struere 0.14.2 → 0.14.4

package/dist/bin/struere.js

@@ -680,7 +680,8 @@ async function _fireTrigger(options) {
         slug: options.slug,
         environment: options.environment,
         entityId: options.entityId,
-        data: options.data
+        data: options.data,
+        ...options.organizationId && { organizationId: options.organizationId }
       }
     }),
     signal: AbortSignal.timeout(60000)
@@ -2053,6 +2054,7 @@ export interface AgentConfig {
   systemPrompt: string | (() => string | Promise<string>)
   model?: ModelConfig
   tools?: string[]
+  roles?: string[]
   firstMessageSuggestions?: string[]
   threadContextParams?: Array<{
     name: string
@@ -2070,6 +2072,7 @@ export interface JSONSchemaProperty {
   items?: JSONSchemaProperty
   properties?: Record<string, JSONSchemaProperty>
   required?: string[]
+  references?: string
 }
 
 export interface JSONSchema {
@@ -2115,6 +2118,7 @@ export interface FieldMaskConfig {
 export interface RoleConfig {
   name: string
   description?: string
+  agentAccess?: string[]
   policies: PolicyConfig[]
   scopeRules?: ScopeRuleConfig[]
   fieldMasks?: FieldMaskConfig[]
@@ -2126,26 +2130,37 @@ export interface TriggerAction {
   as?: string
 }
 
+export interface TriggerOnEntity {
+  entityType: string
+  action: 'created' | 'updated' | 'deleted'
+  condition?: Record<string, unknown>
+}
+
+export interface TriggerOnSchedule {
+  schedule: string
+  timezone?: string
+}
+
+export interface TriggerSchedule {
+  delay?: number
+  at?: string
+  offset?: number
+  cancelPrevious?: boolean
+}
+
+export interface TriggerRetry {
+  maxAttempts?: number
+  backoffMs?: number
+}
+
 export interface TriggerConfig {
   name: string
   slug: string
   description?: string
-  on: {
-    entityType: string
-    action: 'created' | 'updated' | 'deleted'
-    condition?: Record<string, unknown>
-  }
+  on: TriggerOnEntity | TriggerOnSchedule
+  schedule?: TriggerSchedule
+  retry?: TriggerRetry
   actions: TriggerAction[]
-  schedule?: {
-    delay?: number
-    at?: string
-    offset?: number
-    cancelPrevious?: boolean
-  }
-  retry?: {
-    maxAttempts?: number
-    backoffMs?: number
-  }
 }
 
 export interface RouterAgentRef {
@@ -3150,7 +3165,8 @@ function extractAgentPayload(agent, customToolsMap) {
       maxTokens: agent.model?.maxTokens,
       reasoning: agent.model?.reasoning
     },
-    tools
+    tools,
+    roles: agent.roles
   };
 }
 function extractHandlerCode(handler) {
@@ -3633,7 +3649,10 @@ var devCommand = new Command6("dev").description("Watch files and sync to develo
   const apiKey = getApiKey();
   const nonInteractive = !isInteractive();
   if (nonInteractive) {
-    console.error("Error: struere dev is a long-running watch process. Use struere sync instead.");
+    console.error(chalk7.red("Error:"), "`struere dev` requires an interactive terminal (TTY) to render its watch UI.");
+    console.error(chalk7.gray("  - For a one-shot sync, use:"), chalk7.cyan("struere sync [--env development]"));
+    console.error(chalk7.gray("  - For continuous deployment in CI/CD, use:"), chalk7.cyan("struere deploy"));
+    console.error(chalk7.gray("  - To run dev in the foreground, attach a TTY (avoid backgrounding with `&` or piping output)."));
     process.exit(1);
   }
   console.log();
@@ -5849,7 +5868,8 @@ async function queryThreads(options) {
     environment: options.environment,
     ...options.agentId && { agentId: options.agentId },
     ...options.channel && { channel: options.channel },
-    ...options.limit && { limit: options.limit }
+    ...options.limit && { limit: options.limit },
+    ...options.organizationId && { organizationId: options.organizationId }
   });
   if (result.error || !result.data)
     return result;
@@ -5865,20 +5885,21 @@ async function queryThreads(options) {
   }
   return result;
 }
-async function queryThreadDetail(threadId, messageLimit) {
+async function queryThreadDetail(threadId, messageLimit, organizationId) {
   return convexQuery2("threads:getWithMessages", {
     id: threadId,
-    ...messageLimit && { messageLimit }
+    ...messageLimit && { messageLimit },
+    ...organizationId && { organizationId }
   });
 }
-async function queryThreadExecutions(threadId) {
-  return convexQuery2("executions:getByThread", { threadId });
+async function queryThreadExecutions(threadId, organizationId) {
+  return convexQuery2("executions:getByThread", { threadId, ...organizationId && { organizationId } });
 }
-async function resolveThreadId(shortId, environment) {
+async function resolveThreadId(shortId, environment, organizationId) {
   if (shortId.includes("|") || shortId.length > 20) {
     return { data: shortId };
   }
-  const result = await queryThreads({ environment: environment ?? "development", limit: 100 });
+  const result = await queryThreads({ environment: environment ?? "development", limit: 100, organizationId });
   if (result.error || !result.data)
     return { error: result.error ?? "Could not fetch threads" };
   const threads = result.data;
@@ -5887,7 +5908,7 @@ async function resolveThreadId(shortId, environment) {
     for (const env of ["production", "development", "eval"]) {
       if (env === (environment ?? "development"))
         continue;
-      const envResult = await queryThreads({ environment: env, limit: 100 });
+      const envResult = await queryThreads({ environment: env, limit: 100, organizationId });
       if (envResult.data) {
         const envThreads = envResult.data;
         const envMatch = envThreads.find((t) => t._id.endsWith(shortId));
@@ -5989,7 +6010,8 @@ logsCommand.command("list", { isDefault: true }).description("List recent conver
     agentId,
     channel: opts.channel,
     phone: opts.phone,
-    limit: parseInt(opts.limit, 10)
+    limit: parseInt(opts.limit, 10),
+    organizationId: orgId
   });
   if (error || !data) {
     spinner?.fail("Failed to fetch conversations");
@@ -6026,8 +6048,9 @@ logsCommand.command("list", { isDefault: true }).description("List recent conver
 logsCommand.command("view <thread-id>").description("View conversation messages").option("--env <environment>", "Environment hint for resolving short IDs").option("--exec", "Include execution details").option("--verbose", "Show full tool call arguments and results").option("--tail", "Show most recent messages (use with --limit)").option("--json", "Output raw JSON").option("--limit <n>", "Message limit", "100").action(async (rawThreadId, opts) => {
   await ensureAuth2();
   const spinner = opts.json ? null : ora12();
+  const orgId = getOrgId2();
   spinner?.start("Resolving thread");
-  const resolved = await resolveThreadId(rawThreadId, opts.env);
+  const resolved = await resolveThreadId(rawThreadId, opts.env, orgId);
   if (resolved.error || !resolved.data) {
     spinner?.fail("Thread not found");
     console.log(chalk16.red("Error:"), resolved.error || `No thread matched "${rawThreadId}"`);
@@ -6037,7 +6060,7 @@ logsCommand.command("view <thread-id>").description("View conversation messages"
   spinner?.stop();
   spinner?.start("Fetching conversation");
   const fetchLimit = opts.tail ? 1000 : parseInt(opts.limit, 10);
-  const { data, error } = await queryThreadDetail(threadId, fetchLimit);
+  const { data, error } = await queryThreadDetail(threadId, fetchLimit, orgId);
   if (error || !data) {
     spinner?.fail("Failed to fetch conversation");
     console.log(chalk16.red("Error:"), error || "Thread not found");
@@ -6047,7 +6070,7 @@ logsCommand.command("view <thread-id>").description("View conversation messages"
   const result = data;
   let executions = [];
   if (opts.exec) {
-    const execResult = await queryThreadExecutions(threadId);
+    const execResult = await queryThreadExecutions(threadId, orgId);
     if (execResult.data) {
       executions = execResult.data;
     }
@@ -7666,51 +7689,54 @@ async function convexMutation5(path, args) {
   }
   return json.value;
 }
-async function listTriggers(environment) {
-  return convexQuery6("triggers:list", { environment });
+async function listTriggers(environment, organizationId) {
+  return convexQuery6("triggers:list", { environment, ...organizationId && { organizationId } });
 }
-async function getTrigger(slug, environment) {
-  return convexQuery6("triggers:getBySlug", { slug, environment });
+async function getTrigger(slug, environment, organizationId) {
+  return convexQuery6("triggers:getBySlug", { slug, environment, ...organizationId && { organizationId } });
 }
 async function listTriggerRuns(options) {
   return convexQuery6("triggers:listRuns", {
     environment: options.environment,
     ...options.status && { status: options.status },
     ...options.triggerSlug && { triggerSlug: options.triggerSlug },
-    ...options.limit && { limit: options.limit }
+    ...options.limit && { limit: options.limit },
+    ...options.organizationId && { organizationId: options.organizationId }
   });
 }
-async function getTriggerRunDetail(runId, environment) {
+async function getTriggerRunDetail(runId, environment, organizationId) {
   return convexQuery6("triggers:getRunDetail", {
     runId,
-    ...environment && { environment }
+    ...environment && { environment },
+    ...organizationId && { organizationId }
   });
 }
-async function getTriggerRunStats(environment) {
-  return convexQuery6("triggers:getRunStats", { environment });
+async function getTriggerRunStats(environment, organizationId) {
+  return convexQuery6("triggers:getRunStats", { environment, ...organizationId && { organizationId } });
 }
-async function getLastRunStatuses(environment) {
-  return convexQuery6("triggers:getLastRunStatuses", { environment });
+async function getLastRunStatuses(environment, organizationId) {
+  return convexQuery6("triggers:getLastRunStatuses", { environment, ...organizationId && { organizationId } });
 }
-async function cancelTriggerRun(runId, environment) {
-  return convexMutation5("triggers:cancelRun", { runId, environment });
+async function cancelTriggerRun(runId, environment, organizationId) {
+  return convexMutation5("triggers:cancelRun", { runId, environment, ...organizationId && { organizationId } });
 }
-async function retryTriggerRun(runId, environment) {
-  return convexMutation5("triggers:retryRun", { runId, environment });
+async function retryTriggerRun(runId, environment, organizationId) {
+  return convexMutation5("triggers:retryRun", { runId, environment, ...organizationId && { organizationId } });
 }
-async function toggleTrigger(slug, enabled, environment) {
+async function toggleTrigger(slug, enabled, environment, organizationId) {
   const path = enabled ? "triggers:enable" : "triggers:disable";
-  return convexMutation5(path, { slug, environment });
+  return convexMutation5(path, { slug, environment, ...organizationId && { organizationId } });
 }
 async function listTriggerExecutions(options) {
   return convexQuery6("triggers:listExecutions", {
     environment: options.environment,
     ...options.triggerSlug && { triggerSlug: options.triggerSlug },
-    ...options.limit && { limit: options.limit }
+    ...options.limit && { limit: options.limit },
+    ...options.organizationId && { organizationId: options.organizationId }
   });
 }
-async function getTriggerExecutionDetail(eventId, environment) {
-  return convexQuery6("triggers:getExecutionDetail", { eventId, ...environment && { environment } });
+async function getTriggerExecutionDetail(eventId, environment, organizationId) {
+  return convexQuery6("triggers:getExecutionDetail", { eventId, ...environment && { environment }, ...organizationId && { organizationId } });
 }
 async function convexAction3(path, args) {
   const token = getToken3();
@@ -7737,11 +7763,15 @@ async function convexAction3(path, args) {
   }
   return json.value;
 }
-async function retryImmediateExecution(eventId, environment) {
-  return convexAction3("triggers:retryImmediateExecution", { eventId, environment });
+async function retryImmediateExecution(eventId, environment, organizationId) {
+  return convexAction3("triggers:retryImmediateExecution", { eventId, environment, ...organizationId && { organizationId } });
 }
 
 // src/cli/commands/triggers.ts
+function getOrgId3() {
+  const project = loadProject(process.cwd());
+  return project?.organization.id;
+}
 async function withTriggerAuthRetry(fn) {
   try {
     return await fn();
@@ -7909,10 +7939,11 @@ triggersCommand.command("list", { isDefault: true }).description("List all trigg
   await ensureAuth5();
   const spinner = opts.json ? null : ora14();
   try {
+    const orgId = getOrgId3();
     spinner?.start("Fetching triggers");
     const [triggers, statuses] = await Promise.all([
-      listTriggers(opts.env),
-      getLastRunStatuses(opts.env)
+      listTriggers(opts.env, orgId),
+      getLastRunStatuses(opts.env, orgId)
     ]);
     let filtered = triggers;
     if (opts.failed) {
@@ -7958,7 +7989,7 @@ triggersCommand.command("get <slug>").description("View trigger details").option
   const spinner = opts.json ? null : ora14();
   try {
     spinner?.start("Fetching trigger");
-    const trigger = await getTrigger(slug, opts.env);
+    const trigger = await getTrigger(slug, opts.env, getOrgId3());
     if (!trigger) {
       spinner?.fail("Trigger not found");
       if (opts.json) {
@@ -8041,7 +8072,8 @@ triggersCommand.command("runs [slug]").description("List trigger runs").option("
       environment: opts.env,
       status: opts.status,
       triggerSlug: slug,
-      limit: parseInt(opts.limit, 10)
+      limit: parseInt(opts.limit, 10),
+      organizationId: getOrgId3()
     });
     spinner?.succeed(`Found ${runs.length} runs`);
     if (opts.json) {
@@ -8083,7 +8115,7 @@ triggersCommand.command("run <run-id>").description("View trigger run details").
   const spinner = opts.json ? null : ora14();
   try {
     spinner?.start("Fetching run");
-    const run = await getTriggerRunDetail(runId, opts.env);
+    const run = await getTriggerRunDetail(runId, opts.env, getOrgId3());
     if (!run) {
       spinner?.fail("Run not found");
       if (opts.json) {
@@ -8127,8 +8159,9 @@ triggersCommand.command("stats").description("Show trigger run statistics").opti
   await ensureAuth5();
   const spinner = opts.json ? null : ora14();
   try {
+    const orgId = getOrgId3();
     spinner?.start("Fetching statistics");
-    const stats = await getTriggerRunStats(opts.env);
+    const stats = await getTriggerRunStats(opts.env, orgId);
     spinner?.succeed("Run statistics");
     if (opts.json) {
       console.log(JSON.stringify(stats, null, 2));
@@ -8153,7 +8186,7 @@ triggersCommand.command("stats").description("Show trigger run statistics").opti
     console.log(`  ${chalk20.gray("\u2500".repeat(18))}`);
     console.log(`  ${chalk20.bold("Total".padEnd(12))} ${chalk20.bold(String(total).padStart(6))}`);
     console.log();
-    const executions = await listTriggerExecutions({ environment: opts.env, limit: 50 });
+    const executions = await listTriggerExecutions({ environment: opts.env, limit: 50, organizationId: orgId });
     const recentFailures = executions.filter((e) => e.eventType === "trigger.failed");
     const recentSuccesses = executions.length - recentFailures.length;
     console.log(chalk20.bold(`  Recent Executions`));
@@ -8185,7 +8218,8 @@ triggersCommand.command("logs [slug]").description("View trigger execution histo
     const executions = await withTriggerAuthRetry(() => listTriggerExecutions({
       environment: opts.env,
       triggerSlug: slug,
-      limit: parseInt(opts.limit, 10)
+      limit: parseInt(opts.limit, 10),
+      organizationId: getOrgId3()
     }));
     spinner?.succeed(`Found ${executions.length} executions`);
     if (opts.json) {
@@ -8245,6 +8279,7 @@ triggersCommand.command("log <identifier>").description("View detailed trigger e
   await ensureAuth5();
   const spinner = opts.json ? null : ora14();
   try {
+    const orgId = getOrgId3();
     const nth = parseInt(opts.nth, 10);
     if (isNaN(nth) || nth < 1) {
       console.error(chalk20.red("Error:"), "--nth must be a positive integer (e.g., --nth 1 for most recent)");
@@ -8257,7 +8292,8 @@ triggersCommand.command("log <identifier>").description("View detailed trigger e
       const executions = await withTriggerAuthRetry(() => listTriggerExecutions({
         environment: opts.env,
         triggerSlug: identifier,
-        limit: nth
+        limit: nth,
+        organizationId: orgId
       }));
       if (!executions.length) {
         spinner?.fail(`No executions found for trigger "${identifier}" in ${opts.env}`);
@@ -8275,7 +8311,7 @@ triggersCommand.command("log <identifier>").description("View detailed trigger e
       spinner?.succeed(`Found execution for "${identifier}"`);
     }
     spinner?.start("Fetching execution detail");
-    const event = await withTriggerAuthRetry(() => getTriggerExecutionDetail(eventId, opts.env));
+    const event = await withTriggerAuthRetry(() => getTriggerExecutionDetail(eventId, opts.env, orgId));
     if (!event) {
       spinner?.fail("Execution not found");
       if (opts.json) {
@@ -8337,7 +8373,7 @@ triggersCommand.command("retry <run-id>").description("Retry a failed or dead ru
   }
   try {
     spinner?.start("Retrying run...");
-    await retryTriggerRun(runId, environment);
+    await retryTriggerRun(runId, environment, getOrgId3());
     spinner?.succeed(chalk20.green(`Run ${runId} queued for retry`));
     if (opts.json) {
       console.log(JSON.stringify({ success: true, runId }));
@@ -8368,7 +8404,7 @@ triggersCommand.command("cancel <run-id>").description("Cancel a pending run").o
   }
   try {
     spinner?.start("Cancelling run...");
-    await cancelTriggerRun(runId, environment);
+    await cancelTriggerRun(runId, environment, getOrgId3());
     spinner?.succeed(chalk20.green(`Run ${runId} cancelled`));
     if (opts.json) {
       console.log(JSON.stringify({ success: true, runId }));
@@ -8399,7 +8435,7 @@ triggersCommand.command("enable <slug>").description("Enable a trigger").option(
   }
   try {
     spinner?.start("Enabling trigger...");
-    await toggleTrigger(slug, true, environment);
+    await toggleTrigger(slug, true, environment, getOrgId3());
     spinner?.succeed(chalk20.green(`Trigger ${slug} enabled`));
     if (opts.json) {
       console.log(JSON.stringify({ success: true, slug }));
@@ -8430,7 +8466,7 @@ triggersCommand.command("disable <slug>").description("Disable a trigger").optio
   }
   try {
     spinner?.start("Disabling trigger...");
-    await toggleTrigger(slug, false, environment);
+    await toggleTrigger(slug, false, environment, getOrgId3());
     spinner?.succeed(chalk20.green(`Trigger ${slug} disabled`));
     if (opts.json) {
       console.log(JSON.stringify({ success: true, slug }));
@@ -8461,7 +8497,7 @@ triggersCommand.command("retry-event <event-id>").description("Retry a failed im
   }
   try {
     spinner?.start("Retrying failed execution...");
-    const result = await retryImmediateExecution(eventId, environment);
+    const result = await retryImmediateExecution(eventId, environment, getOrgId3());
     if (result.success) {
       spinner?.succeed(chalk20.green(`Execution retried successfully`));
     } else {
@@ -8509,7 +8545,8 @@ triggersCommand.command("fire <slug>").description("Manually fire a trigger").op
       slug,
       environment,
       entityId: opts.entity,
-      data
+      data,
+      organizationId: getOrgId3()
     });
     if (error) {
       spinner?.fail("Trigger execution failed");
@@ -8667,12 +8704,14 @@ async function listThreads(options) {
   return convexQuery7("threads:listWithPreviews", {
     environment: options.environment,
     channel: options.channel,
-    limit: options.limit
+    limit: options.limit,
+    ...options.organizationId && { organizationId: options.organizationId }
   });
 }
 async function getThreadWithMessages(options) {
   return convexQuery7("threads:getWithMessages", {
-    id: options.threadId
+    id: options.threadId,
+    ...options.organizationId && { organizationId: options.organizationId }
   });
 }
 async function archiveThread(options) {
@@ -9298,7 +9337,7 @@ function printExecutionMeta(meta) {
     console.log(chalk24.dim(`Tool errors: ${chalk24.yellow(String(meta.errorCount))}`));
   }
 }
-var chatCommand = new Command22("chat").description("Chat with an agent or via a router").argument("<slug>", "Agent slug (or router slug when --router is used)").option("--env <environment>", "Environment: development | production | eval", "development").option("--thread <id>", "Continue an existing thread").option("--message <msg>", "Single message mode (send and exit)").option("--json", "Output JSON").option("--channel <channel>", "Channel identifier", "api").option("-v, --verbose", "Show execution metadata (model, duration, tool calls)").option("--confirm", "Skip production warning prompt").option("--router", "Chat via a router instead of directly with an agent").option("--phone <number>", "Sender phone number for routing rules").option("--follow", "Continue in interactive mode after sending a message").action(async (slug, options) => {
+var chatCommand = new Command22("chat").description("Chat with an agent or via a router").argument("<slug>", "Agent slug (or router slug when --router is used)").option("--env <environment>", "Environment: development | production | eval", "development").option("--thread <id>", "Continue an existing thread").option("--message <msg>", "Single message mode (send and exit)").option("--json", "Output structured JSON including thread ID, message, usage, and per-tool-call execution metadata.").option("--channel <channel>", "Channel identifier", "api").option("-v, --verbose", "Show execution metadata (model, duration, tool calls)").option("--confirm", "Skip production warning prompt").option("--router", "Chat via a router instead of directly with an agent").option("--phone <number>", "Sender phone number for routing rules").option("--follow", "Continue in interactive mode after sending a message").action(async (slug, options) => {
   const spinner = ora18();
   const cwd = process.cwd();
   const nonInteractive = !isInteractive();
@@ -9436,7 +9475,17 @@ var chatCommand = new Command22("chat").description("Chat with an agent or via a
       spinner.succeed("Message sent");
     const routerResult = result;
     if (jsonMode) {
-      const output = { message: result.message, threadId: result.threadId, usage: result.usage };
+      const output = { threadId: result.threadId, message: result.message, usage: result.usage };
+      if (result._executionMeta) {
+        output.executionMeta = {
+          iterationCount: result._executionMeta.iterationCount,
+          model: result._executionMeta.model,
+          durationMs: result._executionMeta.durationMs,
+          toolCalls: result._executionMeta.toolCallSummary,
+          errorCount: result._executionMeta.errorCount,
+          permissionDenialCount: result._executionMeta.permissionDenialCount
+        };
+      }
       if (routerResult.routedToAgent) {
         output.routedToAgent = routerResult.routedToAgent;
         output.routedToAgentSlug = routerResult.routedToAgentSlug;
@@ -10450,8 +10499,8 @@ function checkModelConfig(resources) {
     hint: "Check agent model config - temperature should be 0-2"
   };
 }
-async function checkStuckThreads(environment) {
-  const threads = await withAuthRetry2(() => listThreads({ environment, limit: 100 }));
+async function checkStuckThreads(environment, organizationId) {
+  const threads = await withAuthRetry2(() => listThreads({ environment, limit: 100, organizationId }));
   const issues = [];
   const now = Date.now();
   const fiveMinutes = 5 * 60 * 1000;
@@ -10480,8 +10529,8 @@ async function checkStuckThreads(environment) {
     hint: "Run `struere threads archive <id>` to archive stuck threads"
   };
 }
-async function checkTriggerHealth(environment) {
-  const executions = await withAuthRetry2(() => listTriggerExecutions({ environment, limit: 100 }));
+async function checkTriggerHealth(environment, organizationId) {
+  const executions = await withAuthRetry2(() => listTriggerExecutions({ environment, limit: 100, organizationId }));
   if (executions.length === 0) {
     return {
       id: "trigger-health",
@@ -10528,8 +10577,8 @@ async function checkTriggerHealth(environment) {
     hint: "Run `struere triggers logs <slug>` to investigate failures"
   };
 }
-async function checkSyncDrift(resources, environment) {
-  const { state, error } = await withAuthRetry2(() => getSyncState(undefined, environment));
+async function checkSyncDrift(resources, environment, organizationId) {
+  const { state, error } = await withAuthRetry2(() => getSyncState(organizationId, environment));
   if (error || !state) {
     return {
       id: "sync-drift",
@@ -10638,6 +10687,8 @@ var doctorCommand = new Command25("doctor").description("Run diagnostic checks o
   const spinner = opts.json ? null : ora20();
   const cwd = process.cwd();
   const environment = opts.env;
+  const project = loadProject(cwd);
+  const organizationId = project?.organization.id;
   try {
     spinner?.start("Loading resources...");
     const resources = await loadAllResources(cwd);
@@ -10648,9 +10699,9 @@ var doctorCommand = new Command25("doctor").description("Run diagnostic checks o
       runCheck(() => checkTemplateApprovals(resources)),
       runCheck(() => checkEntityTypeReferences(resources)),
       runCheck(() => checkModelConfig(resources)),
-      runCheck(() => checkStuckThreads(environment)),
-      runCheck(() => checkTriggerHealth(environment)),
-      runCheck(() => checkSyncDrift(resources, environment))
+      runCheck(() => checkStuckThreads(environment, organizationId)),
+      runCheck(() => checkTriggerHealth(environment, organizationId)),
+      runCheck(() => checkSyncDrift(resources, environment, organizationId))
     ]);
     spinner?.stop();
     const checks = results.map((r) => r.status === "fulfilled" ? r.value : { id: "unknown", label: "Unknown", status: "warn", message: `Check failed: ${r.reason}` });
@@ -10704,10 +10755,332 @@ var doctorCommand = new Command25("doctor").description("Run diagnostic checks o
     process.exit(1);
   }
 });
+
+// src/cli/commands/keys.ts
+init_credentials();
+import { Command as Command26 } from "commander";
+import chalk29 from "chalk";
+import ora21 from "ora";
+import { input as input3, confirm as confirm8 } from "@inquirer/prompts";
+init_convex();
+
+// src/cli/utils/apiKeys.ts
+init_credentials();
+init_config();
+function getToken5() {
+  const credentials = loadCredentials();
+  const apiKey = getApiKey();
+  const token = apiKey || credentials?.token;
+  if (!token)
+    throw new Error("Not authenticated");
+  return token;
+}
+async function convexQuery8(path, args) {
+  const token = getToken5();
+  const response = await fetch(`${CONVEX_URL}/api/query`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${token}`
+    },
+    body: JSON.stringify({ path, args })
+  });
+  const text = await response.text();
+  let json;
+  try {
+    json = JSON.parse(text);
+  } catch {
+    throw new Error(text || `HTTP ${response.status}`);
+  }
+  if (!response.ok) {
+    throw new Error(json.errorData?.message || json.errorMessage || text);
+  }
+  if (json.status === "error") {
+    throw new Error(json.errorMessage || "Unknown error from Convex");
+  }
+  return json.value;
+}
+async function convexMutation6(path, args) {
+  const token = getToken5();
+  const response = await fetch(`${CONVEX_URL}/api/mutation`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${token}`
+    },
+    body: JSON.stringify({ path, args })
+  });
+  const text = await response.text();
+  let json;
+  try {
+    json = JSON.parse(text);
+  } catch {
+    throw new Error(text || `HTTP ${response.status}`);
+  }
+  if (!response.ok) {
+    throw new Error(json.errorData?.message || json.errorMessage || text);
+  }
+  if (json.status === "error") {
+    throw new Error(json.errorMessage || "Unknown error from Convex");
+  }
+  return json.value;
+}
+async function listApiKeys() {
+  return convexQuery8("apiKeys:list", {});
+}
+async function createApiKey(args) {
+  return convexMutation6("apiKeys:create", {
+    name: args.name,
+    environment: args.environment,
+    permissions: args.permissions ?? ["*"]
+  });
+}
+async function removeApiKey(id) {
+  return convexMutation6("apiKeys:remove", { id });
+}
+
+// src/cli/commands/keys.ts
+async function withKeyAuthRetry(fn) {
+  try {
+    return await fn();
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("Unauthenticated") || msg.includes("OIDC") || msg.includes("token") || msg.includes("expired")) {
+      const refreshed = await refreshToken();
+      if (!refreshed)
+        throw err;
+      return fn();
+    }
+    throw err;
+  }
+}
+async function ensureAuth9() {
+  const cwd = process.cwd();
+  const nonInteractive = !isInteractive();
+  if (!hasProject(cwd)) {
+    if (nonInteractive) {
+      console.error(chalk29.red("No struere.json found. Run struere init first."));
+      process.exit(1);
+    }
+    console.log(chalk29.yellow("No struere.json found - initializing project..."));
+    console.log();
+    const success = await runInit(cwd);
+    if (!success) {
+      process.exit(1);
+    }
+    console.log();
+  }
+  let credentials = loadCredentials();
+  const apiKey = getApiKey();
+  if (!credentials && !apiKey) {
+    if (nonInteractive) {
+      console.error(chalk29.red("Not authenticated. Set STRUERE_API_KEY or run struere login."));
+      process.exit(1);
+    }
+    console.log(chalk29.yellow("Not logged in - authenticating..."));
+    console.log();
+    credentials = await performLogin();
+    if (!credentials) {
+      console.log(chalk29.red("Authentication failed"));
+      process.exit(1);
+    }
+    console.log();
+  }
+  return true;
+}
+function relativeTime4(ts) {
+  const diff = Date.now() - ts;
+  const seconds = Math.floor(diff / 1000);
+  if (seconds < 60)
+    return `${seconds}s ago`;
+  const minutes = Math.floor(seconds / 60);
+  if (minutes < 60)
+    return `${minutes}m ago`;
+  const hours = Math.floor(minutes / 60);
+  if (hours < 24)
+    return `${hours}h ago`;
+  const days = Math.floor(hours / 24);
+  return `${days}d ago`;
+}
+function maskedPrefix(prefix) {
+  return `${prefix}****`;
+}
+function isValidEnvironment(value) {
+  return value === "development" || value === "production" || value === "eval";
+}
+var keysCommand = new Command26("keys").description("Manage API keys");
+keysCommand.command("list", { isDefault: true }).description("List API keys").option("--env <environment>", "Filter by environment (development|production|eval)").option("--json", "Output raw JSON").action(async (opts) => {
+  await ensureAuth9();
+  const spinner = opts.json ? null : ora21();
+  try {
+    spinner?.start("Fetching API keys");
+    let keys = await withKeyAuthRetry(() => listApiKeys());
+    if (opts.env) {
+      if (!isValidEnvironment(opts.env)) {
+        spinner?.fail(`Invalid environment: ${opts.env}`);
+        process.exit(1);
+      }
+      keys = keys.filter((k) => k.environment === opts.env);
+    }
+    spinner?.succeed(`Found ${keys.length} API key${keys.length === 1 ? "" : "s"}${opts.env ? ` (${opts.env})` : ""}`);
+    if (opts.json) {
+      console.log(JSON.stringify(keys, null, 2));
+      return;
+    }
+    console.log();
+    renderTable([
+      { key: "id", label: "ID", width: 14 },
+      { key: "name", label: "Name", width: 24 },
+      { key: "prefix", label: "Prefix", width: 22 },
+      { key: "environment", label: "Env", width: 12 },
+      { key: "created", label: "Created", width: 12 },
+      { key: "lastUsed", label: "Last Used", width: 12 }
+    ], keys.map((k) => ({
+      id: k.id.slice(-12),
+      name: k.name,
+      prefix: maskedPrefix(k.keyPrefix),
+      environment: k.environment,
+      created: relativeTime4(k.createdAt),
+      lastUsed: k.lastUsedAt ? relativeTime4(k.lastUsedAt) : chalk29.gray("-")
+    })));
+    console.log();
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    spinner?.fail("Failed to fetch API keys");
+    if (opts.json) {
+      console.log(JSON.stringify({ success: false, error: message }));
+    } else {
+      console.log(chalk29.red("Error:"), message);
+    }
+    process.exit(1);
+  }
+});
+keysCommand.command("create").description("Create a new API key").option("--name <name>", "Key name").option("--env <environment>", "Environment (development|production|eval)", "development").option("--json", "Output raw JSON").option("--confirm", "Skip production confirmation").action(async (opts) => {
+  await ensureAuth9();
+  if (!isValidEnvironment(opts.env)) {
+    const message = `Invalid environment: ${opts.env}`;
+    if (opts.json) {
+      console.log(JSON.stringify({ success: false, error: message }));
+    } else {
+      console.log(chalk29.red("Error:"), message);
+    }
+    process.exit(1);
+  }
+  const environment = opts.env;
+  let name = opts.name;
+  if (!name || !name.trim()) {
+    if (!isInteractive()) {
+      const message = "--name is required in non-interactive mode";
+      if (opts.json) {
+        console.log(JSON.stringify({ success: false, error: message }));
+      } else {
+        console.log(chalk29.red("Error:"), message);
+      }
+      process.exit(1);
+    }
+    name = await input3({
+      message: "API key name:",
+      validate: (v) => v.trim().length > 0 || "Name is required"
+    });
+  }
+  name = name.trim();
+  if (environment === "production" && !opts.confirm && !opts.json && isInteractive()) {
+    const ok = await confirm8({
+      message: chalk29.yellow("Create API key in PRODUCTION environment?"),
+      default: false
+    });
+    if (!ok) {
+      console.log(chalk29.gray("Cancelled"));
+      process.exit(0);
+    }
+  }
+  const spinner = opts.json ? null : ora21();
+  try {
+    spinner?.start("Creating API key");
+    const result = await withKeyAuthRetry(() => createApiKey({ name, environment }));
+    spinner?.succeed(chalk29.green(`Created API key ${chalk29.cyan(result.name)}`));
+    if (opts.json) {
+      console.log(JSON.stringify({
+        id: result.id,
+        name: result.name,
+        prefix: result.keyPrefix,
+        key: result.key,
+        environment,
+        createdAt: result.createdAt
+      }, null, 2));
+      return;
+    }
+    console.log();
+    console.log(chalk29.bold("  " + chalk29.yellow("Save this key now \u2014 it will not be shown again.")));
+    console.log();
+    console.log(`  ${chalk29.gray("Key:")}         ${chalk29.cyan(result.key)}`);
+    console.log(`  ${chalk29.gray("Name:")}        ${result.name}`);
+    console.log(`  ${chalk29.gray("Prefix:")}      ${result.keyPrefix}`);
+    console.log(`  ${chalk29.gray("Environment:")} ${environment}`);
+    console.log(`  ${chalk29.gray("ID:")}          ${result.id}`);
+    console.log();
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    spinner?.fail("Failed to create API key");
+    if (opts.json) {
+      console.log(JSON.stringify({ success: false, error: message }));
+    } else {
+      console.log(chalk29.red("Error:"), message);
+    }
+    process.exit(1);
+  }
+});
+keysCommand.command("revoke <id-or-prefix>").description("Revoke an API key (delete)").option("--confirm", "Skip confirmation prompt").option("--json", "Output raw JSON").action(async (idOrPrefix, opts) => {
+  await ensureAuth9();
+  const spinner = opts.json ? null : ora21();
+  try {
+    spinner?.start("Looking up API key");
+    const keys = await withKeyAuthRetry(() => listApiKeys());
+    const target = keys.find((k) => k.id === idOrPrefix) ?? keys.find((k) => k.id.endsWith(idOrPrefix)) ?? keys.find((k) => k.keyPrefix === idOrPrefix) ?? keys.find((k) => k.keyPrefix.startsWith(idOrPrefix));
+    if (!target) {
+      spinner?.fail(`API key not found: ${idOrPrefix}`);
+      if (opts.json) {
+        console.log(JSON.stringify({ success: false, error: "API key not found" }));
+      }
+      process.exit(1);
+    }
+    spinner?.succeed(`Found ${chalk29.cyan(target.name)} (${maskedPrefix(target.keyPrefix)}, ${target.environment})`);
+    if (!opts.confirm && !opts.json) {
+      if (!isInteractive()) {
+        console.log(chalk29.red("Error:"), "Use --confirm to revoke in non-interactive mode");
+        process.exit(1);
+      }
+      const ok = await confirm8({
+        message: `Revoke this key? This cannot be undone.`,
+        default: false
+      });
+      if (!ok) {
+        console.log(chalk29.gray("Cancelled"));
+        process.exit(0);
+      }
+    }
+    const revokeSpinner = opts.json ? null : ora21();
+    revokeSpinner?.start("Revoking API key");
+    await withKeyAuthRetry(() => removeApiKey(target.id));
+    revokeSpinner?.succeed(chalk29.green(`Revoked ${chalk29.cyan(target.name)}`));
+    if (opts.json) {
+      console.log(JSON.stringify({ success: true, id: target.id, name: target.name }));
+    }
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    spinner?.fail("Failed to revoke API key");
+    if (opts.json) {
+      console.log(JSON.stringify({ success: false, error: message }));
+    } else {
+      console.log(chalk29.red("Error:"), message);
+    }
+    process.exit(1);
+  }
+});
 // package.json
 var package_default = {
   name: "struere",
-  version: "0.14.2",
+  version: "0.14.4",
   description: "Build, test, and deploy AI agents",
   keywords: [
     "ai",
@@ -10742,13 +11115,17 @@ var package_default = {
     ".": {
       import: "./dist/index.js",
       types: "./dist/index.d.ts"
+    },
+    "./client": {
+      import: "./dist/client/index.js",
+      types: "./dist/client/index.d.ts"
     }
   },
   files: [
     "dist"
   ],
   scripts: {
-    build: "bun build ./src/cli/index.ts --outdir ./dist/cli --target bun --external commander --external chalk --external ora --external chokidar --external yaml --external @inquirer/prompts && bun build ./src/index.ts --outdir ./dist --target node && bun build ./src/bin/struere.ts --outdir ./dist/bin --target bun --external commander --external chalk --external ora --external chokidar --external yaml --external @inquirer/prompts && tsc --emitDeclarationOnly && chmod +x ./dist/bin/struere.js",
+    build: "bun build ./src/cli/index.ts --outdir ./dist/cli --target bun --external commander --external chalk --external ora --external chokidar --external yaml --external @inquirer/prompts && bun build ./src/index.ts --outdir ./dist --target node && bun build ./src/client/index.ts --outdir ./dist/client --target browser && bun build ./src/bin/struere.ts --outdir ./dist/bin --target bun --external commander --external chalk --external ora --external chokidar --external yaml --external @inquirer/prompts && tsc --emitDeclarationOnly && chmod +x ./dist/bin/struere.js",
     dev: "tsc --watch",
     test: "bun test",
     prepublishOnly: "bun run build"
@@ -10832,4 +11209,5 @@ program.addCommand(chatCommand);
 program.addCommand(whatsappCommand);
 program.addCommand(diffCommand);
 program.addCommand(doctorCommand);
+program.addCommand(keysCommand);
 program.parse();