@keystrokehq/cli 0.0.123 → 0.0.125

package/dist/{dist-IKyaKHgU.mjs → dist-uZuvgIVp.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { a as array, d as object, p as string, t as entryIdFromFile } from "./discovery-XqwkB9H_-CQLSzR72.mjs";
+import { a as array, d as object, p as string, t as entryIdFromFile } from "./discovery-XqwkB9H_-C2XdYbG2.mjs";
 import { isBuiltin } from "node:module";
 import { basename, join, relative } from "node:path";
 import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
@@ -294,4 +294,4 @@ async function watchApp(options = {}) {
 //#endregion
 export { buildApp, resolveRuntimeBuildArtifact, watchApp };
 
-//# sourceMappingURL=dist-IKyaKHgU.mjs.map
+//# sourceMappingURL=dist-uZuvgIVp.mjs.map

package/dist/{dist-IKyaKHgU.mjs.map → dist-uZuvgIVp.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"dist-IKyaKHgU.mjs","names":["z.object","z.string","z.array"],"sources":["../../../packages/sandbox/dist/files-B0H9_dP4.mjs","../../../packages/tsdown-config/deps.js","../../../packages/tsdown-config/index.js","../../../packages/build/dist/index.mjs"],"sourcesContent":["import { basename, dirname, join, relative, resolve } from \"node:path\";\nimport { access, mkdir, writeFile } from \"node:fs/promises\";\nimport { z } from \"zod\";\nimport { existsSync, readFileSync, readdirSync, statSync } from \"node:fs\";\nimport { fileURLToPath } from \"node:url\";\n//#region src/sandbox-dirs.ts\nfunction resolveSandboxRoot(workspacesRoot, scope) {\n\tif (scope.type === \"agent\") return join(workspacesRoot, scope.agentId);\n\treturn join(workspacesRoot, \"runs\", scope.runId);\n}\nasync function ensureWorkspaceDir(workspaceRoot) {\n\tawait mkdir(workspaceRoot, { recursive: true });\n}\n//#endregion\n//#region src/files/schemas.ts\nconst SandboxFileContentSchema = z.object({\n\tpath: z.string(),\n\tfile: z.string()\n});\n/** Destination path under `/workspace`. For `dir`, used as a prefix. */\nconst SandboxFileSchema = z.object({\n\tpath: z.string(),\n\t/** Single file body — typically from a build-time import (`import doc from \"./doc.md\"`). */\n\tfile: z.string().optional(),\n\t/** Directory contents — each path is relative to `path`. */\n\tdir: z.array(SandboxFileContentSchema).optional()\n});\nconst SandboxDefinitionSchema = z.object({\n\tkey: z.string().optional(),\n\tfiles: z.array(SandboxFileSchema).optional()\n});\n//#endregion\n//#region src/files/define-sandbox.ts\n/** Define a reusable sandbox file layout. */\nfunction defineSandbox(def) {\n\treturn def;\n}\n//#endregion\n//#region src/files/flatten-sandbox-files.ts\n/** Expand directory entries into flat `{ path, file }` records under `/workspace`. */\nfunction flattenSandboxFiles(files) {\n\tif (!files?.length) return [];\n\tconst flattened = [];\n\tfor (const entry of files) {\n\t\tif (entry.dir !== void 0) {\n\t\t\tconst prefix = entry.path.replace(/\\/+$/, \"\");\n\t\t\tfor (const child of entry.dir) flattened.push({\n\t\t\t\tpath: prefix ? `${prefix}/${child.path}` : child.path,\n\t\t\t\tfile: child.file\n\t\t\t});\n\t\t\tcontinue;\n\t\t}\n\t\tif (entry.file === void 0) continue;\n\t\tflattened.push({\n\t\t\tpath: entry.path,\n\t\t\tfile: entry.file\n\t\t});\n\t}\n\treturn flattened;\n}\n//#endregion\n//#region src/files/materialize-sandbox.ts\nasync function materializeSandbox(options) {\n\tconst root = resolveSandboxRoot(options.workspacesRoot, options.scope);\n\tawait ensureWorkspaceDir(root);\n\tconst files = flattenSandboxFiles(options.definition?.files);\n\tif (files.length) await applySandboxFiles(root, files, options.scope);\n\treturn {\n\t\troot,\n\t\tscope: options.scope,\n\t\t...options.definition !== void 0 ? { definition: options.definition } : {}\n\t};\n}\nasync function applySandboxFiles(root, files, scope) {\n\tfor (const entry of files) {\n\t\tconst hostPath = resolve(root, entry.path);\n\t\tif (scope.type === \"agent\") try {\n\t\t\tawait access(hostPath);\n\t\t\tcontinue;\n\t\t} catch {}\n\t\tawait mkdir(dirname(hostPath), { recursive: true });\n\t\tawait writeFile(hostPath, entry.file);\n\t}\n}\n//#endregion\n//#region src/files/pack-dir.ts\nconst SKIP_DIRS$1 = new Set([\".git\", \"node_modules\"]);\n/** Recursively read a host file or directory into sandbox-relative `{ path, file }` entries. */\nfunction packDirFromDisk(rootPath) {\n\tconst stat = statSync(rootPath);\n\tif (stat.isFile()) return [{\n\t\tpath: basename(rootPath),\n\t\tfile: readFileSync(rootPath, \"utf8\")\n\t}];\n\tif (!stat.isDirectory()) throw new Error(`Expected a file or directory at ${rootPath}`);\n\tconst files = [];\n\twalkDir(rootPath, rootPath, files);\n\treturn files;\n}\nfunction walkDir(rootPath, currentPath, files) {\n\tfor (const name of readdirSync(currentPath)) {\n\t\tif (SKIP_DIRS$1.has(name)) continue;\n\t\tconst entryPath = join(currentPath, name);\n\t\tconst stat = statSync(entryPath);\n\t\tif (stat.isDirectory()) {\n\t\t\twalkDir(rootPath, entryPath, files);\n\t\t\tcontinue;\n\t\t}\n\t\tif (!stat.isFile()) continue;\n\t\tfiles.push({\n\t\t\tpath: relative(rootPath, entryPath),\n\t\t\tfile: readFileSync(entryPath, \"utf8\")\n\t\t});\n\t}\n}\n//#endregion\n//#region src/files/pack-asset-dirs.ts\nconst SKIP_DIRS = new Set([\".git\", \"node_modules\"]);\n/** Pack every subdir under `src/skills/` and `src/files/` into an asset manifest. */\nfunction packAssetDirs(appRoot, srcDir = \"src\") {\n\treturn {\n\t\tskills: packAssetRoot(join(appRoot, srcDir, \"skills\")),\n\t\tfiles: packAssetRoot(join(appRoot, srcDir, \"files\"))\n\t};\n}\nfunction packAssetRoot(rootPath) {\n\tif (!statSync(rootPath, { throwIfNoEntry: false })?.isDirectory()) return {};\n\tconst manifest = {};\n\tfor (const name of readdirSync(rootPath)) {\n\t\tif (SKIP_DIRS.has(name)) continue;\n\t\tconst entryPath = join(rootPath, name);\n\t\tif (!statSync(entryPath).isDirectory()) continue;\n\t\tmanifest[name] = packDirFromDisk(entryPath);\n\t}\n\treturn manifest;\n}\n//#endregion\n//#region src/files/resolve-app-root.ts\n/** Walk upward from a module file to find the user app root (`src/agents`, `src/skills`, etc.). */\nfunction resolveAppRoot(fromPath) {\n\tlet dir = statSync(fromPath).isDirectory() ? fromPath : dirname(fromPath);\n\twhile (dir !== dirname(dir)) {\n\t\tif (hasAppLayout(dir)) return dir;\n\t\tdir = dirname(dir);\n\t}\n\treturn process.env.KEYSTROKE_ROOT ?? process.cwd();\n}\n/** Resolve app root from an agent (or other) module URL. */\nfunction resolveAppRootFromModule(moduleUrl) {\n\treturn resolveAppRoot(fileURLToPath(moduleUrl));\n}\nfunction hasAppLayout(dir) {\n\tconst src = join(dir, \"src\");\n\tconst dist = join(dir, \"dist\");\n\treturn existsSync(join(src, \"agents\")) || existsSync(join(src, \"skills\")) || existsSync(join(src, \"files\")) || existsSync(join(dist, \"agents\")) || existsSync(join(dist, \".keystroke\", \"assets.mjs\"));\n}\n//#endregion\nexport { materializeSandbox as a, SandboxDefinitionSchema as c, ensureWorkspaceDir as d, resolveSandboxRoot as f, packDirFromDisk as i, SandboxFileContentSchema as l, resolveAppRootFromModule as n, flattenSandboxFiles as o, packAssetDirs as r, defineSandbox as s, resolveAppRoot as t, SandboxFileSchema as u };\n\n//# sourceMappingURL=files-B0H9_dP4.mjs.map","import { isBuiltin } from \"node:module\";\n\n/** Native addons kept external — resolved from the CLI runtime at app start. */\nexport const NATIVE_RUNTIME_DEPS = [\"pg\", \"better-sqlite3\", \"@parcel/watcher\"];\n\n/** Kept external so .d.ts emission does not inline internal/inferred types. */\nexport const LIBRARY_EXTERNAL_DEPS = [\"better-auth\", /^@better-auth\\//, /^better-auth\\//];\n\n/** Non-auth runtime deps kept external for published entry bundles (platform, etc.). */\nexport const BUNDLED_ENTRY_RUNTIME_EXTERNAL_DEPS = [\n  ...NATIVE_RUNTIME_DEPS,\n  \"dockerode\",\n  \"ssh2\",\n  \"cpu-features\",\n  \"microsandbox\",\n  /^@aws-sdk\\//,\n  /^@napi-rs\\//,\n  \"hono\",\n  /^@hono\\//,\n  \"undici\",\n];\n\n/** Kept external when bundling published entry points (cli, keystroke, platform). */\nexport const BUNDLED_ENTRY_EXTERNAL_DEPS = [\n  ...BUNDLED_ENTRY_RUNTIME_EXTERNAL_DEPS,\n  ...LIBRARY_EXTERNAL_DEPS,\n];\n\n/** Bundle into CLI — device login uses Better Auth client only. */\nexport const BETTER_AUTH_CLIENT_BUNDLE_PATTERNS = [\n  /^better-auth\\/client$/,\n  /^better-auth\\/client\\//,\n];\n\n/** Server adapters and root entry — must not ship in the CLI bundle. */\nexport const BETTER_AUTH_SERVER_EXTERNAL_PATTERNS = [\n  /^better-auth$/,\n  /^@better-auth\\//,\n  /^better-auth\\/(?!client(\\/|$)).+/,\n];\n\nexport function isNativeRuntimeDep(id) {\n  return NATIVE_RUNTIME_DEPS.some((dep) => id === dep || id.startsWith(`${dep}/`));\n}\n\nfunction packageName(id) {\n  if (id.startsWith(\"@\")) {\n    const [scope, name] = id.split(\"/\");\n    return name ? `${scope}/${name}` : id;\n  }\n\n  return id.split(\"/\")[0] ?? id;\n}\n\nfunction isRuntimeExternal(id) {\n  const name = packageName(id);\n  if (isNativeRuntimeDep(name)) {\n    return true;\n  }\n\n  if (name.startsWith(\"@keystrokehq/\")) {\n    return true;\n  }\n\n  if (name === \"better-auth\" || name.startsWith(\"@better-auth/\")) {\n    return true;\n  }\n\n  return false;\n}\n\n/** Library packages resolve npm deps from node_modules at runtime. */\nexport function libraryBuildDepsConfig() {\n  return {\n    alwaysBundle: (_id) => null,\n    neverBundle: [...NATIVE_RUNTIME_DEPS, /^@keystrokehq\\//, ...LIBRARY_EXTERNAL_DEPS],\n    onlyBundle: false,\n  };\n}\n\n/** Bundle npm deps into dist; resolve @keystrokehq/* and natives from the runtime. */\nexport function userAppBuildDepsConfig() {\n  return {\n    alwaysBundle: (id, _importer) => {\n      if (id.startsWith(\".\") || id.startsWith(\"/\") || isBuiltin(id)) {\n        return null;\n      }\n\n      return isRuntimeExternal(id) ? null : true;\n    },\n    neverBundle: [...NATIVE_RUNTIME_DEPS, /^@keystrokehq\\//, ...LIBRARY_EXTERNAL_DEPS],\n    onlyBundle: false,\n  };\n}\n\n/**\n * Published entry packages (cli, keystroke, platform): declare bundled @keystrokehq/*\n * in dependencies (changesets release graph ignores devDependencies). Inlining is\n * driven by alwaysBundle below, not by dep kind. Runtime npm deps stay external.\n */\nexport function bundledEntryDepsConfig() {\n  return {\n    alwaysBundle: [/^@keystrokehq\\//],\n    neverBundle: [...BUNDLED_ENTRY_EXTERNAL_DEPS],\n    onlyBundle: false,\n  };\n}\n\n/** Published CLI: inline better-auth client + @better-auth/*; keep server adapters external. */\nexport const BETTER_AUTH_CLI_BUNDLE_PATTERNS = [\n  ...BETTER_AUTH_CLIENT_BUNDLE_PATTERNS,\n  /^@better-auth\\//,\n];\n\nexport const BETTER_AUTH_CLI_EXTERNAL_PATTERNS = [\n  /^better-auth$/,\n  /^better-auth\\/(?!client(\\/|$)).+/,\n  /^@better-auth\\/drizzle-adapter/,\n  \"drizzle-orm\",\n];\n\n/** Rolldown/tsdown — native bindings; stay in CLI node_modules at runtime. */\nexport const CLI_BUILD_TOOL_EXTERNAL_PATTERNS = [\"tsdown\", \"rolldown\", /^@rolldown\\//, \"tsx\"];\n\n/** CLI: inline better-auth/client; keep server + drizzle adapters external. */\nexport function cliBundledEntryDepsConfig() {\n  return {\n    alwaysBundle: [/^@keystrokehq\\//, ...BETTER_AUTH_CLI_BUNDLE_PATTERNS],\n    neverBundle: [\n      ...BUNDLED_ENTRY_RUNTIME_EXTERNAL_DEPS,\n      ...BETTER_AUTH_CLI_EXTERNAL_PATTERNS,\n      ...CLI_BUILD_TOOL_EXTERNAL_PATTERNS,\n    ],\n    onlyBundle: false,\n  };\n}\n","import { bundledEntryDepsConfig, libraryBuildDepsConfig, userAppBuildDepsConfig } from \"./deps.js\";\n\nexport {\n  isNativeRuntimeDep,\n  NATIVE_RUNTIME_DEPS,\n  bundledEntryDepsConfig,\n  cliBundledEntryDepsConfig,\n  libraryBuildDepsConfig,\n  userAppBuildDepsConfig,\n} from \"./deps.js\";\n\nexport const baseTsdownConfig = {\n  format: [\"esm\", \"cjs\"],\n  dts: true,\n  clean: true,\n  sourcemap: true,\n  target: \"node20\",\n  deps: libraryBuildDepsConfig(),\n};\n\n/** tsdown config for published bundles (cli, keystroke, platform). */\nexport const bundledEntryTsdownConfig = {\n  format: [\"esm\", \"cjs\"],\n  dts: true,\n  clean: true,\n  sourcemap: true,\n  target: \"node20\",\n  deps: bundledEntryDepsConfig(),\n};\n","import { t as resolveModuleDirs } from \"./resolve-module-dirs-BPHQhRGy.mjs\";\nimport { existsSync, mkdirSync, readdirSync, statSync, writeFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { entryIdFromFile } from \"@keystrokehq/server/discovery\";\nimport { packAssetDirs } from \"@keystrokehq/sandbox/files\";\nimport { baseTsdownConfig, userAppBuildDepsConfig } from \"@keystrokehq/tsdown-config\";\nimport { build, mergeConfig } from \"tsdown\";\n//#region src/resolve-runtime-artifact.ts\nfunction packageRoot(nodeModules, scope, name) {\n\tconst direct = scope ? join(nodeModules, scope, name) : join(nodeModules, name);\n\tif (existsSync(join(direct, \"package.json\"))) return direct;\n\tconst pnpmDir = join(nodeModules, \".pnpm\");\n\tif (!existsSync(pnpmDir)) return null;\n\tfor (const entry of readdirSync(pnpmDir)) {\n\t\tconst candidate = scope ? join(pnpmDir, entry, \"node_modules\", scope, name) : join(pnpmDir, entry, \"node_modules\", name);\n\t\tif (existsSync(join(candidate, \"package.json\"))) return candidate;\n\t}\n\treturn null;\n}\n/** Resolve a file shipped with `@keystrokehq/build` inside the CLI runtime. */\nfunction resolveRuntimeBuildArtifact(runtimeNodeModules, relativePath) {\n\tconst pkgRoot = packageRoot(runtimeNodeModules, \"@keystrokehq\", \"build\");\n\tif (!pkgRoot) throw new Error(\"Keystroke runtime is missing @keystrokehq/build\");\n\tconst artifact = join(pkgRoot, relativePath);\n\tif (!existsSync(artifact)) throw new Error(`Keystroke runtime artifact not found: ${relativePath}`);\n\treturn artifact;\n}\n//#endregion\n//#region src/vitest-plugin.ts\nconst ASSETS_MODULE$1 = \"@keystrokehq/assets\";\nconst virtualPrefix = `\\0${ASSETS_MODULE$1}:`;\n/** Vitest plugin resolving `@keystrokehq/assets` from disk. */\nfunction agentAssetsVitestPlugin(appRoot = process.cwd()) {\n\tlet manifest = null;\n\treturn {\n\t\tname: \"keystroke-assets\",\n\t\tresolveId(source) {\n\t\t\tif (source !== ASSETS_MODULE$1) return null;\n\t\t\treturn `${virtualPrefix}manifest`;\n\t\t},\n\t\tload(id) {\n\t\t\tif (id !== `${virtualPrefix}manifest`) return null;\n\t\t\tmanifest ??= packAssetDirs(appRoot);\n\t\t\treturn `export default ${JSON.stringify(manifest)};`;\n\t\t}\n\t};\n}\nfunction findAppRootFromConfig(configFile) {\n\tif (!configFile) return process.cwd();\n\treturn dirname(configFile);\n}\nfunction agentAssetsVitestPluginFromConfig(configFile) {\n\treturn agentAssetsVitestPlugin(findAppRootFromConfig(configFile));\n}\n//#endregion\n//#region src/index.ts\nconst ASSETS_MODULE = \"@keystrokehq/assets\";\nconst VIRTUAL_PREFIX = `\\0${ASSETS_MODULE}:`;\nfunction walkTypeScriptSources(dir) {\n\tif (!existsSync(dir)) return [];\n\tconst files = [];\n\tfor (const name of readdirSync(dir)) {\n\t\tconst path = join(dir, name);\n\t\tif (statSync(path).isDirectory()) files.push(...walkTypeScriptSources(path));\n\t\telse if (/\\.(ts|mts)$/.test(name) && !/\\.(int\\.)?test\\.(ts|mts)$/.test(name)) files.push(path);\n\t}\n\treturn files;\n}\nfunction discoveredEntries(dir, nestedEntry, prefix) {\n\tconst entries = {};\n\tfor (const filePath of walkTypeScriptSources(dir)) {\n\t\tconst id = entryIdFromFile(dir, filePath, { nestedEntry });\n\t\tif (!id) continue;\n\t\tentries[`${prefix}/${id}`] = filePath;\n\t}\n\treturn entries;\n}\nfunction renderAssetModule(manifest) {\n\treturn `export default ${JSON.stringify(manifest)};\\n`;\n}\n/** Rolldown plugin: pack src/skills + src/files and expose `@keystrokehq/assets`. */\nfunction agentAssetsPlugin(options) {\n\tconst srcDir = options.srcDir ?? \"src\";\n\tlet manifest = null;\n\treturn {\n\t\tname: \"keystroke-assets\",\n\t\tbuildStart() {\n\t\t\tmanifest = packAssetDirs(options.root, srcDir);\n\t\t},\n\t\tresolveId(source) {\n\t\t\tif (source !== ASSETS_MODULE) return null;\n\t\t\treturn `${VIRTUAL_PREFIX}manifest`;\n\t\t},\n\t\tload(id) {\n\t\t\tif (id !== `${VIRTUAL_PREFIX}manifest` || !manifest) return null;\n\t\t\treturn renderAssetModule(manifest);\n\t\t},\n\t\tbuildEnd() {\n\t\t\tif (!manifest) return;\n\t\t\tconst outDir = join(options.root, options.outDir ?? \"dist\", \".keystroke\");\n\t\t\tmkdirSync(outDir, { recursive: true });\n\t\t\twriteFileSync(join(outDir, \"assets.mjs\"), renderAssetModule(manifest));\n\t\t}\n\t};\n}\n/** Full tsdown config for user keystroke apps (config + discovered modules only). */\nfunction createAppBuildConfig(options = {}) {\n\tconst root = options.root ?? process.cwd();\n\tconst srcDir = options.srcDir ?? \"src\";\n\tconst outDir = options.outDir ?? \"dist\";\n\tconst srcRoot = join(root, srcDir);\n\tconst configEntry = existsSync(join(root, \"keystroke.config.ts\")) ? join(root, \"keystroke.config.ts\") : void 0;\n\tconst entries = {\n\t\t...configEntry ? { config: configEntry } : {},\n\t\t...discoveredEntries(join(srcRoot, \"agents\"), \"agent\", \"agents\"),\n\t\t...discoveredEntries(join(srcRoot, \"workflows\"), \"workflow\", \"workflows\"),\n\t\t...discoveredEntries(join(srcRoot, \"triggers\"), \"trigger\", \"triggers\")\n\t};\n\tif (Object.keys(entries).length === 0) throw new Error(\"Nothing to build — add keystroke.config.ts or modules under src/\");\n\treturn mergeConfig(baseTsdownConfig, {\n\t\tentry: entries,\n\t\tformat: [\"esm\"],\n\t\toutDir: join(root, outDir),\n\t\tclean: options.clean ?? true,\n\t\tdts: false,\n\t\tloader: { \".md\": \"text\" },\n\t\tdeps: userAppBuildDepsConfig(),\n\t\tplugins: [agentAssetsPlugin({\n\t\t\troot,\n\t\t\tsrcDir,\n\t\t\toutDir\n\t\t})]\n\t});\n}\n/** Build user agents, workflows, triggers, and config to `dist/`. */\nasync function buildApp(options = {}) {\n\tconst root = options.root ?? process.cwd();\n\tconst previous = process.cwd();\n\ttry {\n\t\tprocess.chdir(root);\n\t\tawait build(createAppBuildConfig({\n\t\t\t...options,\n\t\t\troot\n\t\t}));\n\t} finally {\n\t\tprocess.chdir(previous);\n\t}\n}\n/**\n* Watch `src/` and rebuild `dist/` on change.\n*\n* NOT true hot reload — each change runs a full tsdown rebuild. Callers should\n* restart the API server in `onRebuild` so discovery picks up new/changed modules.\n*/\nasync function watchApp(options = {}) {\n\tconst { runWatchApp } = await import(\"./watch-app-DTIeKrbl.mjs\");\n\tawait runWatchApp(buildApp, options);\n}\n//#endregion\nexport { agentAssetsVitestPlugin, agentAssetsVitestPluginFromConfig, buildApp, createAppBuildConfig, resolveModuleDirs, resolveRuntimeBuildArtifact, watchApp };\n\n//# sourceMappingURL=index.mjs.map"],"mappings":";;;;;;;;;AAeA,MAAM,2BAA2BA,OAAS;CACzC,MAAMC,OAAS;CACf,MAAMA,OAAS;AAChB,CAAC;;AAED,MAAM,oBAAoBD,OAAS;CAClC,MAAMC,OAAS;;CAEf,MAAMA,OAAS,EAAE,SAAS;;CAE1B,KAAKC,MAAQ,wBAAwB,EAAE,SAAS;AACjD,CAAC;AAC+BF,OAAS;CACxC,KAAKC,OAAS,EAAE,SAAS;CACzB,OAAOC,MAAQ,iBAAiB,EAAE,SAAS;AAC5C,CAAC;AAwDD,MAAM,cAAc,IAAI,IAAI,CAAC,QAAQ,cAAc,CAAC;;AAEpD,SAAS,gBAAgB,UAAU;CAClC,MAAM,OAAO,SAAS,QAAQ;CAC9B,IAAI,KAAK,OAAO,GAAG,OAAO,CAAC;EAC1B,MAAM,SAAS,QAAQ;EACvB,MAAM,aAAa,UAAU,MAAM;CACpC,CAAC;CACD,IAAI,CAAC,KAAK,YAAY,GAAG,MAAM,IAAI,MAAM,mCAAmC,UAAU;CACtF,MAAM,QAAQ,CAAC;CACf,QAAQ,UAAU,UAAU,KAAK;CACjC,OAAO;AACR;AACA,SAAS,QAAQ,UAAU,aAAa,OAAO;CAC9C,KAAK,MAAM,QAAQ,YAAY,WAAW,GAAG;EAC5C,IAAI,YAAY,IAAI,IAAI,GAAG;EAC3B,MAAM,YAAY,KAAK,aAAa,IAAI;EACxC,MAAM,OAAO,SAAS,SAAS;EAC/B,IAAI,KAAK,YAAY,GAAG;GACvB,QAAQ,UAAU,WAAW,KAAK;GAClC;EACD;EACA,IAAI,CAAC,KAAK,OAAO,GAAG;EACpB,MAAM,KAAK;GACV,MAAM,SAAS,UAAU,SAAS;GAClC,MAAM,aAAa,WAAW,MAAM;EACrC,CAAC;CACF;AACD;AAGA,MAAM,YAAY,IAAI,IAAI,CAAC,QAAQ,cAAc,CAAC;;AAElD,SAAS,cAAc,SAAS,SAAS,OAAO;CAC/C,OAAO;EACN,QAAQ,cAAc,KAAK,SAAS,QAAQ,QAAQ,CAAC;EACrD,OAAO,cAAc,KAAK,SAAS,QAAQ,OAAO,CAAC;CACpD;AACD;AACA,SAAS,cAAc,UAAU;CAChC,IAAI,CAAC,SAAS,UAAU,EAAE,gBAAgB,MAAM,CAAC,GAAG,YAAY,GAAG,OAAO,CAAC;CAC3E,MAAM,WAAW,CAAC;CAClB,KAAK,MAAM,QAAQ,YAAY,QAAQ,GAAG;EACzC,IAAI,UAAU,IAAI,IAAI,GAAG;EACzB,MAAM,YAAY,KAAK,UAAU,IAAI;EACrC,IAAI,CAAC,SAAS,SAAS,EAAE,YAAY,GAAG;EACxC,SAAS,QAAQ,gBAAgB,SAAS;CAC3C;CACA,OAAO;AACR;;;;ACpIA,MAAa,sBAAsB;CAAC;CAAM;CAAkB;AAAiB;;AAG7E,MAAa,wBAAwB;CAAC;CAAe;CAAmB;AAAgB;;AAiBxF,MAAa,8BAA8B,CACzC,GAAG;CAdH,GAAG;CACH;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AAKG,GACH,GAAG,qBACL;;AAGA,MAAa,qCAAqC,CAChD,yBACA,wBACF;AASA,SAAgB,mBAAmB,IAAI;CACrC,OAAO,oBAAoB,MAAM,QAAQ,OAAO,OAAO,GAAG,WAAW,GAAG,IAAI,EAAE,CAAC;AACjF;AAEA,SAAS,YAAY,IAAI;CACvB,IAAI,GAAG,WAAW,GAAG,GAAG;EACtB,MAAM,CAAC,OAAO,QAAQ,GAAG,MAAM,GAAG;EAClC,OAAO,OAAO,GAAG,MAAM,GAAG,SAAS;CACrC;CAEA,OAAO,GAAG,MAAM,GAAG,EAAE,MAAM;AAC7B;AAEA,SAAS,kBAAkB,IAAI;CAC7B,MAAM,OAAO,YAAY,EAAE;CAC3B,IAAI,mBAAmB,IAAI,GACzB,OAAO;CAGT,IAAI,KAAK,WAAW,eAAe,GACjC,OAAO;CAGT,IAAI,SAAS,iBAAiB,KAAK,WAAW,eAAe,GAC3D,OAAO;CAGT,OAAO;AACT;;AAGA,SAAgB,yBAAyB;CACvC,OAAO;EACL,eAAe,QAAQ;EACvB,aAAa;GAAC,GAAG;GAAqB;GAAmB,GAAG;EAAqB;EACjF,YAAY;CACd;AACF;;AAGA,SAAgB,yBAAyB;CACvC,OAAO;EACL,eAAe,IAAI,cAAc;GAC/B,IAAI,GAAG,WAAW,GAAG,KAAK,GAAG,WAAW,GAAG,KAAK,UAAU,EAAE,GAC1D,OAAO;GAGT,OAAO,kBAAkB,EAAE,IAAI,OAAO;EACxC;EACA,aAAa;GAAC,GAAG;GAAqB;GAAmB,GAAG;EAAqB;EACjF,YAAY;CACd;AACF;;;;;;AAOA,SAAgB,yBAAyB;CACvC,OAAO;EACL,cAAc,CAAC,iBAAiB;EAChC,aAAa,CAAC,GAAG,2BAA2B;EAC5C,YAAY;CACd;AACF;AAG+C,CAC7C,GAAG,kCAEL;;;ACrGA,MAAa,mBAAmB;CAC9B,QAAQ,CAAC,OAAO,KAAK;CACrB,KAAK;CACL,OAAO;CACP,WAAW;CACX,QAAQ;CACR,MAAM,uBAAuB;AAC/B;AASQ,uBAAuB;;;ACnB/B,SAAS,YAAY,aAAa,OAAO,MAAM;CAC9C,MAAM,SAAS,QAAQ,KAAK,aAAa,OAAO,IAAI,IAAI,KAAK,aAAa,IAAI;CAC9E,IAAI,WAAW,KAAK,QAAQ,cAAc,CAAC,GAAG,OAAO;CACrD,MAAM,UAAU,KAAK,aAAa,OAAO;CACzC,IAAI,CAAC,WAAW,OAAO,GAAG,OAAO;CACjC,KAAK,MAAM,SAAS,YAAY,OAAO,GAAG;EACzC,MAAM,YAAY,QAAQ,KAAK,SAAS,OAAO,gBAAgB,OAAO,IAAI,IAAI,KAAK,SAAS,OAAO,gBAAgB,IAAI;EACvH,IAAI,WAAW,KAAK,WAAW,cAAc,CAAC,GAAG,OAAO;CACzD;CACA,OAAO;AACR;;AAEA,SAAS,4BAA4B,oBAAoB,cAAc;CACtE,MAAM,UAAU,YAAY,oBAAoB,gBAAgB,OAAO;CACvE,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,iDAAiD;CAC/E,MAAM,WAAW,KAAK,SAAS,YAAY;CAC3C,IAAI,CAAC,WAAW,QAAQ,GAAG,MAAM,IAAI,MAAM,yCAAyC,cAAc;CAClG,OAAO;AACR;AA8BA,MAAM,gBAAgB;AACtB,MAAM,iBAAiB,KAAK,cAAc;AAC1C,SAAS,sBAAsB,KAAK;CACnC,IAAI,CAAC,WAAW,GAAG,GAAG,OAAO,CAAC;CAC9B,MAAM,QAAQ,CAAC;CACf,KAAK,MAAM,QAAQ,YAAY,GAAG,GAAG;EACpC,MAAM,OAAO,KAAK,KAAK,IAAI;EAC3B,IAAI,SAAS,IAAI,EAAE,YAAY,GAAG,MAAM,KAAK,GAAG,sBAAsB,IAAI,CAAC;OACtE,IAAI,cAAc,KAAK,IAAI,KAAK,CAAC,4BAA4B,KAAK,IAAI,GAAG,MAAM,KAAK,IAAI;CAC9F;CACA,OAAO;AACR;AACA,SAAS,kBAAkB,KAAK,aAAa,QAAQ;CACpD,MAAM,UAAU,CAAC;CACjB,KAAK,MAAM,YAAY,sBAAsB,GAAG,GAAG;EAClD,MAAM,KAAK,gBAAgB,KAAK,UAAU,EAAE,YAAY,CAAC;EACzD,IAAI,CAAC,IAAI;EACT,QAAQ,GAAG,OAAO,GAAG,QAAQ;CAC9B;CACA,OAAO;AACR;AACA,SAAS,kBAAkB,UAAU;CACpC,OAAO,kBAAkB,KAAK,UAAU,QAAQ,EAAE;AACnD;;AAEA,SAAS,kBAAkB,SAAS;CACnC,MAAM,SAAS,QAAQ,UAAU;CACjC,IAAI,WAAW;CACf,OAAO;EACN,MAAM;EACN,aAAa;GACZ,WAAW,cAAc,QAAQ,MAAM,MAAM;EAC9C;EACA,UAAU,QAAQ;GACjB,IAAI,WAAW,eAAe,OAAO;GACrC,OAAO,GAAG,eAAe;EAC1B;EACA,KAAK,IAAI;GACR,IAAI,OAAO,GAAG,eAAe,aAAa,CAAC,UAAU,OAAO;GAC5D,OAAO,kBAAkB,QAAQ;EAClC;EACA,WAAW;GACV,IAAI,CAAC,UAAU;GACf,MAAM,SAAS,KAAK,QAAQ,MAAM,QAAQ,UAAU,QAAQ,YAAY;GACxE,UAAU,QAAQ,EAAE,WAAW,KAAK,CAAC;GACrC,cAAc,KAAK,QAAQ,YAAY,GAAG,kBAAkB,QAAQ,CAAC;EACtE;CACD;AACD;;AAEA,SAAS,qBAAqB,UAAU,CAAC,GAAG;CAC3C,MAAM,OAAO,QAAQ,QAAQ,QAAQ,IAAI;CACzC,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,UAAU,KAAK,MAAM,MAAM;CACjC,MAAM,cAAc,WAAW,KAAK,MAAM,qBAAqB,CAAC,IAAI,KAAK,MAAM,qBAAqB,IAAI,KAAK;CAC7G,MAAM,UAAU;EACf,GAAG,cAAc,EAAE,QAAQ,YAAY,IAAI,CAAC;EAC5C,GAAG,kBAAkB,KAAK,SAAS,QAAQ,GAAG,SAAS,QAAQ;EAC/D,GAAG,kBAAkB,KAAK,SAAS,WAAW,GAAG,YAAY,WAAW;EACxE,GAAG,kBAAkB,KAAK,SAAS,UAAU,GAAG,WAAW,UAAU;CACtE;CACA,IAAI,OAAO,KAAK,OAAO,EAAE,WAAW,GAAG,MAAM,IAAI,MAAM,kEAAkE;CACzH,OAAO,YAAY,kBAAkB;EACpC,OAAO;EACP,QAAQ,CAAC,KAAK;EACd,QAAQ,KAAK,MAAM,MAAM;EACzB,OAAO,QAAQ,SAAS;EACxB,KAAK;EACL,QAAQ,EAAE,OAAO,OAAO;EACxB,MAAM,uBAAuB;EAC7B,SAAS,CAAC,kBAAkB;GAC3B;GACA;GACA;EACD,CAAC,CAAC;CACH,CAAC;AACF;;AAEA,eAAe,SAAS,UAAU,CAAC,GAAG;CACrC,MAAM,OAAO,QAAQ,QAAQ,QAAQ,IAAI;CACzC,MAAM,WAAW,QAAQ,IAAI;CAC7B,IAAI;EACH,QAAQ,MAAM,IAAI;EAClB,MAAM,MAAM,qBAAqB;GAChC,GAAG;GACH;EACD,CAAC,CAAC;CACH,UAAU;EACT,QAAQ,MAAM,QAAQ;CACvB;AACD;;;;;;;AAOA,eAAe,SAAS,UAAU,CAAC,GAAG;CACrC,MAAM,EAAE,gBAAgB,MAAM,OAAO;CACrC,MAAM,YAAY,UAAU,OAAO;AACpC"}
+{"version":3,"file":"dist-uZuvgIVp.mjs","names":["z.object","z.string","z.array"],"sources":["../../../packages/sandbox/dist/files-B0H9_dP4.mjs","../../../packages/tsdown-config/deps.js","../../../packages/tsdown-config/index.js","../../../packages/build/dist/index.mjs"],"sourcesContent":["import { basename, dirname, join, relative, resolve } from \"node:path\";\nimport { access, mkdir, writeFile } from \"node:fs/promises\";\nimport { z } from \"zod\";\nimport { existsSync, readFileSync, readdirSync, statSync } from \"node:fs\";\nimport { fileURLToPath } from \"node:url\";\n//#region src/sandbox-dirs.ts\nfunction resolveSandboxRoot(workspacesRoot, scope) {\n\tif (scope.type === \"agent\") return join(workspacesRoot, scope.agentId);\n\treturn join(workspacesRoot, \"runs\", scope.runId);\n}\nasync function ensureWorkspaceDir(workspaceRoot) {\n\tawait mkdir(workspaceRoot, { recursive: true });\n}\n//#endregion\n//#region src/files/schemas.ts\nconst SandboxFileContentSchema = z.object({\n\tpath: z.string(),\n\tfile: z.string()\n});\n/** Destination path under `/workspace`. For `dir`, used as a prefix. */\nconst SandboxFileSchema = z.object({\n\tpath: z.string(),\n\t/** Single file body — typically from a build-time import (`import doc from \"./doc.md\"`). */\n\tfile: z.string().optional(),\n\t/** Directory contents — each path is relative to `path`. */\n\tdir: z.array(SandboxFileContentSchema).optional()\n});\nconst SandboxDefinitionSchema = z.object({\n\tkey: z.string().optional(),\n\tfiles: z.array(SandboxFileSchema).optional()\n});\n//#endregion\n//#region src/files/define-sandbox.ts\n/** Define a reusable sandbox file layout. */\nfunction defineSandbox(def) {\n\treturn def;\n}\n//#endregion\n//#region src/files/flatten-sandbox-files.ts\n/** Expand directory entries into flat `{ path, file }` records under `/workspace`. */\nfunction flattenSandboxFiles(files) {\n\tif (!files?.length) return [];\n\tconst flattened = [];\n\tfor (const entry of files) {\n\t\tif (entry.dir !== void 0) {\n\t\t\tconst prefix = entry.path.replace(/\\/+$/, \"\");\n\t\t\tfor (const child of entry.dir) flattened.push({\n\t\t\t\tpath: prefix ? `${prefix}/${child.path}` : child.path,\n\t\t\t\tfile: child.file\n\t\t\t});\n\t\t\tcontinue;\n\t\t}\n\t\tif (entry.file === void 0) continue;\n\t\tflattened.push({\n\t\t\tpath: entry.path,\n\t\t\tfile: entry.file\n\t\t});\n\t}\n\treturn flattened;\n}\n//#endregion\n//#region src/files/materialize-sandbox.ts\nasync function materializeSandbox(options) {\n\tconst root = resolveSandboxRoot(options.workspacesRoot, options.scope);\n\tawait ensureWorkspaceDir(root);\n\tconst files = flattenSandboxFiles(options.definition?.files);\n\tif (files.length) await applySandboxFiles(root, files, options.scope);\n\treturn {\n\t\troot,\n\t\tscope: options.scope,\n\t\t...options.definition !== void 0 ? { definition: options.definition } : {}\n\t};\n}\nasync function applySandboxFiles(root, files, scope) {\n\tfor (const entry of files) {\n\t\tconst hostPath = resolve(root, entry.path);\n\t\tif (scope.type === \"agent\") try {\n\t\t\tawait access(hostPath);\n\t\t\tcontinue;\n\t\t} catch {}\n\t\tawait mkdir(dirname(hostPath), { recursive: true });\n\t\tawait writeFile(hostPath, entry.file);\n\t}\n}\n//#endregion\n//#region src/files/pack-dir.ts\nconst SKIP_DIRS$1 = new Set([\".git\", \"node_modules\"]);\n/** Recursively read a host file or directory into sandbox-relative `{ path, file }` entries. */\nfunction packDirFromDisk(rootPath) {\n\tconst stat = statSync(rootPath);\n\tif (stat.isFile()) return [{\n\t\tpath: basename(rootPath),\n\t\tfile: readFileSync(rootPath, \"utf8\")\n\t}];\n\tif (!stat.isDirectory()) throw new Error(`Expected a file or directory at ${rootPath}`);\n\tconst files = [];\n\twalkDir(rootPath, rootPath, files);\n\treturn files;\n}\nfunction walkDir(rootPath, currentPath, files) {\n\tfor (const name of readdirSync(currentPath)) {\n\t\tif (SKIP_DIRS$1.has(name)) continue;\n\t\tconst entryPath = join(currentPath, name);\n\t\tconst stat = statSync(entryPath);\n\t\tif (stat.isDirectory()) {\n\t\t\twalkDir(rootPath, entryPath, files);\n\t\t\tcontinue;\n\t\t}\n\t\tif (!stat.isFile()) continue;\n\t\tfiles.push({\n\t\t\tpath: relative(rootPath, entryPath),\n\t\t\tfile: readFileSync(entryPath, \"utf8\")\n\t\t});\n\t}\n}\n//#endregion\n//#region src/files/pack-asset-dirs.ts\nconst SKIP_DIRS = new Set([\".git\", \"node_modules\"]);\n/** Pack every subdir under `src/skills/` and `src/files/` into an asset manifest. */\nfunction packAssetDirs(appRoot, srcDir = \"src\") {\n\treturn {\n\t\tskills: packAssetRoot(join(appRoot, srcDir, \"skills\")),\n\t\tfiles: packAssetRoot(join(appRoot, srcDir, \"files\"))\n\t};\n}\nfunction packAssetRoot(rootPath) {\n\tif (!statSync(rootPath, { throwIfNoEntry: false })?.isDirectory()) return {};\n\tconst manifest = {};\n\tfor (const name of readdirSync(rootPath)) {\n\t\tif (SKIP_DIRS.has(name)) continue;\n\t\tconst entryPath = join(rootPath, name);\n\t\tif (!statSync(entryPath).isDirectory()) continue;\n\t\tmanifest[name] = packDirFromDisk(entryPath);\n\t}\n\treturn manifest;\n}\n//#endregion\n//#region src/files/resolve-app-root.ts\n/** Walk upward from a module file to find the user app root (`src/agents`, `src/skills`, etc.). */\nfunction resolveAppRoot(fromPath) {\n\tlet dir = statSync(fromPath).isDirectory() ? fromPath : dirname(fromPath);\n\twhile (dir !== dirname(dir)) {\n\t\tif (hasAppLayout(dir)) return dir;\n\t\tdir = dirname(dir);\n\t}\n\treturn process.env.KEYSTROKE_ROOT ?? process.cwd();\n}\n/** Resolve app root from an agent (or other) module URL. */\nfunction resolveAppRootFromModule(moduleUrl) {\n\treturn resolveAppRoot(fileURLToPath(moduleUrl));\n}\nfunction hasAppLayout(dir) {\n\tconst src = join(dir, \"src\");\n\tconst dist = join(dir, \"dist\");\n\treturn existsSync(join(src, \"agents\")) || existsSync(join(src, \"skills\")) || existsSync(join(src, \"files\")) || existsSync(join(dist, \"agents\")) || existsSync(join(dist, \".keystroke\", \"assets.mjs\"));\n}\n//#endregion\nexport { materializeSandbox as a, SandboxDefinitionSchema as c, ensureWorkspaceDir as d, resolveSandboxRoot as f, packDirFromDisk as i, SandboxFileContentSchema as l, resolveAppRootFromModule as n, flattenSandboxFiles as o, packAssetDirs as r, defineSandbox as s, resolveAppRoot as t, SandboxFileSchema as u };\n\n//# sourceMappingURL=files-B0H9_dP4.mjs.map","import { isBuiltin } from \"node:module\";\n\n/** Native addons kept external — resolved from the CLI runtime at app start. */\nexport const NATIVE_RUNTIME_DEPS = [\"pg\", \"better-sqlite3\", \"@parcel/watcher\"];\n\n/** Kept external so .d.ts emission does not inline internal/inferred types. */\nexport const LIBRARY_EXTERNAL_DEPS = [\"better-auth\", /^@better-auth\\//, /^better-auth\\//];\n\n/** Non-auth runtime deps kept external for published entry bundles (platform, etc.). */\nexport const BUNDLED_ENTRY_RUNTIME_EXTERNAL_DEPS = [\n  ...NATIVE_RUNTIME_DEPS,\n  \"dockerode\",\n  \"ssh2\",\n  \"cpu-features\",\n  \"microsandbox\",\n  /^@aws-sdk\\//,\n  /^@napi-rs\\//,\n  \"hono\",\n  /^@hono\\//,\n  \"undici\",\n];\n\n/** Kept external when bundling published entry points (cli, keystroke, platform). */\nexport const BUNDLED_ENTRY_EXTERNAL_DEPS = [\n  ...BUNDLED_ENTRY_RUNTIME_EXTERNAL_DEPS,\n  ...LIBRARY_EXTERNAL_DEPS,\n];\n\n/** Bundle into CLI — device login uses Better Auth client only. */\nexport const BETTER_AUTH_CLIENT_BUNDLE_PATTERNS = [\n  /^better-auth\\/client$/,\n  /^better-auth\\/client\\//,\n];\n\n/** Server adapters and root entry — must not ship in the CLI bundle. */\nexport const BETTER_AUTH_SERVER_EXTERNAL_PATTERNS = [\n  /^better-auth$/,\n  /^@better-auth\\//,\n  /^better-auth\\/(?!client(\\/|$)).+/,\n];\n\nexport function isNativeRuntimeDep(id) {\n  return NATIVE_RUNTIME_DEPS.some((dep) => id === dep || id.startsWith(`${dep}/`));\n}\n\nfunction packageName(id) {\n  if (id.startsWith(\"@\")) {\n    const [scope, name] = id.split(\"/\");\n    return name ? `${scope}/${name}` : id;\n  }\n\n  return id.split(\"/\")[0] ?? id;\n}\n\nfunction isRuntimeExternal(id) {\n  const name = packageName(id);\n  if (isNativeRuntimeDep(name)) {\n    return true;\n  }\n\n  if (name.startsWith(\"@keystrokehq/\")) {\n    return true;\n  }\n\n  if (name === \"better-auth\" || name.startsWith(\"@better-auth/\")) {\n    return true;\n  }\n\n  return false;\n}\n\n/** Library packages resolve npm deps from node_modules at runtime. */\nexport function libraryBuildDepsConfig() {\n  return {\n    alwaysBundle: (_id) => null,\n    neverBundle: [...NATIVE_RUNTIME_DEPS, /^@keystrokehq\\//, ...LIBRARY_EXTERNAL_DEPS],\n    onlyBundle: false,\n  };\n}\n\n/** Bundle npm deps into dist; resolve @keystrokehq/* and natives from the runtime. */\nexport function userAppBuildDepsConfig() {\n  return {\n    alwaysBundle: (id, _importer) => {\n      if (id.startsWith(\".\") || id.startsWith(\"/\") || isBuiltin(id)) {\n        return null;\n      }\n\n      return isRuntimeExternal(id) ? null : true;\n    },\n    neverBundle: [...NATIVE_RUNTIME_DEPS, /^@keystrokehq\\//, ...LIBRARY_EXTERNAL_DEPS],\n    onlyBundle: false,\n  };\n}\n\n/**\n * Published entry packages (cli, keystroke, platform): declare bundled @keystrokehq/*\n * in dependencies (changesets release graph ignores devDependencies). Inlining is\n * driven by alwaysBundle below, not by dep kind. Runtime npm deps stay external.\n */\nexport function bundledEntryDepsConfig() {\n  return {\n    alwaysBundle: [/^@keystrokehq\\//],\n    neverBundle: [...BUNDLED_ENTRY_EXTERNAL_DEPS],\n    onlyBundle: false,\n  };\n}\n\n/** Published CLI: inline better-auth client + @better-auth/*; keep server adapters external. */\nexport const BETTER_AUTH_CLI_BUNDLE_PATTERNS = [\n  ...BETTER_AUTH_CLIENT_BUNDLE_PATTERNS,\n  /^@better-auth\\//,\n];\n\nexport const BETTER_AUTH_CLI_EXTERNAL_PATTERNS = [\n  /^better-auth$/,\n  /^better-auth\\/(?!client(\\/|$)).+/,\n  /^@better-auth\\/drizzle-adapter/,\n  \"drizzle-orm\",\n];\n\n/** Rolldown/tsdown — native bindings; stay in CLI node_modules at runtime. */\nexport const CLI_BUILD_TOOL_EXTERNAL_PATTERNS = [\"tsdown\", \"rolldown\", /^@rolldown\\//, \"tsx\"];\n\n/** CLI: inline better-auth/client; keep server + drizzle adapters external. */\nexport function cliBundledEntryDepsConfig() {\n  return {\n    alwaysBundle: [/^@keystrokehq\\//, ...BETTER_AUTH_CLI_BUNDLE_PATTERNS],\n    neverBundle: [\n      ...BUNDLED_ENTRY_RUNTIME_EXTERNAL_DEPS,\n      ...BETTER_AUTH_CLI_EXTERNAL_PATTERNS,\n      ...CLI_BUILD_TOOL_EXTERNAL_PATTERNS,\n    ],\n    onlyBundle: false,\n  };\n}\n","import { bundledEntryDepsConfig, libraryBuildDepsConfig, userAppBuildDepsConfig } from \"./deps.js\";\n\nexport {\n  isNativeRuntimeDep,\n  NATIVE_RUNTIME_DEPS,\n  bundledEntryDepsConfig,\n  cliBundledEntryDepsConfig,\n  libraryBuildDepsConfig,\n  userAppBuildDepsConfig,\n} from \"./deps.js\";\n\nexport const baseTsdownConfig = {\n  format: [\"esm\", \"cjs\"],\n  dts: true,\n  clean: true,\n  sourcemap: true,\n  target: \"node20\",\n  deps: libraryBuildDepsConfig(),\n};\n\n/** tsdown config for published bundles (cli, keystroke, platform). */\nexport const bundledEntryTsdownConfig = {\n  format: [\"esm\", \"cjs\"],\n  dts: true,\n  clean: true,\n  sourcemap: true,\n  target: \"node20\",\n  deps: bundledEntryDepsConfig(),\n};\n","import { t as resolveModuleDirs } from \"./resolve-module-dirs-BPHQhRGy.mjs\";\nimport { existsSync, mkdirSync, readdirSync, statSync, writeFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { entryIdFromFile } from \"@keystrokehq/server/discovery\";\nimport { packAssetDirs } from \"@keystrokehq/sandbox/files\";\nimport { baseTsdownConfig, userAppBuildDepsConfig } from \"@keystrokehq/tsdown-config\";\nimport { build, mergeConfig } from \"tsdown\";\n//#region src/resolve-runtime-artifact.ts\nfunction packageRoot(nodeModules, scope, name) {\n\tconst direct = scope ? join(nodeModules, scope, name) : join(nodeModules, name);\n\tif (existsSync(join(direct, \"package.json\"))) return direct;\n\tconst pnpmDir = join(nodeModules, \".pnpm\");\n\tif (!existsSync(pnpmDir)) return null;\n\tfor (const entry of readdirSync(pnpmDir)) {\n\t\tconst candidate = scope ? join(pnpmDir, entry, \"node_modules\", scope, name) : join(pnpmDir, entry, \"node_modules\", name);\n\t\tif (existsSync(join(candidate, \"package.json\"))) return candidate;\n\t}\n\treturn null;\n}\n/** Resolve a file shipped with `@keystrokehq/build` inside the CLI runtime. */\nfunction resolveRuntimeBuildArtifact(runtimeNodeModules, relativePath) {\n\tconst pkgRoot = packageRoot(runtimeNodeModules, \"@keystrokehq\", \"build\");\n\tif (!pkgRoot) throw new Error(\"Keystroke runtime is missing @keystrokehq/build\");\n\tconst artifact = join(pkgRoot, relativePath);\n\tif (!existsSync(artifact)) throw new Error(`Keystroke runtime artifact not found: ${relativePath}`);\n\treturn artifact;\n}\n//#endregion\n//#region src/vitest-plugin.ts\nconst ASSETS_MODULE$1 = \"@keystrokehq/assets\";\nconst virtualPrefix = `\\0${ASSETS_MODULE$1}:`;\n/** Vitest plugin resolving `@keystrokehq/assets` from disk. */\nfunction agentAssetsVitestPlugin(appRoot = process.cwd()) {\n\tlet manifest = null;\n\treturn {\n\t\tname: \"keystroke-assets\",\n\t\tresolveId(source) {\n\t\t\tif (source !== ASSETS_MODULE$1) return null;\n\t\t\treturn `${virtualPrefix}manifest`;\n\t\t},\n\t\tload(id) {\n\t\t\tif (id !== `${virtualPrefix}manifest`) return null;\n\t\t\tmanifest ??= packAssetDirs(appRoot);\n\t\t\treturn `export default ${JSON.stringify(manifest)};`;\n\t\t}\n\t};\n}\nfunction findAppRootFromConfig(configFile) {\n\tif (!configFile) return process.cwd();\n\treturn dirname(configFile);\n}\nfunction agentAssetsVitestPluginFromConfig(configFile) {\n\treturn agentAssetsVitestPlugin(findAppRootFromConfig(configFile));\n}\n//#endregion\n//#region src/index.ts\nconst ASSETS_MODULE = \"@keystrokehq/assets\";\nconst VIRTUAL_PREFIX = `\\0${ASSETS_MODULE}:`;\nfunction walkTypeScriptSources(dir) {\n\tif (!existsSync(dir)) return [];\n\tconst files = [];\n\tfor (const name of readdirSync(dir)) {\n\t\tconst path = join(dir, name);\n\t\tif (statSync(path).isDirectory()) files.push(...walkTypeScriptSources(path));\n\t\telse if (/\\.(ts|mts)$/.test(name) && !/\\.(int\\.)?test\\.(ts|mts)$/.test(name)) files.push(path);\n\t}\n\treturn files;\n}\nfunction discoveredEntries(dir, nestedEntry, prefix) {\n\tconst entries = {};\n\tfor (const filePath of walkTypeScriptSources(dir)) {\n\t\tconst id = entryIdFromFile(dir, filePath, { nestedEntry });\n\t\tif (!id) continue;\n\t\tentries[`${prefix}/${id}`] = filePath;\n\t}\n\treturn entries;\n}\nfunction renderAssetModule(manifest) {\n\treturn `export default ${JSON.stringify(manifest)};\\n`;\n}\n/** Rolldown plugin: pack src/skills + src/files and expose `@keystrokehq/assets`. */\nfunction agentAssetsPlugin(options) {\n\tconst srcDir = options.srcDir ?? \"src\";\n\tlet manifest = null;\n\treturn {\n\t\tname: \"keystroke-assets\",\n\t\tbuildStart() {\n\t\t\tmanifest = packAssetDirs(options.root, srcDir);\n\t\t},\n\t\tresolveId(source) {\n\t\t\tif (source !== ASSETS_MODULE) return null;\n\t\t\treturn `${VIRTUAL_PREFIX}manifest`;\n\t\t},\n\t\tload(id) {\n\t\t\tif (id !== `${VIRTUAL_PREFIX}manifest` || !manifest) return null;\n\t\t\treturn renderAssetModule(manifest);\n\t\t},\n\t\tbuildEnd() {\n\t\t\tif (!manifest) return;\n\t\t\tconst outDir = join(options.root, options.outDir ?? \"dist\", \".keystroke\");\n\t\t\tmkdirSync(outDir, { recursive: true });\n\t\t\twriteFileSync(join(outDir, \"assets.mjs\"), renderAssetModule(manifest));\n\t\t}\n\t};\n}\n/** Full tsdown config for user keystroke apps (config + discovered modules only). */\nfunction createAppBuildConfig(options = {}) {\n\tconst root = options.root ?? process.cwd();\n\tconst srcDir = options.srcDir ?? \"src\";\n\tconst outDir = options.outDir ?? \"dist\";\n\tconst srcRoot = join(root, srcDir);\n\tconst configEntry = existsSync(join(root, \"keystroke.config.ts\")) ? join(root, \"keystroke.config.ts\") : void 0;\n\tconst entries = {\n\t\t...configEntry ? { config: configEntry } : {},\n\t\t...discoveredEntries(join(srcRoot, \"agents\"), \"agent\", \"agents\"),\n\t\t...discoveredEntries(join(srcRoot, \"workflows\"), \"workflow\", \"workflows\"),\n\t\t...discoveredEntries(join(srcRoot, \"triggers\"), \"trigger\", \"triggers\")\n\t};\n\tif (Object.keys(entries).length === 0) throw new Error(\"Nothing to build — add keystroke.config.ts or modules under src/\");\n\treturn mergeConfig(baseTsdownConfig, {\n\t\tentry: entries,\n\t\tformat: [\"esm\"],\n\t\toutDir: join(root, outDir),\n\t\tclean: options.clean ?? true,\n\t\tdts: false,\n\t\tloader: { \".md\": \"text\" },\n\t\tdeps: userAppBuildDepsConfig(),\n\t\tplugins: [agentAssetsPlugin({\n\t\t\troot,\n\t\t\tsrcDir,\n\t\t\toutDir\n\t\t})]\n\t});\n}\n/** Build user agents, workflows, triggers, and config to `dist/`. */\nasync function buildApp(options = {}) {\n\tconst root = options.root ?? process.cwd();\n\tconst previous = process.cwd();\n\ttry {\n\t\tprocess.chdir(root);\n\t\tawait build(createAppBuildConfig({\n\t\t\t...options,\n\t\t\troot\n\t\t}));\n\t} finally {\n\t\tprocess.chdir(previous);\n\t}\n}\n/**\n* Watch `src/` and rebuild `dist/` on change.\n*\n* NOT true hot reload — each change runs a full tsdown rebuild. Callers should\n* restart the API server in `onRebuild` so discovery picks up new/changed modules.\n*/\nasync function watchApp(options = {}) {\n\tconst { runWatchApp } = await import(\"./watch-app-DTIeKrbl.mjs\");\n\tawait runWatchApp(buildApp, options);\n}\n//#endregion\nexport { agentAssetsVitestPlugin, agentAssetsVitestPluginFromConfig, buildApp, createAppBuildConfig, resolveModuleDirs, resolveRuntimeBuildArtifact, watchApp };\n\n//# sourceMappingURL=index.mjs.map"],"mappings":";;;;;;;;;AAeA,MAAM,2BAA2BA,OAAS;CACzC,MAAMC,OAAS;CACf,MAAMA,OAAS;AAChB,CAAC;;AAED,MAAM,oBAAoBD,OAAS;CAClC,MAAMC,OAAS;;CAEf,MAAMA,OAAS,EAAE,SAAS;;CAE1B,KAAKC,MAAQ,wBAAwB,EAAE,SAAS;AACjD,CAAC;AAC+BF,OAAS;CACxC,KAAKC,OAAS,EAAE,SAAS;CACzB,OAAOC,MAAQ,iBAAiB,EAAE,SAAS;AAC5C,CAAC;AAwDD,MAAM,cAAc,IAAI,IAAI,CAAC,QAAQ,cAAc,CAAC;;AAEpD,SAAS,gBAAgB,UAAU;CAClC,MAAM,OAAO,SAAS,QAAQ;CAC9B,IAAI,KAAK,OAAO,GAAG,OAAO,CAAC;EAC1B,MAAM,SAAS,QAAQ;EACvB,MAAM,aAAa,UAAU,MAAM;CACpC,CAAC;CACD,IAAI,CAAC,KAAK,YAAY,GAAG,MAAM,IAAI,MAAM,mCAAmC,UAAU;CACtF,MAAM,QAAQ,CAAC;CACf,QAAQ,UAAU,UAAU,KAAK;CACjC,OAAO;AACR;AACA,SAAS,QAAQ,UAAU,aAAa,OAAO;CAC9C,KAAK,MAAM,QAAQ,YAAY,WAAW,GAAG;EAC5C,IAAI,YAAY,IAAI,IAAI,GAAG;EAC3B,MAAM,YAAY,KAAK,aAAa,IAAI;EACxC,MAAM,OAAO,SAAS,SAAS;EAC/B,IAAI,KAAK,YAAY,GAAG;GACvB,QAAQ,UAAU,WAAW,KAAK;GAClC;EACD;EACA,IAAI,CAAC,KAAK,OAAO,GAAG;EACpB,MAAM,KAAK;GACV,MAAM,SAAS,UAAU,SAAS;GAClC,MAAM,aAAa,WAAW,MAAM;EACrC,CAAC;CACF;AACD;AAGA,MAAM,YAAY,IAAI,IAAI,CAAC,QAAQ,cAAc,CAAC;;AAElD,SAAS,cAAc,SAAS,SAAS,OAAO;CAC/C,OAAO;EACN,QAAQ,cAAc,KAAK,SAAS,QAAQ,QAAQ,CAAC;EACrD,OAAO,cAAc,KAAK,SAAS,QAAQ,OAAO,CAAC;CACpD;AACD;AACA,SAAS,cAAc,UAAU;CAChC,IAAI,CAAC,SAAS,UAAU,EAAE,gBAAgB,MAAM,CAAC,GAAG,YAAY,GAAG,OAAO,CAAC;CAC3E,MAAM,WAAW,CAAC;CAClB,KAAK,MAAM,QAAQ,YAAY,QAAQ,GAAG;EACzC,IAAI,UAAU,IAAI,IAAI,GAAG;EACzB,MAAM,YAAY,KAAK,UAAU,IAAI;EACrC,IAAI,CAAC,SAAS,SAAS,EAAE,YAAY,GAAG;EACxC,SAAS,QAAQ,gBAAgB,SAAS;CAC3C;CACA,OAAO;AACR;;;;ACpIA,MAAa,sBAAsB;CAAC;CAAM;CAAkB;AAAiB;;AAG7E,MAAa,wBAAwB;CAAC;CAAe;CAAmB;AAAgB;;AAiBxF,MAAa,8BAA8B,CACzC,GAAG;CAdH,GAAG;CACH;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AAKG,GACH,GAAG,qBACL;;AAGA,MAAa,qCAAqC,CAChD,yBACA,wBACF;AASA,SAAgB,mBAAmB,IAAI;CACrC,OAAO,oBAAoB,MAAM,QAAQ,OAAO,OAAO,GAAG,WAAW,GAAG,IAAI,EAAE,CAAC;AACjF;AAEA,SAAS,YAAY,IAAI;CACvB,IAAI,GAAG,WAAW,GAAG,GAAG;EACtB,MAAM,CAAC,OAAO,QAAQ,GAAG,MAAM,GAAG;EAClC,OAAO,OAAO,GAAG,MAAM,GAAG,SAAS;CACrC;CAEA,OAAO,GAAG,MAAM,GAAG,EAAE,MAAM;AAC7B;AAEA,SAAS,kBAAkB,IAAI;CAC7B,MAAM,OAAO,YAAY,EAAE;CAC3B,IAAI,mBAAmB,IAAI,GACzB,OAAO;CAGT,IAAI,KAAK,WAAW,eAAe,GACjC,OAAO;CAGT,IAAI,SAAS,iBAAiB,KAAK,WAAW,eAAe,GAC3D,OAAO;CAGT,OAAO;AACT;;AAGA,SAAgB,yBAAyB;CACvC,OAAO;EACL,eAAe,QAAQ;EACvB,aAAa;GAAC,GAAG;GAAqB;GAAmB,GAAG;EAAqB;EACjF,YAAY;CACd;AACF;;AAGA,SAAgB,yBAAyB;CACvC,OAAO;EACL,eAAe,IAAI,cAAc;GAC/B,IAAI,GAAG,WAAW,GAAG,KAAK,GAAG,WAAW,GAAG,KAAK,UAAU,EAAE,GAC1D,OAAO;GAGT,OAAO,kBAAkB,EAAE,IAAI,OAAO;EACxC;EACA,aAAa;GAAC,GAAG;GAAqB;GAAmB,GAAG;EAAqB;EACjF,YAAY;CACd;AACF;;;;;;AAOA,SAAgB,yBAAyB;CACvC,OAAO;EACL,cAAc,CAAC,iBAAiB;EAChC,aAAa,CAAC,GAAG,2BAA2B;EAC5C,YAAY;CACd;AACF;AAG+C,CAC7C,GAAG,kCAEL;;;ACrGA,MAAa,mBAAmB;CAC9B,QAAQ,CAAC,OAAO,KAAK;CACrB,KAAK;CACL,OAAO;CACP,WAAW;CACX,QAAQ;CACR,MAAM,uBAAuB;AAC/B;AASQ,uBAAuB;;;ACnB/B,SAAS,YAAY,aAAa,OAAO,MAAM;CAC9C,MAAM,SAAS,QAAQ,KAAK,aAAa,OAAO,IAAI,IAAI,KAAK,aAAa,IAAI;CAC9E,IAAI,WAAW,KAAK,QAAQ,cAAc,CAAC,GAAG,OAAO;CACrD,MAAM,UAAU,KAAK,aAAa,OAAO;CACzC,IAAI,CAAC,WAAW,OAAO,GAAG,OAAO;CACjC,KAAK,MAAM,SAAS,YAAY,OAAO,GAAG;EACzC,MAAM,YAAY,QAAQ,KAAK,SAAS,OAAO,gBAAgB,OAAO,IAAI,IAAI,KAAK,SAAS,OAAO,gBAAgB,IAAI;EACvH,IAAI,WAAW,KAAK,WAAW,cAAc,CAAC,GAAG,OAAO;CACzD;CACA,OAAO;AACR;;AAEA,SAAS,4BAA4B,oBAAoB,cAAc;CACtE,MAAM,UAAU,YAAY,oBAAoB,gBAAgB,OAAO;CACvE,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,iDAAiD;CAC/E,MAAM,WAAW,KAAK,SAAS,YAAY;CAC3C,IAAI,CAAC,WAAW,QAAQ,GAAG,MAAM,IAAI,MAAM,yCAAyC,cAAc;CAClG,OAAO;AACR;AA8BA,MAAM,gBAAgB;AACtB,MAAM,iBAAiB,KAAK,cAAc;AAC1C,SAAS,sBAAsB,KAAK;CACnC,IAAI,CAAC,WAAW,GAAG,GAAG,OAAO,CAAC;CAC9B,MAAM,QAAQ,CAAC;CACf,KAAK,MAAM,QAAQ,YAAY,GAAG,GAAG;EACpC,MAAM,OAAO,KAAK,KAAK,IAAI;EAC3B,IAAI,SAAS,IAAI,EAAE,YAAY,GAAG,MAAM,KAAK,GAAG,sBAAsB,IAAI,CAAC;OACtE,IAAI,cAAc,KAAK,IAAI,KAAK,CAAC,4BAA4B,KAAK,IAAI,GAAG,MAAM,KAAK,IAAI;CAC9F;CACA,OAAO;AACR;AACA,SAAS,kBAAkB,KAAK,aAAa,QAAQ;CACpD,MAAM,UAAU,CAAC;CACjB,KAAK,MAAM,YAAY,sBAAsB,GAAG,GAAG;EAClD,MAAM,KAAK,gBAAgB,KAAK,UAAU,EAAE,YAAY,CAAC;EACzD,IAAI,CAAC,IAAI;EACT,QAAQ,GAAG,OAAO,GAAG,QAAQ;CAC9B;CACA,OAAO;AACR;AACA,SAAS,kBAAkB,UAAU;CACpC,OAAO,kBAAkB,KAAK,UAAU,QAAQ,EAAE;AACnD;;AAEA,SAAS,kBAAkB,SAAS;CACnC,MAAM,SAAS,QAAQ,UAAU;CACjC,IAAI,WAAW;CACf,OAAO;EACN,MAAM;EACN,aAAa;GACZ,WAAW,cAAc,QAAQ,MAAM,MAAM;EAC9C;EACA,UAAU,QAAQ;GACjB,IAAI,WAAW,eAAe,OAAO;GACrC,OAAO,GAAG,eAAe;EAC1B;EACA,KAAK,IAAI;GACR,IAAI,OAAO,GAAG,eAAe,aAAa,CAAC,UAAU,OAAO;GAC5D,OAAO,kBAAkB,QAAQ;EAClC;EACA,WAAW;GACV,IAAI,CAAC,UAAU;GACf,MAAM,SAAS,KAAK,QAAQ,MAAM,QAAQ,UAAU,QAAQ,YAAY;GACxE,UAAU,QAAQ,EAAE,WAAW,KAAK,CAAC;GACrC,cAAc,KAAK,QAAQ,YAAY,GAAG,kBAAkB,QAAQ,CAAC;EACtE;CACD;AACD;;AAEA,SAAS,qBAAqB,UAAU,CAAC,GAAG;CAC3C,MAAM,OAAO,QAAQ,QAAQ,QAAQ,IAAI;CACzC,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,UAAU,KAAK,MAAM,MAAM;CACjC,MAAM,cAAc,WAAW,KAAK,MAAM,qBAAqB,CAAC,IAAI,KAAK,MAAM,qBAAqB,IAAI,KAAK;CAC7G,MAAM,UAAU;EACf,GAAG,cAAc,EAAE,QAAQ,YAAY,IAAI,CAAC;EAC5C,GAAG,kBAAkB,KAAK,SAAS,QAAQ,GAAG,SAAS,QAAQ;EAC/D,GAAG,kBAAkB,KAAK,SAAS,WAAW,GAAG,YAAY,WAAW;EACxE,GAAG,kBAAkB,KAAK,SAAS,UAAU,GAAG,WAAW,UAAU;CACtE;CACA,IAAI,OAAO,KAAK,OAAO,EAAE,WAAW,GAAG,MAAM,IAAI,MAAM,kEAAkE;CACzH,OAAO,YAAY,kBAAkB;EACpC,OAAO;EACP,QAAQ,CAAC,KAAK;EACd,QAAQ,KAAK,MAAM,MAAM;EACzB,OAAO,QAAQ,SAAS;EACxB,KAAK;EACL,QAAQ,EAAE,OAAO,OAAO;EACxB,MAAM,uBAAuB;EAC7B,SAAS,CAAC,kBAAkB;GAC3B;GACA;GACA;EACD,CAAC,CAAC;CACH,CAAC;AACF;;AAEA,eAAe,SAAS,UAAU,CAAC,GAAG;CACrC,MAAM,OAAO,QAAQ,QAAQ,QAAQ,IAAI;CACzC,MAAM,WAAW,QAAQ,IAAI;CAC7B,IAAI;EACH,QAAQ,MAAM,IAAI;EAClB,MAAM,MAAM,qBAAqB;GAChC,GAAG;GACH;EACD,CAAC,CAAC;CACH,UAAU;EACT,QAAQ,MAAM,QAAQ;CACvB;AACD;;;;;;;AAOA,eAAe,SAAS,UAAU,CAAC,GAAG;CACrC,MAAM,EAAE,gBAAgB,MAAM,OAAO;CACrC,MAAM,YAAY,UAAU,OAAO;AACpC"}

package/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { a as array, c as discriminatedUnion, d as object, f as record, g as _coercedNumber, h as unknown, i as _enum, l as literal, m as union, n as ZodNumber, o as boolean, p as string, r as ZodType, s as custom, t as entryIdFromFile, u as number$1 } from "./discovery-XqwkB9H_-CQLSzR72.mjs";
+import { _ as _coercedNumber, a as array, c as discriminatedUnion, d as object, f as record, g as url, h as unknown, i as _enum, l as literal, m as union, n as ZodNumber, o as boolean, p as string, r as ZodType, s as custom, t as entryIdFromFile, u as number$1 } from "./discovery-XqwkB9H_-C2XdYbG2.mjs";
 import { a as installPlaygroundDependencies, i as installDependencies, n as buildPlaygroundWorkspace, o as resolvePackageManager, s as resolveCliRoot, t as readCliVersion } from "./version-DESgLEkE.mjs";
 import { createRequire } from "node:module";
 import { Command } from "commander";
@@ -2603,6 +2603,16 @@ const ListOrganizationInvitationsResponseSchema = object({ invitations: array(ob
 })) });
 const AcceptOrganizationInvitationResponseSchema = object({ organization: UserOrganizationSchema });
 const DeclineOrganizationInvitationResponseSchema = object({ success: literal(true) });
+/** Custom avatar override; null means fall back to OAuth `users.image`. */
+const UserAvatarSchema = object({ url: url().nullable() });
+const UserAvatarPatchSchema = object({ 
+/** Storage key returned from presign; null removes the custom override. */
+storageKey: string().min(1).nullable() });
+const PresignUserAvatarRequestSchema = object({ contentType: string().trim().min(1) });
+const PresignUserAvatarResponseSchema = object({
+	uploadUrl: url(),
+	storageKey: string().min(1)
+});
 const ProjectArtifactStatusSchema = _enum(["pending", "ready"]);
 const isoDateTime$1 = string().datetime();
 const ProjectArtifactSchema = object({
@@ -5171,8 +5181,8 @@ const DEFAULT_PROJECT_SETTINGS = {
 	defaultRole: "editor",
 	invitePermission: "admin"
 };
-const MOCK_STORAGE_KEY$4 = "keystroke:mock-project-settings:v1";
-function getBrowserLocalStorage$4() {
+const MOCK_STORAGE_KEY$3 = "keystroke:mock-project-settings:v1";
+function getBrowserLocalStorage$3() {
 	if (typeof globalThis !== "object") return null;
 	return globalThis.localStorage ?? null;
 }
@@ -5198,10 +5208,10 @@ function mergeProjectSettings(current, patch) {
 	});
 }
 function readSettingsStore() {
-	const localStorage = getBrowserLocalStorage$4();
+	const localStorage = getBrowserLocalStorage$3();
 	if (!localStorage) return {};
 	try {
-		const raw = localStorage.getItem(MOCK_STORAGE_KEY$4);
+		const raw = localStorage.getItem(MOCK_STORAGE_KEY$3);
 		if (!raw) return {};
 		const parsed = JSON.parse(raw);
 		if (!parsed || typeof parsed !== "object") return {};
@@ -5211,10 +5221,10 @@ function readSettingsStore() {
 	}
 }
 function writeSettingsStore(store) {
-	const localStorage = getBrowserLocalStorage$4();
+	const localStorage = getBrowserLocalStorage$3();
 	if (!localStorage) return;
 	try {
-		localStorage.setItem(MOCK_STORAGE_KEY$4, JSON.stringify(store));
+		localStorage.setItem(MOCK_STORAGE_KEY$3, JSON.stringify(store));
 	} catch {}
 }
 function requireProjectId(projectId) {
@@ -7717,8 +7727,8 @@ function createHistoryResource() {
 		}, async (runId) => cancelHistoryRun(runId))
 	};
 }
-const MOCK_STORAGE_KEY$3 = "keystroke:mock-organization-sidebar-branding:v1";
-function getBrowserLocalStorage$3() {
+const MOCK_STORAGE_KEY$2 = "keystroke:mock-organization-sidebar-branding:v1";
+function getBrowserLocalStorage$2() {
 	if (typeof globalThis !== "object") return null;
 	return globalThis.localStorage ?? null;
 }
@@ -7761,10 +7771,10 @@ function mergeOrganizationSidebarBranding(current, patch) {
 	});
 }
 function readBrandingStore() {
-	const localStorage = getBrowserLocalStorage$3();
+	const localStorage = getBrowserLocalStorage$2();
 	if (!localStorage) return {};
 	try {
-		const raw = localStorage.getItem(MOCK_STORAGE_KEY$3);
+		const raw = localStorage.getItem(MOCK_STORAGE_KEY$2);
 		if (!raw) return {};
 		const parsed = JSON.parse(raw);
 		if (!parsed || typeof parsed !== "object") return {};
@@ -7774,10 +7784,10 @@ function readBrandingStore() {
 	}
 }
 function writeBrandingStore(store) {
-	const localStorage = getBrowserLocalStorage$3();
+	const localStorage = getBrowserLocalStorage$2();
 	if (!localStorage) return;
 	try {
-		localStorage.setItem(MOCK_STORAGE_KEY$3, JSON.stringify(store));
+		localStorage.setItem(MOCK_STORAGE_KEY$2, JSON.stringify(store));
 	} catch {}
 }
 function resolveOrganizationId(getActiveOrganizationId) {
@@ -7811,8 +7821,8 @@ function createOrganizationSidebarBrandingResource(options) {
 		})
 	};
 }
-const MOCK_STORAGE_KEY$2 = "keystroke:mock-user-preferences:v1";
-function getBrowserLocalStorage$2() {
+const MOCK_STORAGE_KEY$1 = "keystroke:mock-user-preferences:v1";
+function getBrowserLocalStorage$1() {
 	if (typeof globalThis !== "object") return null;
 	return globalThis.localStorage ?? null;
 }
@@ -7920,10 +7930,10 @@ function mergeUserPreferences(current, patch) {
 	});
 }
 function readPreferencesStore() {
-	const localStorage = getBrowserLocalStorage$2();
+	const localStorage = getBrowserLocalStorage$1();
 	if (!localStorage) return {};
 	try {
-		const raw = localStorage.getItem(MOCK_STORAGE_KEY$2);
+		const raw = localStorage.getItem(MOCK_STORAGE_KEY$1);
 		if (!raw) return {};
 		const parsed = JSON.parse(raw);
 		if (!parsed || typeof parsed !== "object") return {};
@@ -7934,13 +7944,13 @@ function readPreferencesStore() {
 	}
 }
 function writePreferencesStore(store) {
-	const localStorage = getBrowserLocalStorage$2();
+	const localStorage = getBrowserLocalStorage$1();
 	if (!localStorage) return;
 	try {
-		localStorage.setItem(MOCK_STORAGE_KEY$2, JSON.stringify(store));
+		localStorage.setItem(MOCK_STORAGE_KEY$1, JSON.stringify(store));
 	} catch {}
 }
-function resolveUserId$1(getCurrentUserId) {
+function resolveUserId(getCurrentUserId) {
 	const userId = getCurrentUserId()?.trim();
 	if (!userId) throw new Error("User preferences require an authenticated user");
 	return userId;
@@ -7952,7 +7962,7 @@ function createUserPreferencesResource(options) {
 			method: "get",
 			plannedEndpoint: "GET /api/account/preferences"
 		}, async () => {
-			const userId = resolveUserId$1(options.getCurrentUserId ?? (() => null));
+			const userId = resolveUserId(options.getCurrentUserId ?? (() => null));
 			return readPreferencesStore()[userId] ?? DEFAULT_USER_PREFERENCES;
 		}),
 		update: mock({
@@ -7960,7 +7970,7 @@ function createUserPreferencesResource(options) {
 			method: "update",
 			plannedEndpoint: "PATCH /api/account/preferences"
 		}, async (patch) => {
-			const userId = resolveUserId$1(options.getCurrentUserId ?? (() => null));
+			const userId = resolveUserId(options.getCurrentUserId ?? (() => null));
 			const store = readPreferencesStore();
 			const next = mergeUserPreferences(store[userId] ?? DEFAULT_USER_PREFERENCES, patch);
 			writePreferencesStore({
@@ -7971,66 +7981,48 @@ function createUserPreferencesResource(options) {
 		})
 	};
 }
-const DEFAULT_USER_AVATAR = { dataUrl: null };
-const MOCK_STORAGE_KEY$1 = "keystroke:mock-user-avatar:v1";
-function getBrowserLocalStorage$1() {
-	if (typeof globalThis !== "object") return null;
-	return globalThis.localStorage ?? null;
-}
-function normalizeUserAvatar(value) {
-	if (!value || typeof value !== "object") return DEFAULT_USER_AVATAR;
-	const dataUrl = value.dataUrl;
-	return { dataUrl: typeof dataUrl === "string" && dataUrl.length > 0 ? dataUrl : null };
-}
-function readAvatarStore() {
-	const localStorage = getBrowserLocalStorage$1();
-	if (!localStorage) return {};
-	try {
-		const raw = localStorage.getItem(MOCK_STORAGE_KEY$1);
-		if (!raw) return {};
-		const parsed = JSON.parse(raw);
-		if (!parsed || typeof parsed !== "object") return {};
-		return Object.fromEntries(Object.entries(parsed).map(([userId, value]) => [userId, normalizeUserAvatar(value)]));
-	} catch {
-		return {};
+function createUserAvatarResource(http) {
+	async function presignUpload(contentType) {
+		const body = PresignUserAvatarRequestSchema.parse({ contentType });
+		const data = await http.post("/api/avatar/presign", { json: body }).json();
+		return PresignUserAvatarResponseSchema.parse(data);
 	}
-}
-function writeAvatarStore(store) {
-	const localStorage = getBrowserLocalStorage$1();
-	if (!localStorage) return;
-	try {
-		localStorage.setItem(MOCK_STORAGE_KEY$1, JSON.stringify(store));
-	} catch {}
-}
-function resolveUserId(getCurrentUserId) {
-	const userId = getCurrentUserId()?.trim();
-	if (!userId) throw new Error("User avatar requires an authenticated user");
-	return userId;
-}
-function createUserAvatarResource(options) {
 	return {
-		get: mock({
-			domain: "userAvatar",
-			method: "get",
-			plannedEndpoint: "GET /api/account/avatar"
-		}, async () => {
-			const userId = resolveUserId(options.getCurrentUserId ?? (() => null));
-			return readAvatarStore()[userId] ?? DEFAULT_USER_AVATAR;
-		}),
-		update: mock({
-			domain: "userAvatar",
-			method: "update",
-			plannedEndpoint: "PATCH /api/account/avatar"
-		}, async (patch) => {
-			const userId = resolveUserId(options.getCurrentUserId ?? (() => null));
-			const store = readAvatarStore();
-			const next = normalizeUserAvatar({ dataUrl: patch.dataUrl });
-			writeAvatarStore({
-				...store,
-				[userId]: next
-			});
-			return next;
-		})
+		async get() {
+			try {
+				const data = await http.get("/api/avatar").json();
+				return UserAvatarSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async upload(file) {
+			const contentType = file.type?.trim() || "application/octet-stream";
+			try {
+				const { uploadUrl, storageKey } = await presignUpload(contentType);
+				if (!(await fetch(uploadUrl, {
+					method: "PUT",
+					body: file,
+					headers: { "Content-Type": contentType }
+				})).ok) throw new Error("Avatar upload failed");
+				return await this.update({ storageKey });
+			} catch (error) {
+				if (error instanceof Error && error.message === "Avatar upload failed") throw error;
+				throw await toPlatformError(error);
+			}
+		},
+		async remove() {
+			return this.update({ storageKey: null });
+		},
+		async update(patch) {
+			const body = UserAvatarPatchSchema.parse(patch);
+			try {
+				const data = await http.patch("/api/avatar", { json: body }).json();
+				return UserAvatarSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		}
 	};
 }
 const CHANNEL_PLATFORMS = [
@@ -8643,7 +8635,7 @@ function createPlatformClient(options) {
 		apiKeys: createApiKeysResource(),
 		recents: createRecentsResource(),
 		userPreferences: createUserPreferencesResource({ getCurrentUserId: options.getCurrentUserId }),
-		userAvatar: createUserAvatarResource({ getCurrentUserId: options.getCurrentUserId }),
+		userAvatar: createUserAvatarResource(http),
 		organizationSidebarBranding: createOrganizationSidebarBrandingResource({ getActiveOrganizationId: () => activeOrganizationId }),
 		getActiveOrganizationId: () => activeOrganizationId,
 		setActiveOrganizationId
@@ -9407,7 +9399,7 @@ function registerBuildCommand(program) {
 	program.command("build").description("Build the keystroke project for production").option("--dir <path>", "Project directory", process.cwd()).action(async (options) => {
 		try {
 			const root = resolveProjectRoot(options.dir);
-			const { buildApp } = await import("./dist-IKyaKHgU.mjs");
+			const { buildApp } = await import("./dist-uZuvgIVp.mjs");
 			await buildApp({ root });
 			process.stdout.write(`Built ${root}\n`);
 		} catch (error) {
@@ -9599,7 +9591,7 @@ async function runDeploy(options) {
 	const config = createCliConfig();
 	const client = createCliPlatformClient(config);
 	if (!options.skipBuild) {
-		const { buildApp } = await import("./dist-IKyaKHgU.mjs");
+		const { buildApp } = await import("./dist-uZuvgIVp.mjs");
 		await buildApp({ root });
 	}
 	const archive = packProjectArtifact(root);
@@ -9697,7 +9689,7 @@ function runtimeChildEnv(parentEnv, overrides) {
 //#region src/project/bootstrap-run.ts
 /** Node args + env for `@keystrokehq/build` bootstrap (shared by start + dev). */
 async function resolveBootstrapRun(options) {
-	const { resolveRuntimeBuildArtifact } = await import("./dist-IKyaKHgU.mjs");
+	const { resolveRuntimeBuildArtifact } = await import("./dist-uZuvgIVp.mjs");
 	const loader = pathToFileURL(resolveRuntimeBuildArtifact(options.runtimeNodeModules, "dist/runtime-loader.mjs")).href;
 	const bootstrap = resolveRuntimeBuildArtifact(options.runtimeNodeModules, "dist/bootstrap.mjs");
 	const args = [`--import=${loader}`];
@@ -9847,7 +9839,7 @@ async function runDev(options) {
 	process.on("SIGINT", shutdown);
 	process.on("SIGTERM", shutdown);
 	try {
-		const { watchApp } = await import("./dist-IKyaKHgU.mjs");
+		const { watchApp } = await import("./dist-uZuvgIVp.mjs");
 		await watchApp({
 			root,
 			clean: false,
@@ -10269,7 +10261,7 @@ async function runStart(options) {
 	const apiPort = Number(new URL(serverUrl).port || 80);
 	const runtimeNodeModules = resolveCliRuntimeNodeModules(resolveCliRoot(import.meta.url));
 	ensureNativeDeps(runtimeNodeModules);
-	const { buildApp } = await import("./dist-IKyaKHgU.mjs");
+	const { buildApp } = await import("./dist-uZuvgIVp.mjs");
 	await buildApp({
 		root,
 		clean: false