@keystrokehq/cli 0.0.0-staging-20260714051854

package/LICENSE

@@ -0,0 +1,13 @@
+Copyright 2026 Sprint Labs, Inc. All rights reserved.
+
+This private canonical monorepo contains materials under different terms:
+
+- The downstream public projection described by `oss/` is made available under
+  the Elastic License 2.0 in `oss/LICENSE`.
+- Code and materials in paths containing an exact `cloud` segment are
+  proprietary and governed by the nearest applicable proprietary license.
+
+Access to this private repository does not itself grant a license to use, copy,
+modify, distribute, make available, or create derivative works from its
+contents. Sprint Labs employees, contractors, customers, and partners receive
+rights only under their applicable written agreements.

package/README.md

@@ -0,0 +1,272 @@
+# keystroke CLI
+
+The primary interface for working with keystroke — locally and against a remote deployment.
+
+**Local** commands hit your local platform API (`PUBLIC_PLATFORM_URL` in the project `.env`, or the dev session URL while `keystroke dev` is running). **Cloud** commands hit the **keystroke platform** control plane (`platformUrl`), which manages and routes to deployed keystroke servers per project.
+
+Distributed via npm as the `keystroke` binary. Staging pre-releases use the opt-in `@staging` dist-tag.
+
+## Philosophy
+
+Keep the CLI small and boring.
+
+- **Few dependencies** — only add a package when it clearly earns its place
+- **Plain output** — no TUI, spinners, or heavy UX frameworks unless we truly need them
+- **Agent-first** — commands should be predictable, scriptable, and easy for AI agents to invoke
+- **Split concerns** — non-secret config in one place, secrets in the OS keychain
+
+Right now the CLI exposes `init`, `build`, `dev`, `start`, `lint`, `typecheck`, `test`, `deploy`, `pull`, `update`, `health`, `auth`, `--help`, and `--version`.
+
+## Command grammar
+
+Stripe-style: plural REST collection, then a verb, then the primary slug. New commands **must** follow this shape.
+
+```text
+keystroke <collection> <verb> [<slug>] [<sub-id>] [--flags]
+keystroke <collection> <sub-collection> <verb> [<slug>] [<sub-id>] [--flags]
+keystroke <verb>                                    # lifecycle only (init, build, dev, deploy, update, …)
+```
+
+Rules:
+
+- **Collections are plural** and match the HTTP API / SDK / `src/` dirs — `workflows`, `agents`, `triggers`, `projects`, `apps`, `channels`, `credentials`. Never singular.
+- **The primary resource is positional**, not a flag. The collection already names the type, so `workflows run greeting` — never `workflows run --workflow greeting`.
+- **Nested resources are sub-collections before the verb** — `workflows runs list <slug>`, `apps actions get <app> <tool>`. Not flat (`workflows-runs-list`) and not verb-first (`workflows list runs`).
+- **A second positional is the child id** — `workflows runs cancel <workflow> <run-id>`, `agents sessions cancel <agent> <session-id>`.
+- **Flags are for two things only:**
+  - **Payload / options** — `--input`, `--message`, `--include`, `--limit`.
+  - **Scope or a *different* resource type** — global `--project` / `--local`; cross-references like `triggers disable <trigger> --workflow <slug>` where the positional is the trigger and the flag narrows to one attachment. Do not add type-named flags (`--workflow`, `--agent`) to that type's own commands.
+- **Verbs are consistent across collections** — `list`, `get`, `create`, `update`, `delete`, `run`/`execute`/`prompt`. Prefer `get` over `show`, `create` over `set`.
+
+Example command tree:
+
+```text
+keystroke workflows run <slug> --input '{...}'
+keystroke workflows runs list|get|cancel <slug> [<run-id>]
+keystroke agents prompt <slug> --message "…"
+keystroke agents sessions list|get|cancel <slug> [<session-id>]
+keystroke triggers invoke <slug> [--input '{…}'] [--workflow <s> | --agent <s>]
+keystroke triggers disable|enable <slug> [--workflow <s> | --agent <s>]
+keystroke triggers runs list|get <slug> [--workflow <s> | --agent <s>]
+keystroke apps actions list|get <app> [<tool>]
+keystroke apps execute <app> <tool> --input '{...}'
+keystroke credentials create|get|rotate|delete <key>
+```
+
+### `auth`
+
+Authenticate with Keystroke via Better Auth device flow. Config lives in `~/.keystroke`; bearer tokens live in the OS keychain.
+
+```bash
+keystroke auth login
+keystroke auth login --web-url http://localhost:3000
+keystroke auth login --web-url https://keystroke.ai --platform-url https://api.keystroke.ai
+keystroke auth status
+keystroke auth logout
+```
+
+| Setting       | Default                    | Purpose                                                          |
+| ------------- | -------------------------- | ---------------------------------------------------------------- |
+| `webUrl`      | `https://keystroke.ai` | Web dashboard; device login and session checks                   |
+| `platformUrl` | `https://api.keystroke.ai` | Platform API (direct; used by CLI platform commands)             |
+
+`auth login` persists both `webUrl` and `platformUrl`. Omit `--web-url` to always reset to production defaults (`https://keystroke.ai` / `https://api.keystroke.ai`), even if a previous login pointed at localhost. Local dev: `--web-url http://localhost:3000` (platform URL resolves to `http://localhost:3002`).
+
+Existing commands do not require auth yet. Use `resolveCliAuth()` when adding protected commands.
+
+### Platform commands
+
+Org-scoped platform commands require `keystroke auth login` plus an organization target: pass `--organization <slug>` or set `organization` in `keystroke.config.ts` (via `keystroke projects link --project <slug>`). Project-scoped commands also accept `--project <slug>` or the `project` field in `keystroke.config.ts`.
+
+```bash
+keystroke org update --name "Acme Inc"
+keystroke org members list
+keystroke org members invite --email ada@example.com --role admin
+keystroke org members role <userId> --role builder
+keystroke org members remove <userId>
+keystroke org leave --yes
+keystroke api-key list
+keystroke api-key create --name "CI"
+keystroke api-key revoke <apiKeyId> --yes
+keystroke --project <slug> project members list
+keystroke --project <slug> project members invite --email ada@example.com --role admin
+keystroke --project <slug> project members role <userId> --role builder
+keystroke --project <slug> project members remove <userId>
+keystroke --project <slug> project members leave --yes
+keystroke --project <slug> project settings get
+keystroke --project <slug> project settings update --description "Notes" --default-role builder --invite-permission all
+```
+
+`organization` is an alias for `org`. List/get-style commands print JSON; mutations set a non-zero exit code on failure.
+
+### `trigger`
+
+List triggers, resolve webhook URLs, and manually invoke after deploy (requires `keystroke auth login`):
+
+```bash
+keystroke triggers list
+keystroke triggers get incoming-message
+keystroke triggers url incoming-message
+keystroke triggers invoke inbox-sync
+keystroke triggers invoke signup --input '{"name":"Ada","email":"ada@example.com"}'
+```
+
+`url` prints a single line suitable for piping into curl or pasting into external webhook config. `invoke` is platform-only (not `--local`): webhook invokes take `--input`; cron and poll take none (cron always uses its static payload). Narrow with `--workflow` / `--agent` when a trigger has multiple attachments.
+
+### `init`
+
+Scaffold a new project from the bundled `hello-world` template — definitions only under `src/`, no `server.ts`.
+
+```bash
+# Interactive (TTY)
+keystroke init
+
+# Headless (scripts, AI agents)
+keystroke init my-app --yes
+keystroke init --name my-app --dir ./my-app --yes --skip-install
+```
+
+| Flag             | Purpose                               |
+| ---------------- | ------------------------------------- |
+| `--name`         | Package name (kebab-case)             |
+| `--template`     | Template name (default `hello-world`) |
+| `-y, --yes`      | Skip prompts                          |
+| `--skip-install` | Don't run package manager install     |
+| `--pm`           | Force npm, pnpm, yarn, or bun         |
+
+Scaffolded projects include a committed `tsconfig.json` and `package.json` scripts for `lint`, `typecheck`, and `test` (invoking the globally installed `keystroke` binary). Lint config (oxlint) ships in the CLI bundle; projects declare `@types/node`, TypeScript, and vitest in devDependencies — not `@keystrokehq/cli`.
+
+### `lint`
+
+Lint `src/` with bundled oxlint. Config lives in the CLI bundle (`dist/configs/oxlintrc.json`), not in the project.
+
+```bash
+keystroke lint
+keystroke lint --dir ./my-app
+```
+
+### `typecheck`
+
+Type-check with bundled TypeScript using the project's `tsconfig.json`.
+
+```bash
+keystroke typecheck
+keystroke typecheck --dir ./my-app
+```
+
+### `test`
+
+Run tests with bundled vitest. Config lives in the CLI bundle (`dist/configs/vitest.config.mjs`).
+
+```bash
+keystroke test
+keystroke test --project unit
+keystroke test --project integration
+```
+
+### `build`
+
+Build the project to `dist/` using the framework bootstrap (no user `server.ts` required).
+
+```bash
+keystroke build
+keystroke build --dir ./my-app
+```
+
+### `deploy`
+
+Lint, typecheck, build, upload, and promote a project artifact on the platform. Requires `keystroke auth login` and a linked project (or `--project <slug>`).
+
+```bash
+keystroke deploy
+keystroke deploy --filter workflows/ping --filter agents/world
+```
+
+`--filter` matches exact build entry keys (`agents/foo`, `workflows/bar`, …). Repeat the flag for multiple modules. Targeted deploy downloads the active artifact, overlays rebuilt module files, merges `route-manifest.json`, and uploads a full tarball — the first deploy for a project must be a full deploy without `--filter`. Config and bundled assets are carried forward from the active artifact; skill/asset drift is not validated in v1.
+
+### `dev`
+
+Watch `src/`, rebuild `dist/` on change, and restart the API. **Not true hot reload** — each change reruns tsdown and boots a fresh server process so discovery picks up new agents/workflows/triggers.
+
+```bash
+keystroke dev
+keystroke dev --port 3002
+```
+
+Same flags as `start`.
+
+### `start`
+
+Build the API incrementally and start the server. Re-running without changes reuses rolldown cache.
+
+Database defaults to SQLite at `./data/dev.db` unless `DATABASE_URL` points at Postgres.
+
+```bash
+keystroke start
+keystroke start --port 3002
+```
+
+| Flag     | Purpose                 |
+| -------- | ----------------------- |
+| `--dir`  | Project root            |
+| `--port` | API port (default 3002) |
+
+Use `keystroke build` for a clean API rebuild.
+
+### Portable local install
+
+Bundle a self-contained CLI you can run outside the monorepo:
+
+```bash
+pnpm cli:pack
+# installs `keystroke` to ~/.local/bin (ensure it is on PATH)
+keystroke --help
+```
+
+Custom output directory: `node apps/cli/scripts/pack.mjs /path/to/install`.
+
+## Dependencies
+
+| Package                                                            | Role                                                                   |
+| ------------------------------------------------------------------ | ---------------------------------------------------------------------- |
+| [`commander`](https://github.com/tj/commander.js)                  | Argument parsing, `--help`, `--version`, subcommands                   |
+| [`conf`](https://github.com/sindresorhus/conf)                     | Persistent non-secret config (profiles, defaults, project prefs). MIT. |
+| [`@napi-rs/keyring`](https://github.com/Brooooooklyn/keyring-node) | API tokens and other secrets via the OS keychain. MIT.                 |
+
+`conf` stores `webUrl`, `platformUrl`, and other non-secrets under `~/.keystroke`. `@napi-rs/keyring` stores bearer tokens — macOS Keychain, Windows Credential Manager, or Secret Service on Linux — so tokens never sit in a plaintext config file.
+
+## Development
+
+```bash
+pnpm cli --help
+pnpm --filter @keystrokehq/cli dev
+pnpm --filter @keystrokehq/cli build
+pnpm --filter @keystrokehq/cli test
+```
+
+Build output goes to `dist/index.mjs` with a Node shebang for the `keystroke` bin.
+
+### `keystroke-dev` (contributor CLI)
+
+`apps/cli/bin/keystroke-dev` is a thin bash wrapper that runs the CLI source tree directly through tsx — no `pnpm --filter ... build` between edits. It sets `KEYSTROKE_DEV=1` and `NODE_OPTIONS=--conditions=development`, so workspace packages resolve to their `src/*.ts` instead of `dist/*.mjs`.
+
+This wrapper is **contributor-only**. It is not in `package.json`'s `bin` map and does not ship to npm — `keystroke-dev` and the published `keystroke` never collide.
+
+After cloning + `pnpm install`:
+
+```bash
+pnpm --filter @keystrokehq/cli link-dev
+# symlinks apps/cli/bin/keystroke-dev → ~/.local/bin/keystroke-dev
+# (override the install location with KEYSTROKE_DEV_BIN_DIR)
+
+keystroke-dev --help
+keystroke-dev start --dir ~/my-project
+```
+
+Resolvers prefer source when it exists. Source paths only exist in the monorepo, so the published CLI still uses bundled assets — there's no fork in behavior, just a fallback chain.
+
+To exercise the bundled flow end-to-end, use `pnpm cli:pack` (builds, packs, and installs `keystroke-dev` from `dist/`).
+
+## Distribution
+
+Published to npm as a Node CLI. Native keyring binaries ship via `@napi-rs/keyring` optional platform packages — no compile step on install for supported platforms.

package/dist/alias-RTYYYW3D-CLFgrowj.mjs

@@ -0,0 +1,98 @@
+#!/usr/bin/env node
+import { r as s, t as o$1 } from "./chunk-QAYAQNCG-Bl0Kbd53.mjs";
+import "./chunk-BZUGFHVS-CPWRFwK8.mjs";
+import { createRequire } from "node:module";
+//#region ../../node_modules/.pnpm/just-bash@3.0.1/node_modules/just-bash/dist/bundle/chunks/chunk-FHC24QSK.js
+createRequire(import.meta.url);
+var d = {
+	name: "alias",
+	summary: "define or display aliases",
+	usage: "alias [name[=value] ...]",
+	options: ["    --help display this help and exit"]
+}, o = "BASH_ALIAS_", m = {
+	name: "alias",
+	async execute(e, a) {
+		if (o$1(e)) return s(d);
+		if (e.length === 0) {
+			let s = "";
+			for (let [i, t] of a.env) if (i.startsWith(o)) {
+				let n = i.slice(o.length);
+				s += `alias ${n}='${t}'
+`;
+			}
+			return {
+				stdout: s,
+				stderr: "",
+				exitCode: 0
+			};
+		}
+		let l = e[0] === "--" ? e.slice(1) : e;
+		for (let s of l) {
+			let i = s.indexOf("=");
+			if (i === -1) {
+				let t = o + s;
+				return a.env.get(t) ? {
+					stdout: `alias ${s}='${a.env.get(t)}'
+`,
+					stderr: "",
+					exitCode: 0
+				} : {
+					stdout: "",
+					stderr: `alias: ${s}: not found
+`,
+					exitCode: 1
+				};
+			} else {
+				let t = s.slice(0, i), n = s.slice(i + 1);
+				(n.startsWith("'") && n.endsWith("'") || n.startsWith("\"") && n.endsWith("\"")) && (n = n.slice(1, -1)), a.env.set(o + t, n);
+			}
+		}
+		return {
+			stdout: "",
+			stderr: "",
+			exitCode: 0
+		};
+	}
+}, c = {
+	name: "unalias",
+	async execute(e, a) {
+		if (o$1(e)) return s({
+			name: "unalias",
+			summary: "remove alias definitions",
+			usage: "unalias name [name ...]",
+			options: ["-a      remove all aliases", "    --help display this help and exit"]
+		});
+		if (e.length === 0) return {
+			stdout: "",
+			stderr: `unalias: usage: unalias [-a] name [name ...]
+`,
+			exitCode: 1
+		};
+		if (e[0] === "-a") {
+			for (let t of a.env.keys()) t.startsWith(o) && a.env.delete(t);
+			return {
+				stdout: "",
+				stderr: "",
+				exitCode: 0
+			};
+		}
+		let l = e[0] === "--" ? e.slice(1) : e, s$1 = !1, i = "";
+		for (let t of l) {
+			let n = o + t;
+			a.env.get(n) ? a.env.delete(n) : (i += `unalias: ${t}: not found
+`, s$1 = !0);
+		}
+		return {
+			stdout: "",
+			stderr: i,
+			exitCode: s$1 ? 1 : 0
+		};
+	}
+};
+//#endregion
+//#region ../../node_modules/.pnpm/just-bash@3.0.1/node_modules/just-bash/dist/bundle/chunks/alias-RTYYYW3D.js
+createRequire(import.meta.url);
+//#endregion
+export { m as aliasCommand, c as unaliasCommand };
+
+//# sourceMappingURL=alias-RTYYYW3D-CLFgrowj.mjs.map

package/dist/alias-RTYYYW3D-CLFgrowj.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"alias-RTYYYW3D-CLFgrowj.mjs","names":["u","r","s"],"sources":["../../../node_modules/.pnpm/just-bash@3.0.1/node_modules/just-bash/dist/bundle/chunks/chunk-FHC24QSK.js","../../../node_modules/.pnpm/just-bash@3.0.1/node_modules/just-bash/dist/bundle/chunks/alias-RTYYYW3D.js"],"sourcesContent":["import{createRequire} from\"node:module\";const require=createRequire(import.meta.url);\nimport{a as r,b as u}from\"./chunk-QAYAQNCG.js\";var d={name:\"alias\",summary:\"define or display aliases\",usage:\"alias [name[=value] ...]\",options:[\"    --help display this help and exit\"]},o=\"BASH_ALIAS_\",m={name:\"alias\",async execute(e,a){if(u(e))return r(d);if(e.length===0){let s=\"\";for(let[i,t]of a.env)if(i.startsWith(o)){let n=i.slice(o.length);s+=`alias ${n}='${t}'\n`}return{stdout:s,stderr:\"\",exitCode:0}}let l=e[0]===\"--\"?e.slice(1):e;for(let s of l){let i=s.indexOf(\"=\");if(i===-1){let t=o+s;return a.env.get(t)?{stdout:`alias ${s}='${a.env.get(t)}'\n`,stderr:\"\",exitCode:0}:{stdout:\"\",stderr:`alias: ${s}: not found\n`,exitCode:1}}else{let t=s.slice(0,i),n=s.slice(i+1);(n.startsWith(\"'\")&&n.endsWith(\"'\")||n.startsWith('\"')&&n.endsWith('\"'))&&(n=n.slice(1,-1)),a.env.set(o+t,n)}}return{stdout:\"\",stderr:\"\",exitCode:0}}},c={name:\"unalias\",async execute(e,a){if(u(e))return r({name:\"unalias\",summary:\"remove alias definitions\",usage:\"unalias name [name ...]\",options:[\"-a      remove all aliases\",\"    --help display this help and exit\"]});if(e.length===0)return{stdout:\"\",stderr:`unalias: usage: unalias [-a] name [name ...]\n`,exitCode:1};if(e[0]===\"-a\"){for(let t of a.env.keys())t.startsWith(o)&&a.env.delete(t);return{stdout:\"\",stderr:\"\",exitCode:0}}let l=e[0]===\"--\"?e.slice(1):e,s=!1,i=\"\";for(let t of l){let n=o+t;a.env.get(n)?a.env.delete(n):(i+=`unalias: ${t}: not found\n`,s=!0)}return{stdout:\"\",stderr:i,exitCode:s?1:0}}},p={name:\"alias\",flags:[]},h={name:\"unalias\",flags:[{flag:\"-a\",type:\"boolean\"}]};export{m as a,c as b,p as c,h as d};\n","import{createRequire} from\"node:module\";const require=createRequire(import.meta.url);\nimport{a,b,c,d}from\"./chunk-FHC24QSK.js\";import\"./chunk-QAYAQNCG.js\";import\"./chunk-BZUGFHVS.js\";export{a as aliasCommand,c as flagsForFuzzing,b as unaliasCommand,d as unaliasFlagsForFuzzing};\n"],"x_google_ignoreList":[0,1],"mappings":";;;;;AAAsD,cAAc,OAAO,KAAK,GAAG;AACpC,IAAI,IAAE;CAAC,MAAK;CAAQ,SAAQ;CAA4B,OAAM;CAA2B,SAAQ,CAAC,uCAAuC;AAAC,GAAE,IAAE,eAAc,IAAE;CAAC,MAAK;CAAQ,MAAM,QAAQ,GAAE,GAAE;EAAC,IAAGA,IAAE,CAAC,GAAE,OAAOC,EAAE,CAAC;EAAE,IAAG,EAAE,WAAS,GAAE;GAAC,IAAI,IAAE;GAAG,KAAI,IAAG,CAAC,GAAE,MAAK,EAAE,KAAI,IAAG,EAAE,WAAW,CAAC,GAAE;IAAC,IAAI,IAAE,EAAE,MAAM,EAAE,MAAM;IAAE,KAAG,SAAS,EAAE,IAAI,EAAE;;GAChX;GAAC,OAAM;IAAC,QAAO;IAAE,QAAO;IAAG,UAAS;GAAC;EAAC;EAAC,IAAI,IAAE,EAAE,OAAK,OAAK,EAAE,MAAM,CAAC,IAAE;EAAE,KAAI,IAAI,KAAK,GAAE;GAAC,IAAI,IAAE,EAAE,QAAQ,GAAG;GAAE,IAAG,MAAI,IAAG;IAAC,IAAI,IAAE,IAAE;IAAE,OAAO,EAAE,IAAI,IAAI,CAAC,IAAE;KAAC,QAAO,SAAS,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE;;KACvL,QAAO;KAAG,UAAS;IAAC,IAAE;KAAC,QAAO;KAAG,QAAO,UAAU,EAAE;;KACpD,UAAS;IAAC;GAAC,OAAK;IAAC,IAAI,IAAE,EAAE,MAAM,GAAE,CAAC,GAAE,IAAE,EAAE,MAAM,IAAE,CAAC;IAAE,CAAC,EAAE,WAAW,GAAG,KAAG,EAAE,SAAS,GAAG,KAAG,EAAE,WAAW,IAAG,KAAG,EAAE,SAAS,IAAG,OAAK,IAAE,EAAE,MAAM,GAAE,EAAE,IAAG,EAAE,IAAI,IAAI,IAAE,GAAE,CAAC;GAAC;EAAC;EAAC,OAAM;GAAC,QAAO;GAAG,QAAO;GAAG,UAAS;EAAC;CAAC;AAAC,GAAE,IAAE;CAAC,MAAK;CAAU,MAAM,QAAQ,GAAE,GAAE;EAAC,IAAGD,IAAE,CAAC,GAAE,OAAOC,EAAE;GAAC,MAAK;GAAU,SAAQ;GAA2B,OAAM;GAA0B,SAAQ,CAAC,8BAA6B,uCAAuC;EAAC,CAAC;EAAE,IAAG,EAAE,WAAS,GAAE,OAAM;GAAC,QAAO;GAAG,QAAO;;GAC5c,UAAS;EAAC;EAAE,IAAG,EAAE,OAAK,MAAK;GAAC,KAAI,IAAI,KAAK,EAAE,IAAI,KAAK,GAAE,EAAE,WAAW,CAAC,KAAG,EAAE,IAAI,OAAO,CAAC;GAAE,OAAM;IAAC,QAAO;IAAG,QAAO;IAAG,UAAS;GAAC;EAAC;EAAC,IAAI,IAAE,EAAE,OAAK,OAAK,EAAE,MAAM,CAAC,IAAE,GAAEC,MAAE,CAAC,GAAE,IAAE;EAAG,KAAI,IAAI,KAAK,GAAE;GAAC,IAAI,IAAE,IAAE;GAAE,EAAE,IAAI,IAAI,CAAC,IAAE,EAAE,IAAI,OAAO,CAAC,KAAG,KAAG,YAAY,EAAE;GAChP,MAAE,CAAC;EAAE;EAAC,OAAM;GAAC,QAAO;GAAG,QAAO;GAAE,UAASA,MAAE,IAAE;EAAC;CAAC;AAAC;;;ACNI,cAAc,OAAO,KAAK,GAAG"}