@keystrokehq/cli 0.0.148 → 0.0.149

package/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { $ as ProjectSlugAvailabilityResponseSchema, A as InviteOrganizationMembersRequestSchema, At as WorkflowSummaryDetailResponseSchema, B as ListProjectsResponseSchema, C as GatewayAttachmentRecordSchema, Ct as UpsertGatewayAttachmentBodySchema, D as HistoryRunDetailResponseSchema, Dt as UserPreferencesSchema, E as HistoryRunCancelResponseSchema, Et as UserPreferencesPatchSchema, F as ListOrganizationMembersResponseSchema, Ft as parseErrorResponse, G as PresignOrgLogoRequestSchema, H as OrganizationSidebarBrandingSchema, I as ListOrganizationsResponseSchema, J as PresignProjectSourceResponseSchema, K as PresignOrgLogoResponseSchema, L as ListProjectDeploymentsResponseSchema, M as ListAppsResponseSchema, Mt as listenPortFromPublicUrl, N as ListCredentialsResponseSchema, O as HistoryRunListQuerySchema, Ot as WorkflowRunDetailResponseSchema, P as ListOrganizationInvitationsResponseSchema, Pt as originFromPublicUrl, Q as ProjectResponseSchema, R as ListProjectFilesResponseSchema, S as ErrorResponseSchema, St as UploadProjectSourceResponseSchema, T as HealthResponseSchema, Tt as UserAvatarSchema, U as PROJECT_REACHABILITY_REQUEST_TIMEOUT_MS, V as OrganizationSidebarBrandingPatchSchema, W as PollRunResponseSchema, X as PresignUserAvatarResponseSchema, Y as PresignUserAvatarRequestSchema, Z as ProjectReachabilityResponseSchema, _ as CreateProjectRequestSchema, _t as UpdateOrganizationMemberRequestSchema, a as AgentSessionListResponseSchema, at as RecentResourceListResponseSchema, b as CredentialInstanceRecordSchema, bt as UpdateProjectRequestSchema, c as CompleteProjectArtifactResponseSchema, ct as SlugAvailabilityResponseSchema, d as CreateCredentialInstanceBodySchema, dt as TriggerDetailResponseSchema, et as PromptInputSchema, f as CreateCredentialsRequestSchema, ft as TriggerListResponseSchema, g as CreateProjectArtifactResponseSchema, gt as UpdateCredentialRequestSchema, h as CreateOrganizationResponseSchema, ht as UpdateCredentialInstanceBodySchema, i as AgentSessionDetailResponseSchema, it as ROUTE_MANIFEST_REL_PATH, j as InviteOrganizationMembersResponseSchema, jt as WorkflowSummaryListResponseSchema, k as HistoryRunListResponseSchema, kt as WorkflowRunListResponseSchema, l as ConnectAuthorizeUrlResponseSchema, lt as StartOAuthConnectionInputSchema, m as CreateOrganizationRequestSchema, mt as TriggerRunListResponseSchema, n as AcceptOrganizationInvitationResponseSchema, nt as QueuedAgentPromptResponseSchema, o as AgentSummaryDetailResponseSchema, ot as SkillSummaryDetailResponseSchema, p as CreateCredentialsResponseSchema, pt as TriggerRunDetailResponseSchema, q as PresignProjectSourceRequestSchema, r as ActiveOrganizationResponseSchema, rt as QueuedRunResponseSchema, s as AgentSummaryListResponseSchema, st as SkillSummaryListResponseSchema, t as ACTIVE_ORG_HEADER, tt as PromptResponseSchema, u as ConnectProvidersResponseSchema, ut as StartOAuthConnectionResultSchema, v as CreateProjectResponseSchema, vt as UpdateOrganizationMemberResponseSchema, w as GetCredentialResponseSchema, wt as UserAvatarPatchSchema, x as DeclineOrganizationInvitationResponseSchema, xt as UploadProjectSourceManifestRequestSchema, y as CredentialInstanceListResponseSchema, yt as UpdateOrganizationRequestSchema, z as ListProjectMetricsResponseSchema } from "./dist-B61CtbIr.mjs";
+import { $ as ProjectSlugAvailabilityResponseSchema, A as InviteOrganizationMembersRequestSchema, At as WorkflowSummaryDetailResponseSchema, B as ListProjectsResponseSchema, C as GatewayAttachmentRecordSchema, Ct as UpsertGatewayAttachmentBodySchema, D as HistoryRunDetailResponseSchema, Dt as UserPreferencesSchema, E as HistoryRunCancelResponseSchema, Et as UserPreferencesPatchSchema, F as ListOrganizationMembersResponseSchema, Ft as parseErrorResponse, G as PresignOrgLogoRequestSchema, H as OrganizationSidebarBrandingSchema, I as ListOrganizationsResponseSchema, J as PresignProjectSourceResponseSchema, K as PresignOrgLogoResponseSchema, L as ListProjectDeploymentsResponseSchema, M as ListAppsResponseSchema, Mt as listenPortFromPublicUrl, N as ListCredentialsResponseSchema, O as HistoryRunListQuerySchema, Ot as WorkflowRunDetailResponseSchema, P as ListOrganizationInvitationsResponseSchema, Pt as originFromPublicUrl, Q as ProjectResponseSchema, R as ListProjectFilesResponseSchema, S as ErrorResponseSchema, St as UploadProjectSourceResponseSchema, T as HealthResponseSchema, Tt as UserAvatarSchema, U as PROJECT_REACHABILITY_REQUEST_TIMEOUT_MS, V as OrganizationSidebarBrandingPatchSchema, W as PollRunResponseSchema, X as PresignUserAvatarResponseSchema, Y as PresignUserAvatarRequestSchema, Z as ProjectReachabilityResponseSchema, _ as CreateProjectRequestSchema, _t as UpdateOrganizationMemberRequestSchema, a as AgentSessionListResponseSchema, at as RecentResourceListResponseSchema, b as CredentialInstanceRecordSchema, bt as UpdateProjectRequestSchema, c as CompleteProjectArtifactResponseSchema, ct as SlugAvailabilityResponseSchema, d as CreateCredentialInstanceBodySchema, dt as TriggerDetailResponseSchema, et as PromptInputSchema, f as CreateCredentialsRequestSchema, ft as TriggerListResponseSchema, g as CreateProjectArtifactResponseSchema, gt as UpdateCredentialRequestSchema, h as CreateOrganizationResponseSchema, ht as UpdateCredentialInstanceBodySchema, i as AgentSessionDetailResponseSchema, it as ROUTE_MANIFEST_REL_PATH, j as InviteOrganizationMembersResponseSchema, jt as WorkflowSummaryListResponseSchema, k as HistoryRunListResponseSchema, kt as WorkflowRunListResponseSchema, l as ConnectAuthorizeUrlResponseSchema, lt as StartOAuthConnectionInputSchema, m as CreateOrganizationRequestSchema, mt as TriggerRunListResponseSchema, n as AcceptOrganizationInvitationResponseSchema, nt as QueuedAgentPromptResponseSchema, o as AgentSummaryDetailResponseSchema, ot as SkillSummaryDetailResponseSchema, p as CreateCredentialsResponseSchema, pt as TriggerRunDetailResponseSchema, q as PresignProjectSourceRequestSchema, r as ActiveOrganizationResponseSchema, rt as QueuedRunResponseSchema, s as AgentSummaryListResponseSchema, st as SkillSummaryListResponseSchema, t as ACTIVE_ORG_HEADER, tt as PromptResponseSchema, u as ConnectProvidersResponseSchema, ut as StartOAuthConnectionResultSchema, v as CreateProjectResponseSchema, vt as UpdateOrganizationMemberResponseSchema, w as GetCredentialResponseSchema, wt as UserAvatarPatchSchema, x as DeclineOrganizationInvitationResponseSchema, xt as UploadProjectSourceManifestRequestSchema, y as CredentialInstanceListResponseSchema, yt as UpdateOrganizationRequestSchema, z as ListProjectMetricsResponseSchema } from "./dist-BKyJS66Y.mjs";
 import { t as walkProject } from "./walk-project-171B4cvO-DJy3qZKd.mjs";
 import { a as installPlaygroundDependencies, i as installDependencies, n as buildPlaygroundWorkspace, o as resolvePackageManager, s as resolveCliRoot, t as readCliVersion } from "./version-DESgLEkE.mjs";
 import { createRequire } from "node:module";
@@ -3883,8 +3883,8 @@ function buildOAuthAuthorizeSearchParams(input) {
 	const params = {};
 	const scopes = input.scopes ?? [];
 	if (scopes.length > 0) params.scopes = scopes.join(",");
-	const projectIds = input.projectIds ?? [];
-	if (projectIds.length > 0) params.projectIds = projectIds.join(",");
+	const projectIds = input.projects ?? [];
+	if (projectIds.length > 0) params.projects = projectIds.join(",");
 	if (input.createOrganizationCredential) params.org = "true";
 	if (input.createUserProvidedCredential) params.user = "true";
 	return params;
@@ -5382,19 +5382,19 @@ function registerAppCommand(program) {
 }
 //#endregion
 //#region src/commands/connect/parse-connect-scopes.ts
-function parseConnectScopes(scopes, projectIds) {
+function parseConnectScopes(scopes, projectSlugs) {
 	const normalized = scopes.length > 0 ? scopes : ["org"];
 	for (const scope of normalized) if (scope !== "org" && scope !== "user" && scope !== "project") throw new Error(`Unknown scope "${scope}". Expected org, user, or project.`);
 	const createOrganizationCredential = normalized.includes("org");
 	const createUserProvidedCredential = normalized.includes("user");
 	const includesProject = normalized.includes("project");
-	const selectedProjectIds = includesProject ? projectIds : [];
-	if (includesProject && selectedProjectIds.length === 0) throw new Error("--project-id is required when scope includes project");
-	if (!createOrganizationCredential && !createUserProvidedCredential && selectedProjectIds.length === 0) throw new Error("At least one scope is required via --scope and/or --project-id");
+	const selectedProjects = includesProject ? projectSlugs : [];
+	if (includesProject && selectedProjects.length === 0) throw new Error("--project-slug is required when scope includes project");
+	if (!createOrganizationCredential && !createUserProvidedCredential && selectedProjects.length === 0) throw new Error("At least one scope is required via --scope and/or --project-slug");
 	return {
 		createOrganizationCredential,
 		createUserProvidedCredential,
-		projectIds: selectedProjectIds
+		projects: selectedProjects
 	};
 }
 //#endregion
@@ -5430,7 +5430,7 @@ async function runConnect(options) {
 			appId: provider.key,
 			scopes: oauthScopes,
 			permissionMode: "default",
-			projectIds: scopes.projectIds,
+			projects: scopes.projects,
 			createOrganizationCredential: scopes.createOrganizationCredential,
 			createUserProvidedCredential: scopes.createUserProvidedCredential
 		});
@@ -5469,11 +5469,11 @@ function resolveConnectTargetOptions() {
 	if (local) return { local: true };
 	return { orgScoped: true };
 }
-function collectValues(value, previous) {
+function collectValues$1(value, previous) {
 	return previous.concat([value]);
 }
 function registerConnectCommand(program) {
-	program.command("connect [provider]").description("Connect third-party accounts (uses apiTarget; --local for local server)").option("--oauth-scope <scope>", "OAuth permission scope to request (repeatable)", collectValues, []).option("--scope <scope>", "Credential scope: org, user, or project (repeatable)", collectValues, []).option("--project-id <id>", "Project id when scope includes project (repeatable)", collectValues, []).option("--print-url", "Print the authorize URL and exit without opening the browser").action((provider, options) => runCliCommand("Could not fetch connect providers", async (ctx) => {
+	program.command("connect [provider]").description("Connect third-party accounts (uses apiTarget; --local for local server)").option("--oauth-scope <scope>", "OAuth permission scope to request (repeatable)", collectValues$1, []).option("--scope <scope>", "Credential scope: org, user, or project (repeatable)", collectValues$1, []).option("--project-slug <slug>", "Project slug when scope includes project (repeatable)", collectValues$1, []).option("--print-url", "Print the authorize URL and exit without opening the browser").action((provider, options) => runCliCommand("Could not fetch connect providers", async (ctx) => {
 		const providers = await ctx.client.connect.listProviders();
 		if (!provider) {
 			if (providers.length === 0) {
@@ -5489,9 +5489,9 @@ function registerConnectCommand(program) {
 			const available = providers.map((entry) => entry.key).join(", ") || "(none)";
 			throw new Error(`Unknown provider "${provider}". Available: ${available}`);
 		}
-		const hasScopeFlags = options.scope.length > 0 || options.projectId.length > 0;
-		if (ctx.apiTarget.mode === "local" && hasScopeFlags) throw new Error("--scope and --project-id are only supported against the platform API (omit --local)");
-		const credentialScopes = ctx.apiTarget.mode === "platform" ? parseConnectScopes(options.scope, options.projectId) : void 0;
+		const hasScopeFlags = options.scope.length > 0 || options.projectSlug.length > 0;
+		if (ctx.apiTarget.mode === "local" && hasScopeFlags) throw new Error("--scope and --project-slug are only supported against the platform API (omit --local)");
+		const credentialScopes = ctx.apiTarget.mode === "platform" ? parseConnectScopes(options.scope, options.projectSlug) : void 0;
 		const platform = ctx.apiTarget.mode === "platform" ? createCliPlatformClient(createCliConfig()) : void 0;
 		await runConnect({
 			client: ctx.client,
@@ -5505,6 +5505,73 @@ function registerConnectCommand(program) {
 	}, void 0, resolveConnectTargetOptions()));
 }
 //#endregion
+//#region src/commands/project/run-project.ts
+async function withActivePlatformClient(config, fn) {
+	const platform = createCliPlatformClient(config);
+	let active = await platform.organizations.getActive();
+	if (!active) active = await selectActiveOrganization(config);
+	platform.setActiveOrganizationId(active.organization.id);
+	await fn(platform);
+}
+function writeInactiveDeployHints(projects) {
+	const bin = cliBinaryName();
+	for (const project of projects) {
+		if (project.status !== "inactive") continue;
+		process.stderr.write(`Project ${formatProjectLabel(project)} is inactive. Deploy with: ${bin} deploy --project ${formatProjectLabel(project)}\n`);
+	}
+}
+async function runProjectList(config) {
+	await withActivePlatformClient(config, async (platform) => {
+		const projects = await platform.projects.list();
+		process.stdout.write(`${JSON.stringify({ projects }, null, 2)}\n`);
+		if (projects.length === 0) {
+			const bin = cliBinaryName();
+			process.stderr.write(`No projects yet. Create one with: ${bin} project create --name "My project"\n`);
+			return;
+		}
+		writeInactiveDeployHints(projects);
+	});
+}
+async function runProjectMetrics(config, options) {
+	await withActivePlatformClient(config, async (platform) => {
+		const metrics = await platform.projectMetrics.list();
+		if (options.projectRef === void 0) {
+			process.stdout.write(`${JSON.stringify(metrics, null, 2)}\n`);
+			return;
+		}
+		const project = await resolveProjectRef(platform, options.projectRef);
+		const output = Object.fromEntries(Object.entries(metrics).filter(([projectId]) => projectId === project.id));
+		process.stdout.write(`${JSON.stringify(output, null, 2)}\n`);
+	});
+}
+async function runProjectDeploymentsList(config, options) {
+	await withActivePlatformClient(config, async (platform) => {
+		const project = await resolveProjectRef(platform, options.projectRef);
+		const deployments = await platform.deployments.listForProject(project.id);
+		process.stdout.write(`${JSON.stringify({ deployments }, null, 2)}\n`);
+	});
+}
+async function runProjectCreate(config, input) {
+	await withActivePlatformClient(config, async (platform) => {
+		const project = await platform.projects.create(input);
+		process.stdout.write(`${JSON.stringify({ project }, null, 2)}\n`);
+		writeInactiveDeployHints([project]);
+	});
+}
+async function runProjectUpdate(config, input) {
+	await withActivePlatformClient(config, async (platform) => {
+		const { projectId, ...patch } = input;
+		const project = await platform.projects.update(projectId, patch);
+		process.stdout.write(`${JSON.stringify({ project }, null, 2)}\n`);
+	});
+}
+async function runProjectDelete(config, projectId) {
+	await withActivePlatformClient(config, async (platform) => {
+		await platform.projects.delete(projectId);
+		process.stdout.write(`${JSON.stringify({ deleted: projectId }, null, 2)}\n`);
+	});
+}
+//#endregion
 //#region src/commands/credentials/target-options.ts
 function resolveCredentialsTargetOptions(options = {}) {
 	if (options.scopeType === "project") return {
@@ -5515,10 +5582,21 @@ function resolveCredentialsTargetOptions(options = {}) {
 }
 //#endregion
 //#region src/commands/credentials/run-credentials.ts
-async function withActivePlatformClient$1(config, fn) {
-	const platform = createCliPlatformClient(config);
-	await ensureActiveOrganization(config);
-	await fn(platform);
+async function createLocalCredentialsClient(targetOptions) {
+	const config = createCliConfig();
+	const target = await resolveApiTarget(config, {
+		...getCliTargetOptions(),
+		...resolveCredentialsTargetOptions(),
+		...targetOptions
+	});
+	return {
+		config,
+		client: createCliClient(config, {
+			baseUrl: target.baseUrl,
+			platform: target.mode === "platform"
+		}),
+		target
+	};
 }
 function isLocalCredentialsTarget() {
 	return Boolean(getCliTargetOptions().local);
@@ -5534,7 +5612,7 @@ async function runCredentialsCommand(fallback, fn) {
 			});
 			return;
 		}
-		await withActivePlatformClient$1(config, async (platform) => {
+		await withActivePlatformClient(config, async (platform) => {
 			await fn({
 				config,
 				platform,
@@ -5550,15 +5628,14 @@ async function runCredentialsCommand(fallback, fn) {
 	}
 }
 function buildPlatformCreateRequest(args) {
-	const apiKey = Object.values(args.value)[0];
-	if (!apiKey) throw new Error("At least one --set field is required");
+	if (Object.keys(args.value).length === 0) throw new Error("At least one --set field is required");
 	return {
 		appId: args.appId,
 		connectionKind: "manual",
-		apiKey,
-		projectIds: args.scope === "project" && args.projectId ? [args.projectId] : [],
-		createOrganizationCredential: args.scope === "org",
-		createUserProvidedCredential: args.scope === "user"
+		value: args.value,
+		projects: args.targets.projects,
+		createOrganizationCredential: args.targets.createOrganizationCredential,
+		createUserProvidedCredential: args.targets.createUserProvidedCredential
 	};
 }
 function buildPlatformUpdatePatch(args) {
@@ -5573,15 +5650,8 @@ function buildPlatformUpdatePatch(args) {
 function registerCredentialsDeleteCommand(credentials) {
 	credentials.command("delete").description("Delete a credential instance").argument("<id>", "Credential instance id").action((id) => runCredentialsCommand("Delete credential failed", async ({ platform, local }) => {
 		if (local) {
-			const config = createCliConfig();
-			const target = await resolveApiTarget(config, {
-				...getCliTargetOptions(),
-				...resolveCredentialsTargetOptions()
-			});
-			await createCliClient(config, {
-				baseUrl: target.baseUrl,
-				platform: target.mode === "platform"
-			}).credentials.deleteInstance(id);
+			const { client } = await createLocalCredentialsClient();
+			await client.credentials.deleteInstance(id);
 			return;
 		}
 		await platform.credentials.delete(id);
@@ -5592,15 +5662,8 @@ function registerCredentialsDeleteCommand(credentials) {
 function registerCredentialsGetCommand(credentials) {
 	credentials.command("get").description("Get a credential instance by id").argument("<id>", "Credential instance id").action((id) => runCredentialsCommand("Get credential failed", async ({ platform, local }) => {
 		if (local) {
-			const config = createCliConfig();
-			const target = await resolveApiTarget(config, {
-				...getCliTargetOptions(),
-				...resolveCredentialsTargetOptions()
-			});
-			const match = (await createCliClient(config, {
-				baseUrl: target.baseUrl,
-				platform: target.mode === "platform"
-			}).credentials.listInstances()).instances.find((instance) => instance.id === id);
+			const { client } = await createLocalCredentialsClient();
+			const match = (await client.credentials.listInstances()).instances.find((instance) => instance.id === id);
 			if (!match) throw new Error(`Credential ${id} not found`);
 			process.stdout.write(`${JSON.stringify(match, null, 2)}\n`);
 			return;
@@ -5614,15 +5677,8 @@ function registerCredentialsGetCommand(credentials) {
 function registerCredentialsListCommand(credentials) {
 	credentials.command("list").description("List stored credential instances").option("--key <key>", "Filter by credential key (local server only)").action((options) => runCredentialsCommand("List credential instances failed", async ({ platform, local }) => {
 		if (local) {
-			const config = createCliConfig();
-			const target = await resolveApiTarget(config, {
-				...getCliTargetOptions(),
-				...resolveCredentialsTargetOptions()
-			});
-			const result = await createCliClient(config, {
-				baseUrl: target.baseUrl,
-				platform: target.mode === "platform"
-			}).credentials.listInstances(options.key ? { key: options.key } : void 0);
+			const { client } = await createLocalCredentialsClient();
+			const result = await client.credentials.listInstances(options.key ? { key: options.key } : void 0);
 			process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
 			return;
 		}
@@ -5775,83 +5831,119 @@ async function assertNoSetConflict(client, args) {
 	}));
 }
 //#endregion
+//#region src/commands/credentials/parse-set-scopes.ts
+function parseCredentialSetScopes(scopes, projectSlugs) {
+	if (scopes.includes("global")) {
+		if (scopes.length > 1) throw new Error("global scope cannot be combined with org, user, or project");
+		if (projectSlugs.length > 0) throw new Error("global scope cannot be combined with --project-slug");
+		return { global: true };
+	}
+	return parseConnectScopes(scopes, projectSlugs);
+}
+//#endregion
 //#region src/commands/credentials/set.ts
 function registerCredentialsSetCommand(credentials) {
-	credentials.command("set").description("Create a new api_key credential instance").argument("<key>", "Credential key or app id, e.g. exa").requiredOption("--scope <scope>", "org, user, project, or global").option("--project-id <id>", "Project id when scope is project").option("--label <label>", "Human-readable label within the scope").option("--default", "Mark as default for this scope").option("--set <field>", "Credential field as key=value or key=@env:VAR (falls back to project .env when unset in shell)", collectSetValues$1, []).action((key, options) => runCredentialsCommand("Set credential failed", async ({ platform, local }) => {
+	credentials.command("set").description("Create a new api_key credential instance").argument("<key>", "Credential key or app id, e.g. exa").option("--scope <scope>", "org, user, project, or global (repeatable)", collectValues, []).option("--project-slug <slug>", "Project slug when scope includes project (repeatable)", collectValues, []).option("--label <label>", "Human-readable label within the scope").option("--default", "Mark as default for this scope").option("--set <field>", "Credential field as key=value or key=@env:VAR (falls back to project .env when unset in shell)", collectSetValues$1, []).action((key, options) => runCredentialsCommand("Set credential failed", async ({ platform, local }) => {
 		const value = parseCredentialValueFields(options.set);
-		const scopeType = scopeTypeFromCli(options.scope);
-		if (scopeType === "project" && !options.projectId) throw new Error("--project-id is required when scope is project");
+		const parsedScopes = parseCredentialSetScopes(options.scope, options.projectSlug);
 		if (local) {
-			const config = createCliConfig();
-			const target = await resolveApiTarget(config, {
-				...getCliTargetOptions(),
-				...resolveCredentialsTargetOptions({
+			const { client } = await createLocalCredentialsClient();
+			if ("global" in parsedScopes) {
+				const scopeType = scopeTypeFromCli("global");
+				await assertNoSetConflict(client, {
+					key,
+					scope: "global",
 					scopeType,
-					projectId: options.projectId
-				})
-			});
-			const client = createCliClient(config, {
-				baseUrl: target.baseUrl,
-				platform: target.mode === "platform"
-			});
-			await assertNoSetConflict(client, {
-				key,
-				scope: options.scope,
-				scopeType,
-				projectId: options.projectId,
-				label: options.label,
-				setFields: options.set
-			});
-			const result = await client.credentials.createInstance({
-				key,
-				scopeType,
-				scopeId: scopeType === "project" ? options.projectId : void 0,
-				label: options.label,
-				isDefault: options.default,
-				value
-			});
-			process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+					label: options.label,
+					setFields: options.set
+				});
+				const result = await client.credentials.createInstance({
+					key,
+					scopeType,
+					label: options.label,
+					isDefault: options.default,
+					value
+				});
+				process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+				return;
+			}
+			const targets = expandLocalCredentialTargets(parsedScopes);
+			const instances = [];
+			for (const target of targets) {
+				await assertNoSetConflict(client, {
+					key,
+					scope: target.scope,
+					scopeType: target.scopeType,
+					projectId: target.projectSlug,
+					label: options.label,
+					setFields: options.set
+				});
+				instances.push(await client.credentials.createInstance({
+					key,
+					scopeType: target.scopeType,
+					scopeId: target.projectSlug,
+					label: options.label,
+					isDefault: options.default,
+					value
+				}));
+			}
+			if (instances.length === 1) {
+				process.stdout.write(`${JSON.stringify(instances[0], null, 2)}\n`);
+				return;
+			}
+			process.stdout.write(`${JSON.stringify({ instances }, null, 2)}\n`);
 			return;
 		}
-		if (options.scope === "global") throw new Error("global scope is only supported against a local keystroke server");
+		if (options.scope.includes("global") || "global" in parsedScopes) throw new Error("global scope is only supported against a local keystroke server");
 		const created = await platform.credentials.create(buildPlatformCreateRequest({
 			appId: key,
 			value,
-			scope: options.scope,
-			projectId: options.projectId
+			targets: parsedScopes
 		}));
 		if (options.label !== void 0 || options.default !== void 0) {
 			const patch = buildPlatformUpdatePatch({
 				...options.label !== void 0 ? { label: options.label } : {},
 				...options.default !== void 0 ? { isDefault: options.default } : {}
 			});
-			for (const credential of created) {
-				const updated = await platform.credentials.update(credential.id, patch);
-				process.stdout.write(`${JSON.stringify({ credential: updated }, null, 2)}\n`);
-			}
+			const credentials = [];
+			for (const credential of created) credentials.push(await platform.credentials.update(credential.id, patch));
+			process.stdout.write(`${JSON.stringify({ credentials }, null, 2)}\n`);
 			return;
 		}
 		process.stdout.write(`${JSON.stringify({ credentials: created }, null, 2)}\n`);
 	}));
 }
+function collectValues(value, previous) {
+	return previous.concat([value]);
+}
 function collectSetValues$1(value, previous) {
 	return previous.concat([value]);
 }
+function expandLocalCredentialTargets(targets) {
+	const expanded = [];
+	if (targets.createOrganizationCredential) expanded.push({
+		scope: "org",
+		scopeType: scopeTypeFromCli("org")
+	});
+	if (targets.createUserProvidedCredential) expanded.push({
+		scope: "user",
+		scopeType: scopeTypeFromCli("user")
+	});
+	for (const projectSlug of targets.projects) expanded.push({
+		scope: "project",
+		scopeType: scopeTypeFromCli("project"),
+		projectSlug
+	});
+	return expanded;
+}
 //#endregion
 //#region src/commands/credentials/update.ts
 function registerCredentialsUpdateCommand(credentials) {
 	credentials.command("update").description("Update a credential instance").argument("<id>", "Credential instance id").option("--label <label>", "Human-readable label within the scope").option("--default", "Mark as default for this scope").option("--set <field>", "Credential field as key=value or key=@env:VAR", collectSetValues, []).action((id, options) => runCredentialsCommand("Update credential failed", async ({ platform, local }) => {
 		const value = options.set.length > 0 ? parseCredentialValueFields(options.set) : void 0;
 		if (local) {
-			const config = createCliConfig();
-			const target = await resolveApiTarget(config, {
-				...getCliTargetOptions(),
-				...resolveCredentialsTargetOptions()
-			});
-			const result = await createCliClient(config, {
-				baseUrl: target.baseUrl,
-				platform: target.mode === "platform"
-			}).credentials.updateInstance(id, {
+			const { client } = await createLocalCredentialsClient();
+			const result = await client.credentials.updateInstance(id, {
 				...options.label !== void 0 ? { label: options.label } : {},
 				...options.default !== void 0 ? { isDefault: options.default } : {},
 				...value ? { value } : {}
@@ -5992,7 +6084,7 @@ function registerBuildCommand(program) {
 	program.command("build").description("Build the keystroke project for production").option("--dir <path>", "Project directory", process.cwd()).action(async (options) => {
 		try {
 			const root = resolveProjectRoot(options.dir);
-			const { buildApp } = await import("./dist-CcJj87Po.mjs");
+			const { buildApp } = await import("./dist-CzQkL7nN.mjs");
 			await buildApp({ root });
 			process.stdout.write(`Built ${root}\n`);
 		} catch (error) {
@@ -6089,7 +6181,7 @@ async function runDeploy(options) {
 	const client = createCliPlatformClient(config);
 	let source;
 	if (!options.skipBuild) {
-		const { buildApp } = await import("./dist-CcJj87Po.mjs");
+		const { buildApp } = await import("./dist-CzQkL7nN.mjs");
 		source = { files: (await buildApp({
 			root,
 			collectSources: true,
@@ -6189,7 +6281,7 @@ function runtimeChildEnv(parentEnv, overrides) {
 //#region src/project/bootstrap-run.ts
 /** Node args + env for `@keystrokehq/build` bootstrap (shared by start + dev). */
 async function resolveBootstrapRun(options) {
-	const { resolveRuntimeBuildArtifact } = await import("./dist-CcJj87Po.mjs");
+	const { resolveRuntimeBuildArtifact } = await import("./dist-CzQkL7nN.mjs");
 	const loader = pathToFileURL(resolveRuntimeBuildArtifact(options.runtimeNodeModules, "dist/runtime-loader.mjs")).href;
 	const bootstrap = resolveRuntimeBuildArtifact(options.runtimeNodeModules, "dist/bootstrap.mjs");
 	const args = [`--import=${loader}`];
@@ -6339,7 +6431,7 @@ async function runDev(options) {
 	process.on("SIGINT", shutdown);
 	process.on("SIGTERM", shutdown);
 	try {
-		const { watchApp } = await import("./dist-CcJj87Po.mjs");
+		const { watchApp } = await import("./dist-CzQkL7nN.mjs");
 		await watchApp({
 			root,
 			clean: false,
@@ -6367,73 +6459,6 @@ function registerDevCommand(program) {
 	});
 }
 //#endregion
-//#region src/commands/project/run-project.ts
-async function withActivePlatformClient(config, fn) {
-	const platform = createCliPlatformClient(config);
-	let active = await platform.organizations.getActive();
-	if (!active) active = await selectActiveOrganization(config);
-	platform.setActiveOrganizationId(active.organization.id);
-	await fn(platform);
-}
-function writeInactiveDeployHints(projects) {
-	const bin = cliBinaryName();
-	for (const project of projects) {
-		if (project.status !== "inactive") continue;
-		process.stderr.write(`Project ${formatProjectLabel(project)} is inactive. Deploy with: ${bin} deploy --project ${formatProjectLabel(project)}\n`);
-	}
-}
-async function runProjectList(config) {
-	await withActivePlatformClient(config, async (platform) => {
-		const projects = await platform.projects.list();
-		process.stdout.write(`${JSON.stringify({ projects }, null, 2)}\n`);
-		if (projects.length === 0) {
-			const bin = cliBinaryName();
-			process.stderr.write(`No projects yet. Create one with: ${bin} project create --name "My project"\n`);
-			return;
-		}
-		writeInactiveDeployHints(projects);
-	});
-}
-async function runProjectMetrics(config, options) {
-	await withActivePlatformClient(config, async (platform) => {
-		const metrics = await platform.projectMetrics.list();
-		if (options.projectRef === void 0) {
-			process.stdout.write(`${JSON.stringify(metrics, null, 2)}\n`);
-			return;
-		}
-		const project = await resolveProjectRef(platform, options.projectRef);
-		const output = Object.fromEntries(Object.entries(metrics).filter(([projectId]) => projectId === project.id));
-		process.stdout.write(`${JSON.stringify(output, null, 2)}\n`);
-	});
-}
-async function runProjectDeploymentsList(config, options) {
-	await withActivePlatformClient(config, async (platform) => {
-		const project = await resolveProjectRef(platform, options.projectRef);
-		const deployments = await platform.deployments.listForProject(project.id);
-		process.stdout.write(`${JSON.stringify({ deployments }, null, 2)}\n`);
-	});
-}
-async function runProjectCreate(config, input) {
-	await withActivePlatformClient(config, async (platform) => {
-		const project = await platform.projects.create(input);
-		process.stdout.write(`${JSON.stringify({ project }, null, 2)}\n`);
-		writeInactiveDeployHints([project]);
-	});
-}
-async function runProjectUpdate(config, input) {
-	await withActivePlatformClient(config, async (platform) => {
-		const { projectId, ...patch } = input;
-		const project = await platform.projects.update(projectId, patch);
-		process.stdout.write(`${JSON.stringify({ project }, null, 2)}\n`);
-	});
-}
-async function runProjectDelete(config, projectId) {
-	await withActivePlatformClient(config, async (platform) => {
-		await platform.projects.delete(projectId);
-		process.stdout.write(`${JSON.stringify({ deleted: projectId }, null, 2)}\n`);
-	});
-}
-//#endregion
 //#region src/commands/history/run-history.ts
 async function runHistoryList(config, filters) {
 	await withActivePlatformClient(config, async (platform) => {
@@ -6954,7 +6979,7 @@ async function runStart(options) {
 	const apiPort = Number(new URL(serverUrl).port || 80);
 	const runtimeNodeModules = resolveCliRuntimeNodeModules(resolveCliRoot(import.meta.url));
 	ensureNativeDeps(runtimeNodeModules);
-	const { buildApp } = await import("./dist-CcJj87Po.mjs");
+	const { buildApp } = await import("./dist-CzQkL7nN.mjs");
 	await buildApp({
 		root,
 		clean: false