }
-            catch (err) {
-                error(`Failed to read TOML file: ${err.message}`);
-                process.exit(1);
-            }
-        }
-        else {
-            if (!options.key || !options.name || !options.baseUrl) {
-                error("Required: --key, --name, --base-url (or use --from-file)");
-                process.exit(1);
-            }
-            payload = {
-                integrationKey: options.key,
-                displayName: options.name,
-                description: options.description,
-                requestConfig: {
-                    baseUrl: options.baseUrl,
-                    allowedMethods: options.allowedMethods?.split(",").map((s) => s.trim()),
-                    allowedPaths: options.allowedPaths?.split(",").map((s) => s.trim()),
-                },
-                timeoutMs: options.timeoutMs ? parseInt(options.timeoutMs) : undefined,
-            };
-        }
         try {
-            const result = await client.createIntegration(resolvedAppId, payload);
+            const result = await client.setIntegrationAvailability(resolvedAppId, id, "disable");
             if (options.json) {
                 json(result);
                 return;
             }
-            success(`Integration created: ${result.displayName}`);
-            keyValue("Integration ID", result.integrationId);
-            keyValue("Key", result.integrationKey);
+            success(`Integration disabled: ${result.integrationKey || id}`);
         }
         catch (err) {
             error(err.message);
             process.exit(1);
         }
     });
-    // Get integration
     integrations
-        .command("get")
-        .description("Get integration details")
+        .command("enable")
+        .description("Put integration back in service.")
         .argument("<integration-id>", "Integration ID")
         .option("--app <app-id>", "App ID (uses current app if not specified)")
         .option("--json", "Output as JSON")
-        .action(async (integrationId, options) => {
+        .action(async (id, options) => {
         const resolvedAppId = resolveAppId(undefined, options);
         const client = new ApiClient();
         try {
-            const result = await client.getIntegration(resolvedAppId, integrationId);
+            const result = await client.setIntegrationAvailability(resolvedAppId, id, "enable");
             if (options.json) {
                 json(result);
                 return;
             }
-            keyValue("Integration ID", result.integrationId);
-            keyValue("Key", result.integrationKey);
-            keyValue("Name", result.displayName);
-            keyValue("Description", result.description);
-            keyValue("Status", formatStatus(result.status));
-            keyValue("Timeout", result.timeoutMs ? `${result.timeoutMs}ms` : "-");
-            if (result.requestConfig) {
-                divider();
-                info("Request Config:");
-                keyValue("  Base URL", result.requestConfig.baseUrl);
-                keyValue("  Allowed Methods", result.requestConfig.allowedMethods?.join(", ") || "all");
-                keyValue("  Allowed Paths", result.requestConfig.allowedPaths?.join(", ") || "all");
-                keyValue("  Response Passthrough", result.requestConfig.responsePassthrough);
-                if (result.requestConfig.bodyMode) {
-                    keyValue("  Body Mode", result.requestConfig.bodyMode);
-                }
-                if (result.requestConfig.multipartFieldMapping?.length) {
-                    keyValue("  Multipart Fields", result.requestConfig.multipartFieldMapping
-                        .map((f) => `${f.fieldName} (${f.type}${f.attachmentIndex != null ? `, attachment[${f.attachmentIndex}]` : ""})`)
-                        .join(", "));
-                }
-            }
+            success(`Integration enabled: ${result.integrationKey || id}`);
         }
         catch (err) {
             error(err.message);
             process.exit(1);
         }
     });
-    // Update integration
+    // #2907 — the delete flow's CLI spelling. Not a second writer of `status`:
+    // this is the plain `DELETE` the server has always answered by writing the
+    // tombstone, which until now only the admin API and the console could reach.
+    // Named `archive`, not `delete`, because a configuration noun gets no
+    // `delete` verb (docs/cli-design.md) and prune-by-push stays the only CLI
+    // hard-delete path.
     integrations
-        .command("update")
-        .description("Update an integration")
+        .command("archive")
+        .description("Retire an integration (soft delete). Delete-lifecycle, not `disable`: the row is kept, goes on holding its key, and there is no un-archive.")
         .argument("<integration-id>", "Integration ID")
         .option("--app <app-id>", "App ID (uses current app if not specified)")
-        .option("--name <name>", "Display name")
-        .option("--description <desc>", "Description")
-        .option("--status <status>", "Status: draft, active, archived")
-        .option("--timeout-ms <ms>", "Request timeout in milliseconds")
+        .option("-y, --yes", "Skip confirmation prompt")
         .option("--json", "Output as JSON")
-        .action(async (integrationId, options) => {
+        .addHelpText("after", `
+What archiving an integration costs:
+  The proxy refuses it, and so does every workflow step that calls it.
+  The archived row still holds its integrationKey, so a push cannot re-create
+  one under the same key.
+  \`primitive integrations enable\` refuses an archived integration; there is no
+  un-archive.
+
+Reclaiming the key means hard-deleting the row:
+  $ rm integrations/<key>.toml
+  $ primitive config push --prune     # confirmed; hard-deletes the row
+  # or hard-delete it in the console, then re-add the file and push.
+`)
+        .action(async (id, options) => {
         const resolvedAppId = resolveAppId(undefined, options);
-        const payload = {};
-        if (options.name)
-            payload.displayName = options.name;
-        if (options.description)
-            payload.description = options.description;
-        if (options.status)
-            payload.status = options.status;
-        if (options.timeoutMs)
-            payload.timeoutMs = parseInt(options.timeoutMs);
-        if (Object.keys(payload).length === 0) {
-            error("No update options specified.");
-            process.exit(1);
+        if (!options.yes) {
+            let confirmed;
+            try {
+                confirmed = await confirmPrompt(`Archive integration ${id}? It is retired, goes on holding its key, ` +
+                    `and there is no un-archive.`);
+            }
+            catch (err) {
+                error(err.message);
+                process.exit(1);
+            }
+            if (!confirmed) {
+                info("Cancelled.");
+                return;
+            }
         }
         const client = new ApiClient();
         try {
-            const result = await client.updateIntegration(resolvedAppId, integrationId, payload);
+            // The soft delete: no `hard`, so the server writes the tombstone and
+            // keeps the row (and its canonical block mirror) in step.
+            const result = await client.deleteIntegration(resolvedAppId, id);
             if (options.json) {
                 json(result);
                 return;
             }
-            success("Integration updated.");
+            success(`Integration archived: ${id}`);
+            info("It is retired and still holds its key — reclaim the key by removing its file and running a confirmed `primitive config push --prune`.");
         }
         catch (err) {
             error(err.message);
             process.exit(1);
         }
     });
-    // Delete integration
     integrations
-        .command("delete")
-        .description("Delete or archive an integration")
+        .command("get")
+        .description("Get integration details")
         .argument("<integration-id>", "Integration ID")
         .option("--app <app-id>", "App ID (uses current app if not specified)")
-        .option("--hard", "Permanently delete instead of archive")
-        .option("-y, --yes", "Skip confirmation prompt")
+        .option("--json", "Output as JSON")
         .action(async (integrationId, options) => {
         const resolvedAppId = resolveAppId(undefined, options);
-        if (!options.yes) {
-            const action = options.hard ? "permanently delete" : "archive";
-            const inquirer = await import("inquirer");
-            const { confirm } = await inquirer.default.prompt([
-                {
-                    type: "confirm",
-                    name: "confirm",
-                    message: `Are you sure you want to ${action} integration ${integrationId}?`,
-                    default: false,
-                },
-            ]);
-            if (!confirm) {
-                info("Cancelled.");
-                return;
-            }
-        }
         const client = new ApiClient();
         try {
-            await client.deleteIntegration(resolvedAppId, integrationId, options.hard);
-            success(`Integration ${options.hard ? "deleted" : "archived"}.`);
+            const result = await client.getIntegration(resolvedAppId, integrationId);
+            if (options.json) {
+                json(result);
+                return;
+            }
+            printResult("Integration ID", result.integrationId);
+            printResult("Key", result.integrationKey);
+            printResult("Name", result.displayName);
+            printResult("Description", result.description);
+            printResult("Status", formatStatus(result.status));
+            printResult("Timeout", result.timeoutMs ? `${result.timeoutMs}ms` : "-");
+            // #2631: no rule means every non-admin call is denied. Print that in
+            // words — a blank or "-" would read as "unrestricted" and hide an
+            // integration that was never given a rule.
+            printResult("Access Rule", typeof result.accessRule === "string" && result.accessRule !== ""
+                ? result.accessRule
+                : "(none — all non-admin calls are denied; set one to allow callers)");
+            if (result.requestConfig) {
+                divider();
+                info("Request Config:");
+                printResult("  Base URL", result.requestConfig.baseUrl);
+                printResult("  Allowed Methods", result.requestConfig.allowedMethods?.join(", ") || "all");
+                printResult("  Allowed Paths", result.requestConfig.allowedPaths?.join(", ") || "all");
+                printResult("  Response Passthrough", result.requestConfig.responsePassthrough);
+                if (result.requestConfig.bodyMode) {
+                    printResult("  Body Mode", result.requestConfig.bodyMode);
+                }
+                if (result.requestConfig.multipartFieldMapping?.length) {
+                    printResult("  Multipart Fields", result.requestConfig.multipartFieldMapping
+                        .map((f) => `${f.fieldName} (${f.type}${f.attachmentIndex != null ? `, attachment[${f.attachmentIndex}]` : ""})`)
+                        .join(", "));
+                }
+            }
         }
         catch (err) {
             error(err.message);
             process.exit(1);
         }
     });
-    // Test integration
     integrations
         .command("test")
         .description("Test an integration by making a request")
@@ -304,20 +303,37 @@ Examples:
     // List integration logs
     integrations
         .command("logs")
-        .description("View integration request logs")
+        .description("View integration request logs (includes workflow-initiated calls; filter with --source workflow|user|admin|test)")
         .argument("<integration-id>", "Integration ID")
         .option("--app <app-id>", "App ID (uses current app if not specified)")
         .option("--limit <n>", "Number of logs to show", "20")
+        .option("--source <source>", "Filter by call source: user, admin, test, or workflow")
+        .option("--run <run-id>", "Only the calls this run made (a workflow run or a function run)")
+        .option("--status <status>", "Filter by upstream HTTP status (e.g. 200, 500)")
+        .option("--from <iso>", "Only logs at or after this ISO timestamp")
+        .option("--to <iso>", "Only logs at or before this ISO timestamp")
         .option("--json", "Output as JSON")
         .action(async (integrationId, options) => {
         const resolvedAppId = resolveAppId(undefined, options);
         const client = new ApiClient();
         try {
+            const validSources = new Set(["user", "admin", "test", "workflow"]);
+            if (options.source && !validSources.has(options.source)) {
+                error(`Invalid --source value '${options.source}'. Must be one of: user, admin, test, workflow.`);
+                process.exit(1);
+            }
             const logs = await client.listIntegrationLogs(resolvedAppId, integrationId, {
                 limit: parseInt(options.limit),
+                ...(options.source && { source: options.source }),
+                // #3691 — the run pivot. A function run's id and a workflow run's
+                // are read the same way, because a row names its run either way.
+                ...(options.run && { runId: options.run }),
+                ...(options.status && { status: options.status }),
+                ...(options.from && { from: options.from }),
+                ...(options.to && { to: options.to }),
             });
             if (options.json) {
-                json(logs);
+                json(buildIntegrationEnvelope(logs));
                 return;
             }
             if (!logs || logs.length === 0) {
@@ -326,10 +342,13 @@ Examples:
             }
             console.log(formatTable(logs, [
                 { header: "TIME", key: "timestamp", format: formatDate },
+                { header: "SOURCE", key: "source", format: (v) => v || "user" },
                 { header: "METHOD", key: "method" },
                 { header: "PATH", key: "path" },
                 { header: "STATUS", key: "status" },
                 { header: "DURATION", key: "durationMs", format: formatDuration },
+                { header: "WORKFLOW", key: "workflowKey", format: (v) => v || "" },
+                { header: "RUN", key: "runId", format: (v) => (v ? formatId(v) : "") },
                 { header: "TRACE", key: "traceId", format: formatId },
             ]));
         }
@@ -338,96 +357,318 @@ Examples:
             process.exit(1);
         }
     });
-    // Secrets subcommand
-    const secrets = integrations.command("secrets").description("Manage integration secrets");
-    // List secrets
-    secrets
+    // ============================================
+    // TESTS SUBCOMMAND
+    // ============================================
+    const tests = integrations
+        .command("tests")
+        .description("Run and inspect integration test cases")
+        .addHelpText("after", `
+Test cases are authored in TOML at integrations/<key>.tests/<name>.toml and
+applied with \`primitive config push\` (issue #2769); \`config fields integration\`
+lists the fields. Deleting a case is removing its file and running
+\`config push --prune\`.
+
+Every verb here takes the integration's KEY or its ID (#3000). An identifier
+that names no integration in the app fails; \`Total Tests: 0\` only ever means
+the integration exists and has no cases.
+
+Examples:
+  $ primitive integrations tests list <integration>
+  $ primitive integrations tests run <integration> <test-case-id>
+  $ primitive integrations tests run-all <integration>
+  $ primitive integrations tests run-all <integration> --test-cases 01ABC,01DEF,01GHI
+`);
+    // List test cases
+    tests
         .command("list")
-        .description("List secrets for an integration")
-        .argument("<integration-id>", "Integration ID")
+        .description("List test cases for an integration")
+        .argument("<integration>", "Integration key or ID")
         .option("--app <app-id>", "App ID (uses current app if not specified)")
+        .addOption(pageLimitOption())
+        .addOption(pageCursorOption())
         .option("--json", "Output as JSON")
-        .action(async (integrationId, options) => {
+        .action(async (integration, options) => {
+        const limit = parsePageLimit(options.limit);
         const resolvedAppId = resolveAppId(undefined, options);
         const client = new ApiClient();
         try {
-            const secretsList = await client.listIntegrationSecrets(resolvedAppId, integrationId);
+            // #3000 — resolve BEFORE listing: the test-case endpoint answers an
+            // unknown block with an empty page, so an unresolved identifier would
+            // print "No test cases found." and exit 0.
+            const { integrationId } = await resolveIntegrationSelector(client, resolvedAppId, integration);
+            const page = normalizeCliListEnvelope(await client.listTestCases(resolvedAppId, "integration", integrationId, {
+                limit,
+                cursor: options.cursor,
+            }));
+            const items = page.items;
             if (options.json) {
-                json(secretsList);
+                json(page);
                 return;
             }
-            if (!secretsList || secretsList.length === 0) {
-                info("No secrets found.");
+            if (items.length === 0) {
+                printEmptyPage(page, "test cases");
                 return;
             }
-            console.log(formatTable(secretsList, [
-                { header: "ID", key: "secretId", format: formatId },
-                { header: "VERSION", key: "version" },
-                { header: "SUMMARY", key: "secretSummary" },
-                { header: "STATUS", key: "status", format: formatStatus },
+            console.log(formatTable(items, [
+                { header: "ID", key: "testCaseId", format: formatId },
+                { header: "NAME", key: "name" },
+                { header: "CONFIG", key: "configId", format: (v) => v ? formatId(v) : "-" },
                 { header: "CREATED", key: "createdAt", format: formatDate },
             ]));
+            printPageHint(page);
         }
         catch (err) {
             error(err.message);
             process.exit(1);
         }
     });
-    // Add secret
-    secrets
-        .command("add")
-        .description("Add a secret to an integration")
-        .argument("<integration-id>", "Integration ID")
+    // Get test case
+    tests
+        .command("get")
+        .description("Get test case details")
+        .argument("<integration>", "Integration key or ID")
+        .argument("<test-case-id>", "Test Case ID")
         .option("--app <app-id>", "App ID (uses current app if not specified)")
-        .option("--data <json>", "Secret data as JSON (e.g., '{\"apiKey\":\"...\"}' )")
-        .option("--summary <text>", "Description of the secret")
         .option("--json", "Output as JSON")
-        .action(async (integrationId, options) => {
+        .action(async (integration, testCaseId, options) => {
         const resolvedAppId = resolveAppId(undefined, options);
-        if (!options.data) {
-            error("--data is required (JSON object with secret values)");
+        const client = new ApiClient();
+        try {
+            const { integrationId } = await resolveIntegrationSelector(client, resolvedAppId, integration);
+            const result = await client.getTestCase(resolvedAppId, "integration", integrationId, testCaseId);
+            if (options.json) {
+                json(result);
+                return;
+            }
+            printResult("Test Case ID", result.testCaseId);
+            printResult("Name", result.name);
+            printResult("Config ID", result.configId || "-");
+            printResult("Created", formatDate(result.createdAt));
+            divider();
+            info("Input Variables:");
+            console.log(JSON.stringify(testCaseInputVariables(result.inputVariables), null, 2));
+            if (result.expectedOutputPattern) {
+                divider();
+                printResult("Expected Pattern", result.expectedOutputPattern);
+            }
+            if (result.expectedOutputContains) {
+                divider();
+                info("Expected Contains:");
+                try {
+                    console.log(JSON.stringify(JSON.parse(result.expectedOutputContains), null, 2));
+                }
+                catch {
+                    console.log(result.expectedOutputContains);
+                }
+            }
+            if (result.expectedJsonSubset) {
+                divider();
+                info("Expected JSON Subset:");
+                try {
+                    console.log(JSON.stringify(JSON.parse(result.expectedJsonSubset), null, 2));
+                }
+                catch {
+                    console.log(result.expectedJsonSubset);
+                }
+            }
+            if (result.evaluatorPromptId) {
+                divider();
+                printResult("Evaluator Prompt", result.evaluatorPromptId);
+                printResult("Evaluator Config", result.evaluatorConfigId || "-");
+            }
+        }
+        catch (err) {
+            error(err.message);
             process.exit(1);
         }
-        let secretData;
+    });
+    // Run a single test case
+    tests
+        .command("run")
+        .description("Run a single test case")
+        .argument("<integration>", "Integration key or ID")
+        .argument("<test-case-id>", "Test Case ID")
+        .option("--app <app-id>", "App ID (uses current app if not specified)")
+        .option("--config <config-id>", "Override config ID")
+        .option("--json", "Output as JSON")
+        .action(async (integration, testCaseId, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
         try {
-            secretData = JSON.parse(options.data);
+            const { integrationId } = await resolveIntegrationSelector(client, resolvedAppId, integration);
+            // Get test case to retrieve its variables
+            const testCase = await client.getTestCase(resolvedAppId, "integration", integrationId, testCaseId);
+            // #2968 — the case's variables ARE the request the run issues, so a
+            // dropped `inputVariables` here is the config's bare defaults instead
+            // of the case's method, path and body. The server hands them back
+            // parsed; older servers hand back JSON text. #3158 — an input that
+            // cannot be read stops the run and says why, rather than issuing a
+            // request the case never authored.
+            const variables = requireTestCaseInputVariables(testCase.inputVariables, testCaseId);
+            const result = await client.executeBlockTest(resolvedAppId, "integration", integrationId, {
+                variables,
+                testCaseId,
+                configId: options.config || testCase.configId,
+            });
+            if (options.json) {
+                json(result);
+                return;
+            }
+            const passed = result.verification?.passed;
+            if (passed) {
+                success("Test PASSED");
+            }
+            else {
+                error("Test FAILED");
+            }
+            keyValue("Duration", formatDuration(result.metrics?.durationMs));
+            if (result.verification) {
+                divider();
+                info("Verification:");
+                const v = result.verification;
+                keyValue("  Passed", v.passed ? chalk.green("Yes") : chalk.red("No"));
+                keyValue("  Checks", `${v.summary?.passed || 0}/${v.summary?.total || 0} passed`);
+                if (v.checks && v.checks.length > 0) {
+                    console.log();
+                    for (const check of v.checks) {
+                        const icon = check.passed ? chalk.green("\u2713") : chalk.red("\u2717");
+                        console.log(`  ${icon} ${check.name}`);
+                        if (!check.passed && check.message) {
+                            console.log(`    ${chalk.dim(check.message)}`);
+                        }
+                    }
+                }
+            }
+            if (result.output) {
+                divider();
+                info("Output:");
+                console.log(typeof result.output === "string" ? result.output : JSON.stringify(result.output, null, 2));
+            }
+            if (result.error) {
+                divider();
+                error(`Error: ${result.error}`);
+            }
+            if (!passed) {
+                process.exit(1);
+            }
         }
-        catch {
-            error("Invalid JSON in --data");
+        catch (err) {
+            error(err.message);
             process.exit(1);
         }
+    });
+    // Run all test cases (or a specific group)
+    tests
+        .command("run-all")
+        .description("Run all test cases for an integration, or a specific subset")
+        .argument("<integration>", "Integration key or ID")
+        .option("--app <app-id>", "App ID (uses current app if not specified)")
+        .option("--config <config-id>", "Override config ID for all tests")
+        .option("--test-cases <ids>", "Comma-separated list of test case IDs to run (runs only these)")
+        .option("--json", "Output as JSON")
+        .action(async (integration, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
         const client = new ApiClient();
         try {
-            const result = await client.addIntegrationSecret(resolvedAppId, integrationId, {
-                secretData,
-                secretSummary: options.summary,
+            // #3000 — resolve BEFORE announcing the run: an unresolved identifier
+            // came back as `Total Tests: 0 / Failed: 0` and exit 0, which reads as
+            // a pass in CI.
+            const { integrationId } = await resolveIntegrationSelector(client, resolvedAppId, integration);
+            // Parse test case IDs if provided
+            let testCaseIds;
+            if (options.testCases) {
+                testCaseIds = options.testCases.split(",").map((id) => id.trim()).filter(Boolean);
+                if (testCaseIds.length === 0) {
+                    error("No valid test case IDs provided in --test-cases");
+                    process.exit(1);
+                }
+            }
+            if (!options.json) {
+                if (testCaseIds) {
+                    info(`Running ${testCaseIds.length} selected test case(s)...`);
+                }
+                else {
+                    info("Running all test cases...");
+                }
+            }
+            const result = await client.runAllTestCases(resolvedAppId, "integration", integrationId, {
+                overrideConfigId: options.config,
+                testCaseIds,
             });
             if (options.json) {
                 json(result);
                 return;
             }
-            success("Secret added.");
-            keyValue("Secret ID", result?.secretId);
-            keyValue("Version", result?.version);
+            const { summary, runs, comparisonGroup } = result;
+            divider();
+            keyValue("Comparison Group", comparisonGroup);
+            keyValue("Total Tests", summary.total);
+            keyValue("Passed", chalk.green(summary.passed));
+            keyValue("Failed", summary.failed > 0 ? chalk.red(summary.failed) : "0");
+            divider();
+            if (runs && runs.length > 0) {
+                for (const r of runs) {
+                    const passed = r.verification?.passed;
+                    const icon = passed ? chalk.green("\u2713") : chalk.red("\u2717");
+                    const status = passed ? "PASSED" : "FAILED";
+                    console.log(`${icon} ${r.testCaseName} - ${status}`);
+                    if (!passed && r.verification?.details?.reason) {
+                        console.log(`  ${chalk.dim(r.verification.details.reason)}`);
+                    }
+                }
+            }
+            // Exit with error code if any tests failed
+            if (summary.failed > 0) {
+                process.exit(1);
+            }
         }
         catch (err) {
             error(err.message);
             process.exit(1);
         }
     });
-    // Archive secret
-    secrets
-        .command("archive")
-        .description("Archive a secret")
-        .argument("<integration-id>", "Integration ID")
-        .argument("<secret-id>", "Secret ID")
+    // List test runs
+    tests
+        .command("runs")
+        .description("List recent test runs for an integration")
+        .argument("<integration>", "Integration key or ID")
         .option("--app <app-id>", "App ID (uses current app if not specified)")
-        .action(async (integrationId, secretId, options) => {
+        .option("--limit <n>", "Maximum number of runs to show", "20")
+        .option("--group <group>", "Filter by comparison group")
+        .option("--json", "Output as JSON")
+        .action(async (integration, options) => {
         const resolvedAppId = resolveAppId(undefined, options);
         const client = new ApiClient();
         try {
-            await client.archiveIntegrationSecret(resolvedAppId, integrationId, secretId);
-            success("Secret archived.");
+            const { integrationId } = await resolveIntegrationSelector(client, resolvedAppId, integration);
+            const { items } = await client.listTestRuns(resolvedAppId, "integration", integrationId, {
+                limit: parseInt(options.limit),
+                comparisonGroup: options.group,
+            });
+            if (options.json) {
+                json(items);
+                return;
+            }
+            if (!items || items.length === 0) {
+                info("No test runs found.");
+                return;
+            }
+            console.log(formatTable(items, [
+                { header: "RUN ID", key: "runId", format: formatId },
+                { header: "TEST CASE ID", key: "testCaseId", format: (v) => v ? formatId(v) : "-" },
+                {
+                    header: "PASSED",
+                    key: "verificationPassed",
+                    format: (v) => v === true
+                        ? chalk.green("Yes")
+                        : v === false
+                            ? chalk.red("No")
+                            : "-",
+                },
+                { header: "DURATION", key: "durationMs", format: formatDuration },
+                { header: "STARTED", key: "startedAt", format: formatDate },
+            ]));
         }
         catch (err) {
             error(err.message);