struere 0.14.1 → 0.14.3

package/dist/bin/struere.js

@@ -680,7 +680,8 @@ async function _fireTrigger(options) {
         slug: options.slug,
         environment: options.environment,
         entityId: options.entityId,
-        data: options.data
+        data: options.data,
+        ...options.organizationId && { organizationId: options.organizationId }
       }
     }),
     signal: AbortSignal.timeout(60000)
@@ -3226,6 +3227,42 @@ function validateResources(payload, resources) {
 }
 
 // src/cli/commands/sync.ts
+class SyncValidationFailureError extends Error {
+  validationErrors;
+  constructor(validationErrors) {
+    super("Server-side validation failed for one or more resources");
+    this.name = "SyncValidationFailureError";
+    this.validationErrors = validationErrors;
+  }
+}
+function renderValidationErrors(errors) {
+  console.log();
+  console.log(chalk6.red.bold("Validation failed \u2014 no changes were applied."));
+  console.log();
+  const labels = {
+    agents: "agent",
+    entityTypes: "entity type",
+    roles: "role",
+    evalSuites: "eval suite",
+    triggers: "trigger",
+    fixtures: "fixture",
+    routers: "router",
+    tools: "tool"
+  };
+  const order = ["agents", "entityTypes", "roles", "evalSuites", "triggers", "fixtures", "routers", "tools"];
+  for (const key of order) {
+    const items = errors[key];
+    if (!items || items.length === 0)
+      continue;
+    const label = labels[key] || key;
+    console.log(chalk6.red.bold(`  ${key}:`), chalk6.red(`${items.length} invalid ${label}${items.length === 1 ? "" : "s"}`));
+    for (const item of items) {
+      const id = item.slug || item.name || "(unidentified)";
+      console.log(chalk6.red(`    - ${id}: ${item.error}`));
+    }
+  }
+  console.log();
+}
 async function performDevSync(cwd, organizationId) {
   generateTypeDeclarations(cwd);
   const resources = await loadAllResources(cwd);
@@ -3256,6 +3293,8 @@ ${resources.errors.join(`
     environment: "development"
   });
   if (!devResult.success) {
+    if (devResult.validationErrors)
+      throw new SyncValidationFailureError(devResult.validationErrors);
     throw new Error(devResult.error || "Dev sync failed");
   }
   const hasEvalContent = payload.evalSuites && payload.evalSuites.length > 0 || payload.fixtures && payload.fixtures.length > 0;
@@ -3271,6 +3310,8 @@ ${resources.errors.join(`
       environment: "eval"
     });
     if (!evalResult.success) {
+      if (evalResult.validationErrors)
+        throw new SyncValidationFailureError(evalResult.validationErrors);
       throw new Error(evalResult.error || "Eval sync failed");
     }
   }
@@ -3343,8 +3384,11 @@ ${resources.errors.join(`
       organizationId,
       environment: "eval"
     });
-    if (!result.success)
+    if (!result.success) {
+      if (result.validationErrors)
+        throw new SyncValidationFailureError(result.validationErrors);
       throw new Error(result.error || "Eval sync failed");
+    }
     return result;
   }
   if (environment === "production") {
@@ -3353,8 +3397,11 @@ ${resources.errors.join(`
       organizationId,
       environment: "production"
     });
-    if (!result.success)
+    if (!result.success) {
+      if (result.validationErrors)
+        throw new SyncValidationFailureError(result.validationErrors);
       throw new Error(result.error || "Production sync failed");
+    }
     return result;
   }
   return performDevSync(cwd, organizationId);
@@ -3560,6 +3607,15 @@ var syncCommand = new Command5("sync").description("Sync resources to Convex and
       }));
     }
   } catch (error) {
+    if (error instanceof SyncValidationFailureError) {
+      if (jsonMode) {
+        console.log(JSON.stringify({ success: false, validationErrors: error.validationErrors }));
+      } else {
+        output.fail("Sync failed");
+        renderValidationErrors(error.validationErrors);
+      }
+      process.exit(1);
+    }
     if (jsonMode) {
       console.log(JSON.stringify({ success: false, error: error instanceof Error ? error.message : String(error) }));
     } else {
@@ -3578,7 +3634,10 @@ var devCommand = new Command6("dev").description("Watch files and sync to develo
   const apiKey = getApiKey();
   const nonInteractive = !isInteractive();
   if (nonInteractive) {
-    console.error("Error: struere dev is a long-running watch process. Use struere sync instead.");
+    console.error(chalk7.red("Error:"), "`struere dev` requires an interactive terminal (TTY) to render its watch UI.");
+    console.error(chalk7.gray("  - For a one-shot sync, use:"), chalk7.cyan("struere sync [--env development]"));
+    console.error(chalk7.gray("  - For continuous deployment in CI/CD, use:"), chalk7.cyan("struere deploy"));
+    console.error(chalk7.gray("  - To run dev in the foreground, attach a TTY (avoid backgrounding with `&` or piping output)."));
     process.exit(1);
   }
   console.log();
@@ -3690,6 +3749,9 @@ var devCommand = new Command6("dev").description("Watch files and sync to develo
         console.log(chalk7.gray("  2."), "Or run", chalk7.cyan("struere init"), "to select a different organization");
         console.log();
         process.exit(1);
+      } else if (error instanceof SyncValidationFailureError) {
+        spinner.fail("Sync failed");
+        renderValidationErrors(error.validationErrors);
       } else {
         spinner.fail("Sync failed");
         console.log(chalk7.red("Error:"), error instanceof Error ? error.message : String(error));
@@ -3730,8 +3792,13 @@ var devCommand = new Command6("dev").description("Watch files and sync to develo
       await performDevSync(cwd, project.organization.id);
       syncSpinner.succeed("Synced");
     } catch (error) {
-      syncSpinner.fail("Sync failed");
-      console.log(chalk7.red("Error:"), error instanceof Error ? error.message : String(error));
+      if (error instanceof SyncValidationFailureError) {
+        syncSpinner.fail("Sync failed");
+        renderValidationErrors(error.validationErrors);
+      } else {
+        syncSpinner.fail("Sync failed");
+        console.log(chalk7.red("Error:"), error instanceof Error ? error.message : String(error));
+      }
     }
   };
   const handleFileChange = (path, action) => {
@@ -3998,6 +4065,8 @@ var deployCommand = new Command7("deploy").description("Deploy all resources to
       environment: "production"
     });
     if (!syncResult.success) {
+      if (syncResult.validationErrors)
+        throw new SyncValidationFailureError(syncResult.validationErrors);
       throw new Error(syncResult.error || "Deploy failed");
     }
     const elapsed = Date.now() - startTime;
@@ -4107,6 +4176,14 @@ var deployCommand = new Command7("deploy").description("Deploy all resources to
         console.log();
       }
       process.exit(1);
+    } else if (error instanceof SyncValidationFailureError) {
+      if (jsonMode) {
+        console.log(JSON.stringify({ success: false, validationErrors: error.validationErrors }));
+      } else {
+        spinner.fail("Deployment failed");
+        renderValidationErrors(error.validationErrors);
+      }
+      process.exit(1);
     } else {
       if (jsonMode) {
         console.log(JSON.stringify({ success: false, error: error instanceof Error ? error.message : String(error) }));
@@ -5776,7 +5853,8 @@ async function queryThreads(options) {
     environment: options.environment,
     ...options.agentId && { agentId: options.agentId },
     ...options.channel && { channel: options.channel },
-    ...options.limit && { limit: options.limit }
+    ...options.limit && { limit: options.limit },
+    ...options.organizationId && { organizationId: options.organizationId }
   });
   if (result.error || !result.data)
     return result;
@@ -5792,20 +5870,21 @@ async function queryThreads(options) {
   }
   return result;
 }
-async function queryThreadDetail(threadId, messageLimit) {
+async function queryThreadDetail(threadId, messageLimit, organizationId) {
   return convexQuery2("threads:getWithMessages", {
     id: threadId,
-    ...messageLimit && { messageLimit }
+    ...messageLimit && { messageLimit },
+    ...organizationId && { organizationId }
   });
 }
-async function queryThreadExecutions(threadId) {
-  return convexQuery2("executions:getByThread", { threadId });
+async function queryThreadExecutions(threadId, organizationId) {
+  return convexQuery2("executions:getByThread", { threadId, ...organizationId && { organizationId } });
 }
-async function resolveThreadId(shortId, environment) {
+async function resolveThreadId(shortId, environment, organizationId) {
   if (shortId.includes("|") || shortId.length > 20) {
     return { data: shortId };
   }
-  const result = await queryThreads({ environment: environment ?? "development", limit: 100 });
+  const result = await queryThreads({ environment: environment ?? "development", limit: 100, organizationId });
   if (result.error || !result.data)
     return { error: result.error ?? "Could not fetch threads" };
   const threads = result.data;
@@ -5814,7 +5893,7 @@ async function resolveThreadId(shortId, environment) {
     for (const env of ["production", "development", "eval"]) {
       if (env === (environment ?? "development"))
         continue;
-      const envResult = await queryThreads({ environment: env, limit: 100 });
+      const envResult = await queryThreads({ environment: env, limit: 100, organizationId });
       if (envResult.data) {
         const envThreads = envResult.data;
         const envMatch = envThreads.find((t) => t._id.endsWith(shortId));
@@ -5916,7 +5995,8 @@ logsCommand.command("list", { isDefault: true }).description("List recent conver
     agentId,
     channel: opts.channel,
     phone: opts.phone,
-    limit: parseInt(opts.limit, 10)
+    limit: parseInt(opts.limit, 10),
+    organizationId: orgId
   });
   if (error || !data) {
     spinner?.fail("Failed to fetch conversations");
@@ -5953,8 +6033,9 @@ logsCommand.command("list", { isDefault: true }).description("List recent conver
 logsCommand.command("view <thread-id>").description("View conversation messages").option("--env <environment>", "Environment hint for resolving short IDs").option("--exec", "Include execution details").option("--verbose", "Show full tool call arguments and results").option("--tail", "Show most recent messages (use with --limit)").option("--json", "Output raw JSON").option("--limit <n>", "Message limit", "100").action(async (rawThreadId, opts) => {
   await ensureAuth2();
   const spinner = opts.json ? null : ora12();
+  const orgId = getOrgId2();
   spinner?.start("Resolving thread");
-  const resolved = await resolveThreadId(rawThreadId, opts.env);
+  const resolved = await resolveThreadId(rawThreadId, opts.env, orgId);
   if (resolved.error || !resolved.data) {
     spinner?.fail("Thread not found");
     console.log(chalk16.red("Error:"), resolved.error || `No thread matched "${rawThreadId}"`);
@@ -5964,7 +6045,7 @@ logsCommand.command("view <thread-id>").description("View conversation messages"
   spinner?.stop();
   spinner?.start("Fetching conversation");
   const fetchLimit = opts.tail ? 1000 : parseInt(opts.limit, 10);
-  const { data, error } = await queryThreadDetail(threadId, fetchLimit);
+  const { data, error } = await queryThreadDetail(threadId, fetchLimit, orgId);
   if (error || !data) {
     spinner?.fail("Failed to fetch conversation");
     console.log(chalk16.red("Error:"), error || "Thread not found");
@@ -5974,7 +6055,7 @@ logsCommand.command("view <thread-id>").description("View conversation messages"
   const result = data;
   let executions = [];
   if (opts.exec) {
-    const execResult = await queryThreadExecutions(threadId);
+    const execResult = await queryThreadExecutions(threadId, orgId);
     if (execResult.data) {
       executions = execResult.data;
     }
@@ -7593,51 +7674,54 @@ async function convexMutation5(path, args) {
   }
   return json.value;
 }
-async function listTriggers(environment) {
-  return convexQuery6("triggers:list", { environment });
+async function listTriggers(environment, organizationId) {
+  return convexQuery6("triggers:list", { environment, ...organizationId && { organizationId } });
 }
-async function getTrigger(slug, environment) {
-  return convexQuery6("triggers:getBySlug", { slug, environment });
+async function getTrigger(slug, environment, organizationId) {
+  return convexQuery6("triggers:getBySlug", { slug, environment, ...organizationId && { organizationId } });
 }
 async function listTriggerRuns(options) {
   return convexQuery6("triggers:listRuns", {
     environment: options.environment,
     ...options.status && { status: options.status },
     ...options.triggerSlug && { triggerSlug: options.triggerSlug },
-    ...options.limit && { limit: options.limit }
+    ...options.limit && { limit: options.limit },
+    ...options.organizationId && { organizationId: options.organizationId }
   });
 }
-async function getTriggerRunDetail(runId, environment) {
+async function getTriggerRunDetail(runId, environment, organizationId) {
   return convexQuery6("triggers:getRunDetail", {
     runId,
-    ...environment && { environment }
+    ...environment && { environment },
+    ...organizationId && { organizationId }
   });
 }
-async function getTriggerRunStats(environment) {
-  return convexQuery6("triggers:getRunStats", { environment });
+async function getTriggerRunStats(environment, organizationId) {
+  return convexQuery6("triggers:getRunStats", { environment, ...organizationId && { organizationId } });
 }
-async function getLastRunStatuses(environment) {
-  return convexQuery6("triggers:getLastRunStatuses", { environment });
+async function getLastRunStatuses(environment, organizationId) {
+  return convexQuery6("triggers:getLastRunStatuses", { environment, ...organizationId && { organizationId } });
 }
-async function cancelTriggerRun(runId, environment) {
-  return convexMutation5("triggers:cancelRun", { runId, environment });
+async function cancelTriggerRun(runId, environment, organizationId) {
+  return convexMutation5("triggers:cancelRun", { runId, environment, ...organizationId && { organizationId } });
 }
-async function retryTriggerRun(runId, environment) {
-  return convexMutation5("triggers:retryRun", { runId, environment });
+async function retryTriggerRun(runId, environment, organizationId) {
+  return convexMutation5("triggers:retryRun", { runId, environment, ...organizationId && { organizationId } });
 }
-async function toggleTrigger(slug, enabled, environment) {
+async function toggleTrigger(slug, enabled, environment, organizationId) {
   const path = enabled ? "triggers:enable" : "triggers:disable";
-  return convexMutation5(path, { slug, environment });
+  return convexMutation5(path, { slug, environment, ...organizationId && { organizationId } });
 }
 async function listTriggerExecutions(options) {
   return convexQuery6("triggers:listExecutions", {
     environment: options.environment,
     ...options.triggerSlug && { triggerSlug: options.triggerSlug },
-    ...options.limit && { limit: options.limit }
+    ...options.limit && { limit: options.limit },
+    ...options.organizationId && { organizationId: options.organizationId }
   });
 }
-async function getTriggerExecutionDetail(eventId, environment) {
-  return convexQuery6("triggers:getExecutionDetail", { eventId, ...environment && { environment } });
+async function getTriggerExecutionDetail(eventId, environment, organizationId) {
+  return convexQuery6("triggers:getExecutionDetail", { eventId, ...environment && { environment }, ...organizationId && { organizationId } });
 }
 async function convexAction3(path, args) {
   const token = getToken3();
@@ -7664,11 +7748,15 @@ async function convexAction3(path, args) {
   }
   return json.value;
 }
-async function retryImmediateExecution(eventId, environment) {
-  return convexAction3("triggers:retryImmediateExecution", { eventId, environment });
+async function retryImmediateExecution(eventId, environment, organizationId) {
+  return convexAction3("triggers:retryImmediateExecution", { eventId, environment, ...organizationId && { organizationId } });
 }
 
 // src/cli/commands/triggers.ts
+function getOrgId3() {
+  const project = loadProject(process.cwd());
+  return project?.organization.id;
+}
 async function withTriggerAuthRetry(fn) {
   try {
     return await fn();
@@ -7836,10 +7924,11 @@ triggersCommand.command("list", { isDefault: true }).description("List all trigg
   await ensureAuth5();
   const spinner = opts.json ? null : ora14();
   try {
+    const orgId = getOrgId3();
     spinner?.start("Fetching triggers");
     const [triggers, statuses] = await Promise.all([
-      listTriggers(opts.env),
-      getLastRunStatuses(opts.env)
+      listTriggers(opts.env, orgId),
+      getLastRunStatuses(opts.env, orgId)
     ]);
     let filtered = triggers;
     if (opts.failed) {
@@ -7885,7 +7974,7 @@ triggersCommand.command("get <slug>").description("View trigger details").option
   const spinner = opts.json ? null : ora14();
   try {
     spinner?.start("Fetching trigger");
-    const trigger = await getTrigger(slug, opts.env);
+    const trigger = await getTrigger(slug, opts.env, getOrgId3());
     if (!trigger) {
       spinner?.fail("Trigger not found");
       if (opts.json) {
@@ -7968,7 +8057,8 @@ triggersCommand.command("runs [slug]").description("List trigger runs").option("
       environment: opts.env,
       status: opts.status,
       triggerSlug: slug,
-      limit: parseInt(opts.limit, 10)
+      limit: parseInt(opts.limit, 10),
+      organizationId: getOrgId3()
     });
     spinner?.succeed(`Found ${runs.length} runs`);
     if (opts.json) {
@@ -8010,7 +8100,7 @@ triggersCommand.command("run <run-id>").description("View trigger run details").
   const spinner = opts.json ? null : ora14();
   try {
     spinner?.start("Fetching run");
-    const run = await getTriggerRunDetail(runId, opts.env);
+    const run = await getTriggerRunDetail(runId, opts.env, getOrgId3());
     if (!run) {
       spinner?.fail("Run not found");
       if (opts.json) {
@@ -8054,8 +8144,9 @@ triggersCommand.command("stats").description("Show trigger run statistics").opti
   await ensureAuth5();
   const spinner = opts.json ? null : ora14();
   try {
+    const orgId = getOrgId3();
     spinner?.start("Fetching statistics");
-    const stats = await getTriggerRunStats(opts.env);
+    const stats = await getTriggerRunStats(opts.env, orgId);
     spinner?.succeed("Run statistics");
     if (opts.json) {
       console.log(JSON.stringify(stats, null, 2));
@@ -8080,7 +8171,7 @@ triggersCommand.command("stats").description("Show trigger run statistics").opti
     console.log(`  ${chalk20.gray("\u2500".repeat(18))}`);
     console.log(`  ${chalk20.bold("Total".padEnd(12))} ${chalk20.bold(String(total).padStart(6))}`);
     console.log();
-    const executions = await listTriggerExecutions({ environment: opts.env, limit: 50 });
+    const executions = await listTriggerExecutions({ environment: opts.env, limit: 50, organizationId: orgId });
     const recentFailures = executions.filter((e) => e.eventType === "trigger.failed");
     const recentSuccesses = executions.length - recentFailures.length;
     console.log(chalk20.bold(`  Recent Executions`));
@@ -8112,7 +8203,8 @@ triggersCommand.command("logs [slug]").description("View trigger execution histo
     const executions = await withTriggerAuthRetry(() => listTriggerExecutions({
       environment: opts.env,
       triggerSlug: slug,
-      limit: parseInt(opts.limit, 10)
+      limit: parseInt(opts.limit, 10),
+      organizationId: getOrgId3()
     }));
     spinner?.succeed(`Found ${executions.length} executions`);
     if (opts.json) {
@@ -8172,6 +8264,7 @@ triggersCommand.command("log <identifier>").description("View detailed trigger e
   await ensureAuth5();
   const spinner = opts.json ? null : ora14();
   try {
+    const orgId = getOrgId3();
     const nth = parseInt(opts.nth, 10);
     if (isNaN(nth) || nth < 1) {
       console.error(chalk20.red("Error:"), "--nth must be a positive integer (e.g., --nth 1 for most recent)");
@@ -8184,7 +8277,8 @@ triggersCommand.command("log <identifier>").description("View detailed trigger e
       const executions = await withTriggerAuthRetry(() => listTriggerExecutions({
         environment: opts.env,
         triggerSlug: identifier,
-        limit: nth
+        limit: nth,
+        organizationId: orgId
       }));
       if (!executions.length) {
         spinner?.fail(`No executions found for trigger "${identifier}" in ${opts.env}`);
@@ -8202,7 +8296,7 @@ triggersCommand.command("log <identifier>").description("View detailed trigger e
       spinner?.succeed(`Found execution for "${identifier}"`);
     }
     spinner?.start("Fetching execution detail");
-    const event = await withTriggerAuthRetry(() => getTriggerExecutionDetail(eventId, opts.env));
+    const event = await withTriggerAuthRetry(() => getTriggerExecutionDetail(eventId, opts.env, orgId));
     if (!event) {
       spinner?.fail("Execution not found");
       if (opts.json) {
@@ -8264,7 +8358,7 @@ triggersCommand.command("retry <run-id>").description("Retry a failed or dead ru
   }
   try {
     spinner?.start("Retrying run...");
-    await retryTriggerRun(runId, environment);
+    await retryTriggerRun(runId, environment, getOrgId3());
     spinner?.succeed(chalk20.green(`Run ${runId} queued for retry`));
     if (opts.json) {
       console.log(JSON.stringify({ success: true, runId }));
@@ -8295,7 +8389,7 @@ triggersCommand.command("cancel <run-id>").description("Cancel a pending run").o
   }
   try {
     spinner?.start("Cancelling run...");
-    await cancelTriggerRun(runId, environment);
+    await cancelTriggerRun(runId, environment, getOrgId3());
     spinner?.succeed(chalk20.green(`Run ${runId} cancelled`));
     if (opts.json) {
       console.log(JSON.stringify({ success: true, runId }));
@@ -8326,7 +8420,7 @@ triggersCommand.command("enable <slug>").description("Enable a trigger").option(
   }
   try {
     spinner?.start("Enabling trigger...");
-    await toggleTrigger(slug, true, environment);
+    await toggleTrigger(slug, true, environment, getOrgId3());
     spinner?.succeed(chalk20.green(`Trigger ${slug} enabled`));
     if (opts.json) {
       console.log(JSON.stringify({ success: true, slug }));
@@ -8357,7 +8451,7 @@ triggersCommand.command("disable <slug>").description("Disable a trigger").optio
   }
   try {
     spinner?.start("Disabling trigger...");
-    await toggleTrigger(slug, false, environment);
+    await toggleTrigger(slug, false, environment, getOrgId3());
     spinner?.succeed(chalk20.green(`Trigger ${slug} disabled`));
     if (opts.json) {
       console.log(JSON.stringify({ success: true, slug }));
@@ -8388,7 +8482,7 @@ triggersCommand.command("retry-event <event-id>").description("Retry a failed im
   }
   try {
     spinner?.start("Retrying failed execution...");
-    const result = await retryImmediateExecution(eventId, environment);
+    const result = await retryImmediateExecution(eventId, environment, getOrgId3());
     if (result.success) {
       spinner?.succeed(chalk20.green(`Execution retried successfully`));
     } else {
@@ -8436,7 +8530,8 @@ triggersCommand.command("fire <slug>").description("Manually fire a trigger").op
       slug,
       environment,
       entityId: opts.entity,
-      data
+      data,
+      organizationId: getOrgId3()
     });
     if (error) {
       spinner?.fail("Trigger execution failed");
@@ -8594,12 +8689,14 @@ async function listThreads(options) {
   return convexQuery7("threads:listWithPreviews", {
     environment: options.environment,
     channel: options.channel,
-    limit: options.limit
+    limit: options.limit,
+    ...options.organizationId && { organizationId: options.organizationId }
   });
 }
 async function getThreadWithMessages(options) {
   return convexQuery7("threads:getWithMessages", {
-    id: options.threadId
+    id: options.threadId,
+    ...options.organizationId && { organizationId: options.organizationId }
   });
 }
 async function archiveThread(options) {
@@ -10377,8 +10474,8 @@ function checkModelConfig(resources) {
     hint: "Check agent model config - temperature should be 0-2"
   };
 }
-async function checkStuckThreads(environment) {
-  const threads = await withAuthRetry2(() => listThreads({ environment, limit: 100 }));
+async function checkStuckThreads(environment, organizationId) {
+  const threads = await withAuthRetry2(() => listThreads({ environment, limit: 100, organizationId }));
   const issues = [];
   const now = Date.now();
   const fiveMinutes = 5 * 60 * 1000;
@@ -10407,8 +10504,8 @@ async function checkStuckThreads(environment) {
     hint: "Run `struere threads archive <id>` to archive stuck threads"
   };
 }
-async function checkTriggerHealth(environment) {
-  const executions = await withAuthRetry2(() => listTriggerExecutions({ environment, limit: 100 }));
+async function checkTriggerHealth(environment, organizationId) {
+  const executions = await withAuthRetry2(() => listTriggerExecutions({ environment, limit: 100, organizationId }));
   if (executions.length === 0) {
     return {
       id: "trigger-health",
@@ -10455,8 +10552,8 @@ async function checkTriggerHealth(environment) {
     hint: "Run `struere triggers logs <slug>` to investigate failures"
   };
 }
-async function checkSyncDrift(resources, environment) {
-  const { state, error } = await withAuthRetry2(() => getSyncState(undefined, environment));
+async function checkSyncDrift(resources, environment, organizationId) {
+  const { state, error } = await withAuthRetry2(() => getSyncState(organizationId, environment));
   if (error || !state) {
     return {
       id: "sync-drift",
@@ -10565,6 +10662,8 @@ var doctorCommand = new Command25("doctor").description("Run diagnostic checks o
   const spinner = opts.json ? null : ora20();
   const cwd = process.cwd();
   const environment = opts.env;
+  const project = loadProject(cwd);
+  const organizationId = project?.organization.id;
   try {
     spinner?.start("Loading resources...");
     const resources = await loadAllResources(cwd);
@@ -10575,9 +10674,9 @@ var doctorCommand = new Command25("doctor").description("Run diagnostic checks o
       runCheck(() => checkTemplateApprovals(resources)),
       runCheck(() => checkEntityTypeReferences(resources)),
       runCheck(() => checkModelConfig(resources)),
-      runCheck(() => checkStuckThreads(environment)),
-      runCheck(() => checkTriggerHealth(environment)),
-      runCheck(() => checkSyncDrift(resources, environment))
+      runCheck(() => checkStuckThreads(environment, organizationId)),
+      runCheck(() => checkTriggerHealth(environment, organizationId)),
+      runCheck(() => checkSyncDrift(resources, environment, organizationId))
     ]);
     spinner?.stop();
     const checks = results.map((r) => r.status === "fulfilled" ? r.value : { id: "unknown", label: "Unknown", status: "warn", message: `Check failed: ${r.reason}` });
@@ -10631,10 +10730,332 @@ var doctorCommand = new Command25("doctor").description("Run diagnostic checks o
     process.exit(1);
   }
 });
+
+// src/cli/commands/keys.ts
+init_credentials();
+import { Command as Command26 } from "commander";
+import chalk29 from "chalk";
+import ora21 from "ora";
+import { input as input3, confirm as confirm8 } from "@inquirer/prompts";
+init_convex();
+
+// src/cli/utils/apiKeys.ts
+init_credentials();
+init_config();
+function getToken5() {
+  const credentials = loadCredentials();
+  const apiKey = getApiKey();
+  const token = apiKey || credentials?.token;
+  if (!token)
+    throw new Error("Not authenticated");
+  return token;
+}
+async function convexQuery8(path, args) {
+  const token = getToken5();
+  const response = await fetch(`${CONVEX_URL}/api/query`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${token}`
+    },
+    body: JSON.stringify({ path, args })
+  });
+  const text = await response.text();
+  let json;
+  try {
+    json = JSON.parse(text);
+  } catch {
+    throw new Error(text || `HTTP ${response.status}`);
+  }
+  if (!response.ok) {
+    throw new Error(json.errorData?.message || json.errorMessage || text);
+  }
+  if (json.status === "error") {
+    throw new Error(json.errorMessage || "Unknown error from Convex");
+  }
+  return json.value;
+}
+async function convexMutation6(path, args) {
+  const token = getToken5();
+  const response = await fetch(`${CONVEX_URL}/api/mutation`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${token}`
+    },
+    body: JSON.stringify({ path, args })
+  });
+  const text = await response.text();
+  let json;
+  try {
+    json = JSON.parse(text);
+  } catch {
+    throw new Error(text || `HTTP ${response.status}`);
+  }
+  if (!response.ok) {
+    throw new Error(json.errorData?.message || json.errorMessage || text);
+  }
+  if (json.status === "error") {
+    throw new Error(json.errorMessage || "Unknown error from Convex");
+  }
+  return json.value;
+}
+async function listApiKeys() {
+  return convexQuery8("apiKeys:list", {});
+}
+async function createApiKey(args) {
+  return convexMutation6("apiKeys:create", {
+    name: args.name,
+    environment: args.environment,
+    permissions: args.permissions ?? ["*"]
+  });
+}
+async function removeApiKey(id) {
+  return convexMutation6("apiKeys:remove", { id });
+}
+
+// src/cli/commands/keys.ts
+async function withKeyAuthRetry(fn) {
+  try {
+    return await fn();
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("Unauthenticated") || msg.includes("OIDC") || msg.includes("token") || msg.includes("expired")) {
+      const refreshed = await refreshToken();
+      if (!refreshed)
+        throw err;
+      return fn();
+    }
+    throw err;
+  }
+}
+async function ensureAuth9() {
+  const cwd = process.cwd();
+  const nonInteractive = !isInteractive();
+  if (!hasProject(cwd)) {
+    if (nonInteractive) {
+      console.error(chalk29.red("No struere.json found. Run struere init first."));
+      process.exit(1);
+    }
+    console.log(chalk29.yellow("No struere.json found - initializing project..."));
+    console.log();
+    const success = await runInit(cwd);
+    if (!success) {
+      process.exit(1);
+    }
+    console.log();
+  }
+  let credentials = loadCredentials();
+  const apiKey = getApiKey();
+  if (!credentials && !apiKey) {
+    if (nonInteractive) {
+      console.error(chalk29.red("Not authenticated. Set STRUERE_API_KEY or run struere login."));
+      process.exit(1);
+    }
+    console.log(chalk29.yellow("Not logged in - authenticating..."));
+    console.log();
+    credentials = await performLogin();
+    if (!credentials) {
+      console.log(chalk29.red("Authentication failed"));
+      process.exit(1);
+    }
+    console.log();
+  }
+  return true;
+}
+function relativeTime4(ts) {
+  const diff = Date.now() - ts;
+  const seconds = Math.floor(diff / 1000);
+  if (seconds < 60)
+    return `${seconds}s ago`;
+  const minutes = Math.floor(seconds / 60);
+  if (minutes < 60)
+    return `${minutes}m ago`;
+  const hours = Math.floor(minutes / 60);
+  if (hours < 24)
+    return `${hours}h ago`;
+  const days = Math.floor(hours / 24);
+  return `${days}d ago`;
+}
+function maskedPrefix(prefix) {
+  return `${prefix}****`;
+}
+function isValidEnvironment(value) {
+  return value === "development" || value === "production" || value === "eval";
+}
+var keysCommand = new Command26("keys").description("Manage API keys");
+keysCommand.command("list", { isDefault: true }).description("List API keys").option("--env <environment>", "Filter by environment (development|production|eval)").option("--json", "Output raw JSON").action(async (opts) => {
+  await ensureAuth9();
+  const spinner = opts.json ? null : ora21();
+  try {
+    spinner?.start("Fetching API keys");
+    let keys = await withKeyAuthRetry(() => listApiKeys());
+    if (opts.env) {
+      if (!isValidEnvironment(opts.env)) {
+        spinner?.fail(`Invalid environment: ${opts.env}`);
+        process.exit(1);
+      }
+      keys = keys.filter((k) => k.environment === opts.env);
+    }
+    spinner?.succeed(`Found ${keys.length} API key${keys.length === 1 ? "" : "s"}${opts.env ? ` (${opts.env})` : ""}`);
+    if (opts.json) {
+      console.log(JSON.stringify(keys, null, 2));
+      return;
+    }
+    console.log();
+    renderTable([
+      { key: "id", label: "ID", width: 14 },
+      { key: "name", label: "Name", width: 24 },
+      { key: "prefix", label: "Prefix", width: 22 },
+      { key: "environment", label: "Env", width: 12 },
+      { key: "created", label: "Created", width: 12 },
+      { key: "lastUsed", label: "Last Used", width: 12 }
+    ], keys.map((k) => ({
+      id: k.id.slice(-12),
+      name: k.name,
+      prefix: maskedPrefix(k.keyPrefix),
+      environment: k.environment,
+      created: relativeTime4(k.createdAt),
+      lastUsed: k.lastUsedAt ? relativeTime4(k.lastUsedAt) : chalk29.gray("-")
+    })));
+    console.log();
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    spinner?.fail("Failed to fetch API keys");
+    if (opts.json) {
+      console.log(JSON.stringify({ success: false, error: message }));
+    } else {
+      console.log(chalk29.red("Error:"), message);
+    }
+    process.exit(1);
+  }
+});
+keysCommand.command("create").description("Create a new API key").option("--name <name>", "Key name").option("--env <environment>", "Environment (development|production|eval)", "development").option("--json", "Output raw JSON").option("--confirm", "Skip production confirmation").action(async (opts) => {
+  await ensureAuth9();
+  if (!isValidEnvironment(opts.env)) {
+    const message = `Invalid environment: ${opts.env}`;
+    if (opts.json) {
+      console.log(JSON.stringify({ success: false, error: message }));
+    } else {
+      console.log(chalk29.red("Error:"), message);
+    }
+    process.exit(1);
+  }
+  const environment = opts.env;
+  let name = opts.name;
+  if (!name || !name.trim()) {
+    if (!isInteractive()) {
+      const message = "--name is required in non-interactive mode";
+      if (opts.json) {
+        console.log(JSON.stringify({ success: false, error: message }));
+      } else {
+        console.log(chalk29.red("Error:"), message);
+      }
+      process.exit(1);
+    }
+    name = await input3({
+      message: "API key name:",
+      validate: (v) => v.trim().length > 0 || "Name is required"
+    });
+  }
+  name = name.trim();
+  if (environment === "production" && !opts.confirm && !opts.json && isInteractive()) {
+    const ok = await confirm8({
+      message: chalk29.yellow("Create API key in PRODUCTION environment?"),
+      default: false
+    });
+    if (!ok) {
+      console.log(chalk29.gray("Cancelled"));
+      process.exit(0);
+    }
+  }
+  const spinner = opts.json ? null : ora21();
+  try {
+    spinner?.start("Creating API key");
+    const result = await withKeyAuthRetry(() => createApiKey({ name, environment }));
+    spinner?.succeed(chalk29.green(`Created API key ${chalk29.cyan(result.name)}`));
+    if (opts.json) {
+      console.log(JSON.stringify({
+        id: result.id,
+        name: result.name,
+        prefix: result.keyPrefix,
+        key: result.key,
+        environment,
+        createdAt: result.createdAt
+      }, null, 2));
+      return;
+    }
+    console.log();
+    console.log(chalk29.bold("  " + chalk29.yellow("Save this key now \u2014 it will not be shown again.")));
+    console.log();
+    console.log(`  ${chalk29.gray("Key:")}         ${chalk29.cyan(result.key)}`);
+    console.log(`  ${chalk29.gray("Name:")}        ${result.name}`);
+    console.log(`  ${chalk29.gray("Prefix:")}      ${result.keyPrefix}`);
+    console.log(`  ${chalk29.gray("Environment:")} ${environment}`);
+    console.log(`  ${chalk29.gray("ID:")}          ${result.id}`);
+    console.log();
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    spinner?.fail("Failed to create API key");
+    if (opts.json) {
+      console.log(JSON.stringify({ success: false, error: message }));
+    } else {
+      console.log(chalk29.red("Error:"), message);
+    }
+    process.exit(1);
+  }
+});
+keysCommand.command("revoke <id-or-prefix>").description("Revoke an API key (delete)").option("--confirm", "Skip confirmation prompt").option("--json", "Output raw JSON").action(async (idOrPrefix, opts) => {
+  await ensureAuth9();
+  const spinner = opts.json ? null : ora21();
+  try {
+    spinner?.start("Looking up API key");
+    const keys = await withKeyAuthRetry(() => listApiKeys());
+    const target = keys.find((k) => k.id === idOrPrefix) ?? keys.find((k) => k.id.endsWith(idOrPrefix)) ?? keys.find((k) => k.keyPrefix === idOrPrefix) ?? keys.find((k) => k.keyPrefix.startsWith(idOrPrefix));
+    if (!target) {
+      spinner?.fail(`API key not found: ${idOrPrefix}`);
+      if (opts.json) {
+        console.log(JSON.stringify({ success: false, error: "API key not found" }));
+      }
+      process.exit(1);
+    }
+    spinner?.succeed(`Found ${chalk29.cyan(target.name)} (${maskedPrefix(target.keyPrefix)}, ${target.environment})`);
+    if (!opts.confirm && !opts.json) {
+      if (!isInteractive()) {
+        console.log(chalk29.red("Error:"), "Use --confirm to revoke in non-interactive mode");
+        process.exit(1);
+      }
+      const ok = await confirm8({
+        message: `Revoke this key? This cannot be undone.`,
+        default: false
+      });
+      if (!ok) {
+        console.log(chalk29.gray("Cancelled"));
+        process.exit(0);
+      }
+    }
+    const revokeSpinner = opts.json ? null : ora21();
+    revokeSpinner?.start("Revoking API key");
+    await withKeyAuthRetry(() => removeApiKey(target.id));
+    revokeSpinner?.succeed(chalk29.green(`Revoked ${chalk29.cyan(target.name)}`));
+    if (opts.json) {
+      console.log(JSON.stringify({ success: true, id: target.id, name: target.name }));
+    }
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    spinner?.fail("Failed to revoke API key");
+    if (opts.json) {
+      console.log(JSON.stringify({ success: false, error: message }));
+    } else {
+      console.log(chalk29.red("Error:"), message);
+    }
+    process.exit(1);
+  }
+});
 // package.json
 var package_default = {
   name: "struere",
-  version: "0.14.1",
+  version: "0.14.3",
   description: "Build, test, and deploy AI agents",
   keywords: [
     "ai",
@@ -10669,13 +11090,17 @@ var package_default = {
     ".": {
       import: "./dist/index.js",
       types: "./dist/index.d.ts"
+    },
+    "./client": {
+      import: "./dist/client/index.js",
+      types: "./dist/client/index.d.ts"
     }
   },
   files: [
     "dist"
   ],
   scripts: {
-    build: "bun build ./src/cli/index.ts --outdir ./dist/cli --target bun --external commander --external chalk --external ora --external chokidar --external yaml --external @inquirer/prompts && bun build ./src/index.ts --outdir ./dist --target node && bun build ./src/bin/struere.ts --outdir ./dist/bin --target bun --external commander --external chalk --external ora --external chokidar --external yaml --external @inquirer/prompts && tsc --emitDeclarationOnly && chmod +x ./dist/bin/struere.js",
+    build: "bun build ./src/cli/index.ts --outdir ./dist/cli --target bun --external commander --external chalk --external ora --external chokidar --external yaml --external @inquirer/prompts && bun build ./src/index.ts --outdir ./dist --target node && bun build ./src/client/index.ts --outdir ./dist/client --target browser && bun build ./src/bin/struere.ts --outdir ./dist/bin --target bun --external commander --external chalk --external ora --external chokidar --external yaml --external @inquirer/prompts && tsc --emitDeclarationOnly && chmod +x ./dist/bin/struere.js",
     dev: "tsc --watch",
     test: "bun test",
     prepublishOnly: "bun run build"
@@ -10759,4 +11184,5 @@ program.addCommand(chatCommand);
 program.addCommand(whatsappCommand);
 program.addCommand(diffCommand);
 program.addCommand(doctorCommand);
+program.addCommand(keysCommand);
 program.parse();