@keystrokehq/cli 0.0.1

package/dist/layout-CbMtQ2tm.mjs

@@ -0,0 +1,67 @@
+#!/usr/bin/env node
+
+import path from "node:path";
+//#region ../../packages/project-config/src/layout.ts
+/** Canonical name for the build output directory relative to the project root. */
+const BUILD_OUTPUT_DIR_NAME = "dist";
+const BUILD_DIR_NAME = "build";
+const MANIFEST_FILE_NAME = "manifest.json";
+const FLOW_FILE_NAME = "flow.json";
+const BUNDLE_FILE_NAME = "workflow.js";
+const SOURCE_MAP_FILE_NAME = "workflow.js.map";
+const METADATA_ROOT_DIR_NAME = "metadata";
+const METADATA_FILE_EXTENSION = ".json";
+const TRIGGERS_DIR_NAME = "triggers";
+/** Resolves the canonical build output directory for a project root (e.g. `<projectRoot>/dist`). */
+function resolveBuildOutputDir(projectRoot) {
+	return path.resolve(projectRoot, BUILD_OUTPUT_DIR_NAME);
+}
+/** Resolves all file paths (manifest, flow graph, bundle, source map) for a workflow's build artifacts. */
+function getWorkflowArtifactPaths(outputDir, workflowId) {
+	const workflowDir = path.join(outputDir, workflowId);
+	const buildDir = path.join(workflowDir, BUILD_DIR_NAME);
+	return {
+		workflowDir,
+		buildDir,
+		manifestPath: path.join(workflowDir, MANIFEST_FILE_NAME),
+		flowPath: path.join(workflowDir, FLOW_FILE_NAME),
+		bundlePath: path.join(buildDir, BUNDLE_FILE_NAME),
+		sourceMapPath: path.join(buildDir, SOURCE_MAP_FILE_NAME)
+	};
+}
+/** Resolves the manifest path for a workflow directory entry within a build output dir. */
+function getWorkflowManifestPath(outputDir, workflowDirName) {
+	return path.join(outputDir, workflowDirName, MANIFEST_FILE_NAME);
+}
+/** Lists all output file paths (relative) for a workflow artifact. Includes source map only if present. */
+function createArtifactOutputFiles(workflowId, hasSourceMap) {
+	const paths = getWorkflowArtifactPaths("", workflowId);
+	const outputFiles = [
+		path.relative(".", paths.manifestPath),
+		path.relative(".", paths.flowPath),
+		path.relative(".", paths.bundlePath)
+	];
+	if (hasSourceMap) outputFiles.push(path.relative(".", paths.sourceMapPath));
+	return outputFiles.sort((left, right) => left.localeCompare(right));
+}
+/** Resolves the root directory where per-file metadata JSON is written (outputDir/metadata). */
+function getMetadataRoot(outputDir) {
+	return path.join(outputDir, METADATA_ROOT_DIR_NAME);
+}
+/** Resolves the triggers subdirectory within a workflow's build directory. */
+function getTriggersDir(buildDir) {
+	return path.join(buildDir, TRIGGERS_DIR_NAME);
+}
+/** Maps a source file's relative path to its metadata output path (replaces .ts/.tsx/.mts with .json). */
+function createMetadataOutputFile(relativeFilePath) {
+	return path.join(METADATA_ROOT_DIR_NAME, replaceSourceExtension(relativeFilePath)).replaceAll("\\", "/");
+}
+/** Resolves the full filesystem path for a source file's metadata JSON output. */
+function getFileMetadataPath(outputDir, relativeFilePath) {
+	return path.join(outputDir, createMetadataOutputFile(relativeFilePath));
+}
+function replaceSourceExtension(relativeFilePath) {
+	return relativeFilePath.replace(/\.(ts|tsx|mts)$/u, METADATA_FILE_EXTENSION);
+}
+//#endregion
+export { MANIFEST_FILE_NAME as a, createArtifactOutputFiles as c, getMetadataRoot as d, getTriggersDir as f, resolveBuildOutputDir as h, FLOW_FILE_NAME as i, createMetadataOutputFile as l, getWorkflowManifestPath as m, BUILD_OUTPUT_DIR_NAME as n, METADATA_ROOT_DIR_NAME as o, getWorkflowArtifactPaths as p, BUNDLE_FILE_NAME as r, SOURCE_MAP_FILE_NAME as s, BUILD_DIR_NAME as t, getFileMetadataPath as u };

package/dist/list-enrichment-y-cwizLr.mjs

@@ -0,0 +1,189 @@
+#!/usr/bin/env node
+
+import { o as ANSI, s as style, t as ui } from "./keystroke.mjs";
+import { n as resolveCredentialValuesFromEnv, t as groupCredentialRequirements } from "./credentials-OfVHOtG3.mjs";
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { parse } from "dotenv";
+//#region src/commands/credentials/list/list-display.ts
+/** Visible width for layout; avoids unusably narrow or absurdly wide lines. */
+function getTerminalContentWidth() {
+	const cols = process.stdout.columns;
+	if (!cols || !Number.isFinite(cols)) return 78;
+	return Math.max(40, Math.min(cols - 2, 100));
+}
+function truncateWithEllipsis(text, maxLen) {
+	if (maxLen < 4) return text.slice(0, maxLen);
+	if (text.length <= maxLen) return text;
+	return `${text.slice(0, maxLen - 1)}…`;
+}
+function formatWhere(where) {
+	switch (where) {
+		case "both": return style("Both", ANSI.green);
+		case "cloud": return style("Cloud", ANSI.dim);
+		case "local": return style("Local", ANSI.green);
+		case "missing": return style("Missing", ANSI.dim);
+		default: return "—";
+	}
+}
+function shortCredProjectLabel(projectId) {
+	if (projectId === "—") return "—";
+	return projectId.length > 14 ? `${projectId.slice(0, 8)}…` : projectId;
+}
+function dimLabel(label, width = 10) {
+	return style(label.padEnd(width), ANSI.dim);
+}
+/**
+* Renders one credential per compact block (fits narrow terminals better than a wide table).
+*/
+function renderCredentialListBlocks(rows, formatCreated, footer) {
+	const w = getTerminalContentWidth();
+	const indent = "  ";
+	let first = true;
+	for (const r of rows) {
+		if (!first) ui.br();
+		first = false;
+		const parts = [style(r.credentialSetId, ANSI.bold), formatWhere(r.where)];
+		if (r.isDefault === true) parts.push(style("default", ANSI.green));
+		ui.text(parts.join(` ${style("·", ANSI.dim)} `));
+		if (r.name !== "—") ui.text(`${indent}${dimLabel("Name")}${r.name}`);
+		const proj = shortCredProjectLabel(r.projectId);
+		const scopeRest = proj === "—" ? "" : ` ${style("·", ANSI.dim)} Cred project ${proj}`;
+		ui.text(`${indent}${dimLabel("Scope")}${r.scope}${scopeRest}`);
+		const wfDisplay = truncateWithEllipsis(r.workflows.length === 0 ? "—" : r.workflows.join(", "), Math.max(12, w - 14));
+		ui.text(`${indent}${dimLabel("Workflows")}${wfDisplay}`);
+		if (r.createdAt) ui.text(`${indent}${dimLabel("Created")}${formatCreated(r.createdAt)}`);
+	}
+	if (footer) {
+		const { pagination, syntheticManifestCount } = footer;
+		const { total, limit, offset } = pagination;
+		if (total > 0) {
+			const start = offset + 1;
+			const end = Math.min(offset + limit, total);
+			ui.hint(`Server list: ${start}–${end} of ${total} credential set(s).`);
+		}
+		if (offset + limit < total) ui.hint(`Next page: --offset ${offset + limit} --limit ${limit}`);
+		if (syntheticManifestCount > 0) ui.hint(`Plus ${syntheticManifestCount} from local manifests with no matching credential set on the server.`);
+	}
+}
+//#endregion
+//#region src/commands/credentials/list/list-enrichment.ts
+/**
+* Maps manifest credential scope strings to API/server scope.
+* Default and user-provided flows resolve to user-scoped credential sets.
+*/
+function normalizeManifestScopeToServer(scope) {
+	if (scope === "organization") return "organization";
+	if (scope === "project") return "project";
+	return "user";
+}
+/** Stable key for a manifest group (credential set + server scope). */
+function manifestGroupKey(g) {
+	return `${g.credentialSetId}\0${normalizeManifestScopeToServer(g.scope)}`;
+}
+function manifestGroupMatchesServerRow(cs, g) {
+	if (cs.credentialSetId !== g.credentialSetId) return false;
+	return cs.scope === normalizeManifestScopeToServer(g.scope);
+}
+/**
+* Merges manifest groups across all workflows (deduped by integration + scope, keys unioned).
+* Order follows first-seen group order while iterating manifests.
+*/
+function collectMergedManifestGroups(manifests) {
+	const map = /* @__PURE__ */ new Map();
+	for (const { manifest } of manifests) for (const g of groupCredentialRequirements(manifest)) {
+		const k = manifestGroupKey(g);
+		const existing = map.get(k);
+		if (!existing) map.set(k, {
+			credentialSetId: g.credentialSetId,
+			scope: g.scope,
+			keys: [...g.keys]
+		});
+		else existing.keys = [...new Set([...existing.keys, ...g.keys])].sort();
+	}
+	return [...map.values()];
+}
+/** Workflows that reference each manifest group (integration + scope), sorted by workflow label. */
+function buildCredentialWorkflowConsumersByGroup(manifests) {
+	const map = /* @__PURE__ */ new Map();
+	for (const { manifest } of manifests) {
+		const label = manifest.name ?? manifest.id;
+		for (const g of groupCredentialRequirements(manifest)) {
+			const k = manifestGroupKey(g);
+			let set = map.get(k);
+			if (!set) {
+				set = /* @__PURE__ */ new Set();
+				map.set(k, set);
+			}
+			set.add(label);
+		}
+	}
+	return new Map([...map].map(([id, labels]) => [id, [...labels].sort()]));
+}
+/**
+* Loads `.env` from the workflow project root (if present). Does not mutate `process.env`.
+*/
+async function loadProjectDotenvFile(workflowsDir) {
+	const envPath = path.join(workflowsDir, ".env");
+	try {
+		return parse(await readFile(envPath, "utf-8"));
+	} catch {
+		return {};
+	}
+}
+function resolveKeysForServerRow(cs, manifestGroups) {
+	if (cs.keys && cs.keys.length > 0) return cs.keys;
+	const matching = manifestGroups.filter((g) => manifestGroupMatchesServerRow(cs, g));
+	if (matching.length === 0) return [];
+	const keys = /* @__PURE__ */ new Set();
+	for (const m of matching) for (const k of m.keys) keys.add(k);
+	return [...keys].sort();
+}
+function resolveKeysForSet(serverKeys, manifestKeys) {
+	if (serverKeys && serverKeys.length > 0) return serverKeys;
+	return manifestKeys ?? [];
+}
+function computeCredentialWhere(params) {
+	const { onServer, keys, mergedEnv, keyToEnv } = params;
+	if (keys.length === 0) return "unknown";
+	const localComplete = resolveCredentialValuesFromEnv(keys, mergedEnv, keyToEnv ?? void 0) !== null;
+	if (onServer) return localComplete ? "both" : "cloud";
+	return localComplete ? "local" : "missing";
+}
+function enrichServerCredentialRow(params) {
+	const { cs, manifestGroups, mergedEnv, keyToEnv, workflowLabels } = params;
+	const where = computeCredentialWhere({
+		onServer: true,
+		keys: resolveKeysForSet(cs.keys, resolveKeysForServerRow(cs, manifestGroups)),
+		mergedEnv,
+		keyToEnv: keyToEnv ?? void 0
+	});
+	return {
+		workflows: workflowLabels ?? [],
+		where
+	};
+}
+function buildSyntheticNotOnServerRows(params) {
+	const { serverRows, manifestGroups, workflowConsumersByGroup, mergedEnv, credentialEnvMap } = params;
+	const out = [];
+	for (const g of manifestGroups) {
+		if (serverRows.some((cs) => manifestGroupMatchesServerRow(cs, g))) continue;
+		const keys = g.keys;
+		const keyToEnv = credentialEnvMap?.[g.credentialSetId];
+		const where = computeCredentialWhere({
+			onServer: false,
+			keys,
+			mergedEnv,
+			keyToEnv
+		});
+		out.push({
+			credentialSetId: g.credentialSetId,
+			scope: normalizeManifestScopeToServer(g.scope),
+			workflows: workflowConsumersByGroup.get(manifestGroupKey(g)) ?? [],
+			where
+		});
+	}
+	return out;
+}
+//#endregion
+export { loadProjectDotenvFile as a, getTerminalContentWidth as c, enrichServerCredentialRow as i, renderCredentialListBlocks as l, buildSyntheticNotOnServerRows as n, manifestGroupKey as o, collectMergedManifestGroups as r, normalizeManifestScopeToServer as s, buildCredentialWorkflowConsumersByGroup as t, truncateWithEllipsis as u };

package/dist/list.handler-BTWvCyjA.mjs

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+
+import { D as throwReportedCliExit, o as ANSI, s as style, t as ui } from "./keystroke.mjs";
+import { d as trackProject } from "./dist-CUK7yBM0.mjs";
+import { i as writeJson } from "./output-DM4b7KgY.mjs";
+import { t as requireWorkflowsDir } from "./resolve-project-DDJ29sCF.mjs";
+import { t as createSpinnerProgress } from "./spinner-progress-DMVwgqO9.mjs";
+import { a as runWorkflowBuild, n as renderBuildFailure } from "./workflow-build-DBQaBfnn.mjs";
+//#region src/commands/workflows/list.handler.ts
+function formatWorkflow(artifact) {
+	const name = style(artifact.manifest.name, `${ANSI.bold}${ANSI.cyan}`);
+	const filePath = style(artifact.workflow.resolvedFilePath, ANSI.dim);
+	const lines = [`  ${name}`, `  ${filePath}`];
+	if (artifact.manifest.description) lines.push(`  ${artifact.manifest.description}`);
+	lines.push(`  ${style(`$ keystroke workflows try-deploy "${artifact.manifest.name}"`, ANSI.dim)}`);
+	return lines.join("\n");
+}
+async function handleWorkflowsList(options, ctx) {
+	const workflowsDir = await requireWorkflowsDir(options.path);
+	await trackProject(workflowsDir);
+	const spinner = !ctx.jsonMode ? createSpinnerProgress("[list]") : void 0;
+	spinner?.start("Loading workflows...");
+	try {
+		const { result } = await runWorkflowBuild({
+			workflowsDir,
+			verbose: false
+		});
+		spinner?.stop();
+		if (ctx.jsonMode) {
+			writeJson(result.artifacts.map((artifact) => ({
+				name: artifact.manifest.name,
+				filePath: artifact.workflow.resolvedFilePath,
+				description: artifact.manifest.description ?? null,
+				exportName: artifact.workflow.exportName
+			})));
+			return;
+		}
+		if (result.artifacts.length === 0) {
+			ui.hint(`No workflows found in ${workflowsDir}`);
+			return;
+		}
+		ui.text(result.artifacts.map(formatWorkflow).join("\n\n"));
+		ui.br();
+		ui.hint(`${result.artifacts.length} workflow(s) found`);
+	} catch (error) {
+		spinner?.stop();
+		renderBuildFailure(error);
+		throwReportedCliExit("Failed to list workflows.", { cause: error });
+	}
+}
+//#endregion
+export { handleWorkflowsList };

package/dist/list.handler-CWF_Dj15.mjs

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+
+import { t as ui } from "./keystroke.mjs";
+import { i as requireClient } from "./context-T7HZuB97.mjs";
+//#region src/commands/org/list.handler.ts
+async function handleOrgList(_options, ctx) {
+	const { user } = await requireClient(ctx).users.getMe();
+	const orgs = user.organizations ?? [];
+	const currentOrgId = ctx.organizationId;
+	const storedOrgIds = new Set(ctx.storedCredentials?.orgs.map((o) => o.organizationId) ?? []);
+	if (orgs.length === 0) {
+		ui.warn("You do not belong to any organization.");
+		return;
+	}
+	for (const org of orgs) {
+		const parts = [];
+		if (org.id === currentOrgId) parts.push("current");
+		if (storedOrgIds.has(org.id)) parts.push("key stored");
+		const suffix = parts.length > 0 ? ` (${parts.join(", ")})` : "";
+		ui.text(`  ${org.name}${suffix}`);
+	}
+}
+//#endregion
+export { handleOrgList };

package/dist/list.handler-CZ6G2x_G.mjs

@@ -0,0 +1,75 @@
+#!/usr/bin/env node
+
+import { o as ANSI, s as style, t as ui } from "./keystroke.mjs";
+import { s as readStoredProjects } from "./dist-CUK7yBM0.mjs";
+import { i as readProjectConfig } from "./project-config-D1qsQlO7.mjs";
+import { i as writeJson } from "./output-DM4b7KgY.mjs";
+import { access } from "node:fs/promises";
+import Table from "cli-table3";
+//#region src/commands/projects/list.handler.ts
+async function getProjectNameFromConfig(projectPath) {
+	return (await readProjectConfig(projectPath))?.name;
+}
+function relativeTime(isoDate) {
+	const diff = Date.now() - new Date(isoDate).getTime();
+	const seconds = Math.floor(diff / 1e3);
+	if (seconds < 60) return `${seconds}s ago`;
+	const minutes = Math.floor(seconds / 60);
+	if (minutes < 60) return `${minutes}m ago`;
+	const hours = Math.floor(minutes / 60);
+	if (hours < 24) return `${hours}h ago`;
+	return `${Math.floor(hours / 24)}d ago`;
+}
+async function pathExists(p) {
+	try {
+		await access(p);
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function handleProjectsList(_options, ctx) {
+	const stored = await readStoredProjects();
+	if (!stored || Object.keys(stored.projects).length === 0) {
+		if (ctx.jsonMode) {
+			writeJson([]);
+			return;
+		}
+		ui.hint("No tracked projects. Run `keystroke init` to get started.");
+		return;
+	}
+	const entries = Object.entries(stored.projects).sort(([, a], [, b]) => new Date(b.lastAccessed).getTime() - new Date(a.lastAccessed).getTime());
+	if (ctx.jsonMode) {
+		writeJson(entries.map(([projectPath, entry]) => ({
+			name: entry.name ?? null,
+			path: projectPath,
+			lastAccessed: entry.lastAccessed,
+			isRecent: stored.lastProject === projectPath
+		})));
+		return;
+	}
+	const table = new Table({
+		head: [
+			"Name",
+			"Path",
+			"Last Accessed"
+		],
+		style: { head: [] }
+	});
+	for (const [projectPath, entry] of entries) {
+		const exists = await pathExists(projectPath);
+		const nameCol = entry.name ?? (exists ? await getProjectNameFromConfig(projectPath) : void 0) ?? style("(unnamed)", ANSI.dim);
+		const pathCol = exists ? projectPath : `${projectPath} ${style("(missing)", ANSI.yellow)}`;
+		const timeCol = relativeTime(entry.lastAccessed);
+		const indicator = stored.lastProject === projectPath ? ` ${style("(recent)", ANSI.cyan)}` : "";
+		table.push([
+			nameCol,
+			`${pathCol}${indicator}`,
+			timeCol
+		]);
+	}
+	ui.text(table.toString());
+	ui.hint(`\n${entries.length} project(s) tracked`);
+}
+//#endregion
+export { handleProjectsList };

package/dist/list.handler-DWaQkJaR.mjs

@@ -0,0 +1,51 @@
+#!/usr/bin/env node
+
+import { D as throwReportedCliExit, h as toErrorMessage, o as ANSI, s as style, t as ui } from "./keystroke.mjs";
+import { i as writeJson } from "./output-DM4b7KgY.mjs";
+import { i as requireClient } from "./context-T7HZuB97.mjs";
+import Table from "cli-table3";
+//#region src/commands/api-keys/list.handler.ts
+async function handleApiKeysList(_options, ctx) {
+	const client = requireClient(ctx);
+	try {
+		const { apiKeys } = await client.apiKeys.list();
+		if (ctx.jsonMode) {
+			writeJson(apiKeys.map((key) => ({
+				id: key.id,
+				name: key.name,
+				ownerEmail: key.ownerEmail,
+				organizationId: key.organizationId,
+				createdAt: key.createdAt,
+				lastUsedAt: key.lastUsedAt,
+				expiresAt: key.expiresAt
+			})));
+			return;
+		}
+		if (apiKeys.length === 0) {
+			ui.hint("No API keys found.");
+			return;
+		}
+		const table = new Table({
+			head: [
+				"Name",
+				"ID",
+				"Owner",
+				"Created"
+			],
+			style: { head: [] }
+		});
+		for (const key of apiKeys) table.push([
+			key.name ?? style("(unnamed)", ANSI.dim),
+			key.id,
+			key.ownerEmail,
+			new Date(key.createdAt).toLocaleDateString()
+		]);
+		ui.text(table.toString());
+		ui.hint(`${apiKeys.length} API key(s) total`);
+	} catch (error) {
+		ui.error(`Failed to list API keys: ${toErrorMessage(error)}`);
+		throwReportedCliExit(`Failed to list API keys: ${toErrorMessage(error)}`, { cause: error });
+	}
+}
+//#endregion
+export { handleApiKeysList };

package/dist/list.handler-DqbFcBW7.mjs

@@ -0,0 +1,180 @@
+#!/usr/bin/env node
+
+import { D as throwReportedCliExit, t as ui } from "./keystroke.mjs";
+import { i as writeJson } from "./output-DM4b7KgY.mjs";
+import { a as readManifestsFromOutDir } from "./dist-BkJUoBiG.mjs";
+import { n as resolveWorkflowsDir } from "./resolve-project-DDJ29sCF.mjs";
+import { n as getProcessEnv } from "./env-91KwMKov.mjs";
+import { i as requireClient } from "./context-T7HZuB97.mjs";
+import { t as readCredentialEnvMap } from "./credential-env-map-CI8yWHVy.mjs";
+import { a as loadProjectDotenvFile, i as enrichServerCredentialRow, l as renderCredentialListBlocks, n as buildSyntheticNotOnServerRows, r as collectMergedManifestGroups, t as buildCredentialWorkflowConsumersByGroup } from "./list-enrichment-y-cwizLr.mjs";
+import dayjs from "dayjs";
+//#region src/commands/credentials/list/fetch-all-credential-sets.ts
+/**
+* Pages through GET /credentials until all accessible credential sets are loaded.
+* Used so manifest-only synthetic rows match the full server inventory (not just the current page).
+*/
+async function fetchAllAccessibleCredentialSets(client) {
+	const all = [];
+	let offset = 0;
+	const limit = 100;
+	let total = 0;
+	for (;;) {
+		const res = await client.credentials.list({
+			limit,
+			offset
+		});
+		total = res.pagination.total;
+		const batch = res.credentialSets ?? [];
+		all.push(...batch);
+		if (batch.length === 0 || all.length >= total) break;
+		offset += limit;
+	}
+	return all;
+}
+//#endregion
+//#region src/commands/credentials/list/list.handler.ts
+/** Compact date for block layout (full precision in `--json`). */
+function formatCreatedAtForDisplay(iso) {
+	const d = dayjs(iso);
+	return d.isValid() ? d.format("MMM D, YYYY") : iso;
+}
+function workflowLabelsForServerRow(cs, workflowConsumersByGroup) {
+	return workflowConsumersByGroup.get(`${cs.credentialSetId}\0${cs.scope}`);
+}
+async function resolveServerRowsForManifestMatch(client, manifestGroupsLength, offset, pageRows, paginationTotal) {
+	if (manifestGroupsLength === 0) return pageRows;
+	if (!(offset > 0 || pageRows.length < paginationTotal)) return pageRows;
+	return fetchAllAccessibleCredentialSets(client);
+}
+async function handleCredentialsList(options, ctx) {
+	const client = requireClient(ctx);
+	const limit = options.limit ?? 50;
+	const offset = options.offset ?? 0;
+	const params = {
+		limit,
+		offset
+	};
+	if (options.projectId && options.scope && options.scope !== "project") {
+		ui.error("--project-id can only be used with --scope project");
+		throwReportedCliExit("--project-id can only be used with --scope project");
+	}
+	if (options.scope) params.scope = options.scope;
+	if (options.credentialSetId) params.credentialSetId = options.credentialSetId;
+	if (options.projectId) {
+		params.projectId = options.projectId;
+		params.scope ??= "project";
+	}
+	const response = await client.credentials.list(params);
+	const credentialSets = response.credentialSets ?? [];
+	const workflowsDir = await resolveWorkflowsDir(options.path);
+	const manifests = workflowsDir ? await readManifestsFromOutDir(workflowsDir) : [];
+	const credentialEnvMap = workflowsDir ? await readCredentialEnvMap(workflowsDir) : null;
+	const projectDotenv = workflowsDir ? await loadProjectDotenvFile(workflowsDir) : {};
+	const mergedEnv = {
+		...getProcessEnv(),
+		...projectDotenv
+	};
+	const manifestGroups = collectMergedManifestGroups(manifests);
+	const workflowConsumersByGroup = buildCredentialWorkflowConsumersByGroup(manifests);
+	const serverRowsForSyntheticMatch = await resolveServerRowsForManifestMatch(client, manifestGroups.length, offset, credentialSets, response.pagination.total);
+	if (ctx.jsonMode) {
+		const serverRows = credentialSets.map((cs) => {
+			const { workflows, where } = enrichServerCredentialRow({
+				cs,
+				manifestGroups,
+				mergedEnv,
+				keyToEnv: credentialEnvMap?.[cs.credentialSetId] ?? null,
+				workflowLabels: workflowLabelsForServerRow(cs, workflowConsumersByGroup)
+			});
+			return {
+				source: "server",
+				id: cs.id,
+				credentialSetId: cs.credentialSetId,
+				name: cs.name,
+				scope: cs.scope,
+				projectId: cs.projectId,
+				isDefault: cs.isDefault,
+				createdAt: cs.createdAt,
+				updatedAt: cs.updatedAt,
+				workflows,
+				where
+			};
+		});
+		const synthetic = buildSyntheticNotOnServerRows({
+			serverRows: serverRowsForSyntheticMatch,
+			manifestGroups,
+			workflowConsumersByGroup,
+			mergedEnv,
+			credentialEnvMap
+		}).map((row) => ({
+			source: "manifest",
+			id: null,
+			credentialSetId: row.credentialSetId,
+			name: null,
+			scope: row.scope,
+			projectId: null,
+			isDefault: null,
+			createdAt: null,
+			updatedAt: null,
+			workflows: row.workflows,
+			where: row.where
+		}));
+		writeJson([...serverRows, ...synthetic], response.pagination);
+		return;
+	}
+	if (credentialSets.length === 0 && manifestGroups.length === 0) {
+		ui.text("No credential sets found.");
+		return;
+	}
+	const displayRows = [];
+	let hasUnknownWhere = false;
+	for (const cs of credentialSets) {
+		const { workflows, where } = enrichServerCredentialRow({
+			cs,
+			manifestGroups,
+			mergedEnv,
+			keyToEnv: credentialEnvMap?.[cs.credentialSetId] ?? null,
+			workflowLabels: workflowLabelsForServerRow(cs, workflowConsumersByGroup)
+		});
+		if (where === "unknown") hasUnknownWhere = true;
+		displayRows.push({
+			credentialSetId: cs.credentialSetId,
+			name: cs.name,
+			scope: cs.scope,
+			projectId: cs.projectId ?? "—",
+			workflows,
+			where,
+			isDefault: cs.isDefault,
+			createdAt: cs.createdAt
+		});
+	}
+	const syntheticRows = buildSyntheticNotOnServerRows({
+		serverRows: serverRowsForSyntheticMatch,
+		manifestGroups,
+		workflowConsumersByGroup,
+		mergedEnv,
+		credentialEnvMap
+	});
+	for (const row of syntheticRows) {
+		if (row.where === "unknown") hasUnknownWhere = true;
+		displayRows.push({
+			credentialSetId: row.credentialSetId,
+			name: "—",
+			scope: row.scope,
+			projectId: "—",
+			workflows: row.workflows,
+			where: row.where,
+			isDefault: null,
+			createdAt: null
+		});
+	}
+	renderCredentialListBlocks(displayRows, formatCreatedAtForDisplay, {
+		pagination: response.pagination,
+		syntheticManifestCount: syntheticRows.length
+	});
+	if (!workflowsDir) ui.hint("No Keystroke project in cwd: workflow names and env checks need --path or run from a project with keystroke.config.ts.");
+	if (hasUnknownWhere) ui.hint("Where is \"—\" when keys are unknown: run `keystroke workflows build`, use --path, or rely on server-reported keys.");
+}
+//#endregion
+export { handleCredentialsList };