@keystrokehq/cli 0.0.148 → 0.0.150

package/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { $ as ProjectSlugAvailabilityResponseSchema, A as InviteOrganizationMembersRequestSchema, At as WorkflowSummaryDetailResponseSchema, B as ListProjectsResponseSchema, C as GatewayAttachmentRecordSchema, Ct as UpsertGatewayAttachmentBodySchema, D as HistoryRunDetailResponseSchema, Dt as UserPreferencesSchema, E as HistoryRunCancelResponseSchema, Et as UserPreferencesPatchSchema, F as ListOrganizationMembersResponseSchema, Ft as parseErrorResponse, G as PresignOrgLogoRequestSchema, H as OrganizationSidebarBrandingSchema, I as ListOrganizationsResponseSchema, J as PresignProjectSourceResponseSchema, K as PresignOrgLogoResponseSchema, L as ListProjectDeploymentsResponseSchema, M as ListAppsResponseSchema, Mt as listenPortFromPublicUrl, N as ListCredentialsResponseSchema, O as HistoryRunListQuerySchema, Ot as WorkflowRunDetailResponseSchema, P as ListOrganizationInvitationsResponseSchema, Pt as originFromPublicUrl, Q as ProjectResponseSchema, R as ListProjectFilesResponseSchema, S as ErrorResponseSchema, St as UploadProjectSourceResponseSchema, T as HealthResponseSchema, Tt as UserAvatarSchema, U as PROJECT_REACHABILITY_REQUEST_TIMEOUT_MS, V as OrganizationSidebarBrandingPatchSchema, W as PollRunResponseSchema, X as PresignUserAvatarResponseSchema, Y as PresignUserAvatarRequestSchema, Z as ProjectReachabilityResponseSchema, _ as CreateProjectRequestSchema, _t as UpdateOrganizationMemberRequestSchema, a as AgentSessionListResponseSchema, at as RecentResourceListResponseSchema, b as CredentialInstanceRecordSchema, bt as UpdateProjectRequestSchema, c as CompleteProjectArtifactResponseSchema, ct as SlugAvailabilityResponseSchema, d as CreateCredentialInstanceBodySchema, dt as TriggerDetailResponseSchema, et as PromptInputSchema, f as CreateCredentialsRequestSchema, ft as TriggerListResponseSchema, g as CreateProjectArtifactResponseSchema, gt as UpdateCredentialRequestSchema, h as CreateOrganizationResponseSchema, ht as UpdateCredentialInstanceBodySchema, i as AgentSessionDetailResponseSchema, it as ROUTE_MANIFEST_REL_PATH, j as InviteOrganizationMembersResponseSchema, jt as WorkflowSummaryListResponseSchema, k as HistoryRunListResponseSchema, kt as WorkflowRunListResponseSchema, l as ConnectAuthorizeUrlResponseSchema, lt as StartOAuthConnectionInputSchema, m as CreateOrganizationRequestSchema, mt as TriggerRunListResponseSchema, n as AcceptOrganizationInvitationResponseSchema, nt as QueuedAgentPromptResponseSchema, o as AgentSummaryDetailResponseSchema, ot as SkillSummaryDetailResponseSchema, p as CreateCredentialsResponseSchema, pt as TriggerRunDetailResponseSchema, q as PresignProjectSourceRequestSchema, r as ActiveOrganizationResponseSchema, rt as QueuedRunResponseSchema, s as AgentSummaryListResponseSchema, st as SkillSummaryListResponseSchema, t as ACTIVE_ORG_HEADER, tt as PromptResponseSchema, u as ConnectProvidersResponseSchema, ut as StartOAuthConnectionResultSchema, v as CreateProjectResponseSchema, vt as UpdateOrganizationMemberResponseSchema, w as GetCredentialResponseSchema, wt as UserAvatarPatchSchema, x as DeclineOrganizationInvitationResponseSchema, xt as UploadProjectSourceManifestRequestSchema, y as CredentialInstanceListResponseSchema, yt as UpdateOrganizationRequestSchema, z as ListProjectMetricsResponseSchema } from "./dist-B61CtbIr.mjs";
+import { $ as PresignProjectSourceRequestSchema, A as GetCredentialResponseSchema, At as UpsertGatewayAttachmentBodySchema, B as ListOrganizationInvitationsResponseSchema, C as CreateProjectRequestSchema, Ct as UpdateCredentialRequestSchema, D as DeclineOrganizationInvitationResponseSchema, Dt as UpdateProjectRequestSchema, E as CredentialInstanceRecordSchema, Et as UpdateOrganizationRequestSchema, F as HistoryRunListResponseSchema, Ft as WorkflowRunDetailResponseSchema, G as ListProjectMetricsResponseSchema, H as ListOrganizationsResponseSchema, Ht as parseErrorResponse, I as InviteOrganizationMembersRequestSchema, It as WorkflowRunListResponseSchema, J as OrganizationSidebarBrandingSchema, K as ListProjectsResponseSchema, L as InviteOrganizationMembersResponseSchema, Lt as WorkflowSummaryDetailResponseSchema, M as HistoryRunCancelResponseSchema, Mt as UserAvatarSchema, N as HistoryRunDetailResponseSchema, Nt as UserPreferencesPatchSchema, O as ErrorResponseSchema, Ot as UploadProjectSourceManifestRequestSchema, P as HistoryRunListQuerySchema, Pt as UserPreferencesSchema, Q as PresignOrgLogoResponseSchema, R as ListAppsResponseSchema, Rt as WorkflowSummaryListResponseSchema, S as CreateProjectArtifactResponseSchema, St as UpdateCredentialInstanceBodySchema, T as CredentialInstanceListResponseSchema, Tt as UpdateOrganizationMemberResponseSchema, U as ListProjectDeploymentsResponseSchema, V as ListOrganizationMembersResponseSchema, Vt as originFromPublicUrl, W as ListProjectFilesResponseSchema, X as PollRunResponseSchema, Y as PROJECT_REACHABILITY_REQUEST_TIMEOUT_MS, Z as PresignOrgLogoRequestSchema, _ as CreateCredentialInstanceBodySchema, _t as TriggerDetailResponseSchema, a as AgentSessionListResponseSchema, at as ProjectSlugAvailabilityResponseSchema, b as CreateOrganizationRequestSchema, bt as TriggerRunListResponseSchema, c as BindChannelBodySchema, ct as QueuedAgentPromptResponseSchema, d as ChannelConnectionSchema, dt as RecentResourceListResponseSchema, et as PresignProjectSourceResponseSchema, f as ChannelDirectoryListResponseSchema, ft as SkillSummaryDetailResponseSchema, g as ConnectProvidersResponseSchema, gt as StartOAuthConnectionResultSchema, h as ConnectAuthorizeUrlResponseSchema, ht as StartOAuthConnectionInputSchema, i as AgentSessionDetailResponseSchema, it as ProjectResponseSchema, j as HealthResponseSchema, jt as UserAvatarPatchSchema, k as GatewayAttachmentRecordSchema, kt as UploadProjectSourceResponseSchema, l as ChannelAccountListResponseSchema, lt as QueuedRunResponseSchema, m as CompleteProjectArtifactResponseSchema, mt as SlugAvailabilityResponseSchema, n as AcceptOrganizationInvitationResponseSchema, nt as PresignUserAvatarResponseSchema, o as AgentSummaryDetailResponseSchema, ot as PromptInputSchema, p as ChannelPlatformSchema, pt as SkillSummaryListResponseSchema, q as OrganizationSidebarBrandingPatchSchema, r as ActiveOrganizationResponseSchema, rt as ProjectReachabilityResponseSchema, s as AgentSummaryListResponseSchema, st as PromptResponseSchema, t as ACTIVE_ORG_HEADER, tt as PresignUserAvatarRequestSchema, u as ChannelConnectionListResponseSchema, ut as ROUTE_MANIFEST_REL_PATH, v as CreateCredentialsRequestSchema, vt as TriggerListResponseSchema, w as CreateProjectResponseSchema, wt as UpdateOrganizationMemberRequestSchema, x as CreateOrganizationResponseSchema, xt as UpdateChannelBindingBodySchema, y as CreateCredentialsResponseSchema, yt as TriggerRunDetailResponseSchema, z as ListCredentialsResponseSchema, zt as listenPortFromPublicUrl } from "./dist-BfWdSrRa.mjs";
 import { t as walkProject } from "./walk-project-171B4cvO-DJy3qZKd.mjs";
 import { a as installPlaygroundDependencies, i as installDependencies, n as buildPlaygroundWorkspace, o as resolvePackageManager, s as resolveCliRoot, t as readCliVersion } from "./version-DESgLEkE.mjs";
 import { createRequire } from "node:module";
@@ -3774,8 +3774,8 @@ const DEFAULT_PROJECT_SETTINGS = {
 	defaultRole: "editor",
 	invitePermission: "admin"
 };
-const MOCK_STORAGE_KEY$1 = "keystroke:mock-project-settings:v1";
-function getBrowserLocalStorage$1() {
+const MOCK_STORAGE_KEY = "keystroke:mock-project-settings:v1";
+function getBrowserLocalStorage() {
 	if (typeof globalThis !== "object") return null;
 	return globalThis.localStorage ?? null;
 }
@@ -3801,10 +3801,10 @@ function mergeProjectSettings(current, patch) {
 	});
 }
 function readSettingsStore() {
-	const localStorage = getBrowserLocalStorage$1();
+	const localStorage = getBrowserLocalStorage();
 	if (!localStorage) return {};
 	try {
-		const raw = localStorage.getItem(MOCK_STORAGE_KEY$1);
+		const raw = localStorage.getItem(MOCK_STORAGE_KEY);
 		if (!raw) return {};
 		const parsed = JSON.parse(raw);
 		if (!parsed || typeof parsed !== "object") return {};
@@ -3814,10 +3814,10 @@ function readSettingsStore() {
 	}
 }
 function writeSettingsStore(store) {
-	const localStorage = getBrowserLocalStorage$1();
+	const localStorage = getBrowserLocalStorage();
 	if (!localStorage) return;
 	try {
-		localStorage.setItem(MOCK_STORAGE_KEY$1, JSON.stringify(store));
+		localStorage.setItem(MOCK_STORAGE_KEY, JSON.stringify(store));
 	} catch {}
 }
 function requireProjectId(projectId) {
@@ -3883,8 +3883,8 @@ function buildOAuthAuthorizeSearchParams(input) {
 	const params = {};
 	const scopes = input.scopes ?? [];
 	if (scopes.length > 0) params.scopes = scopes.join(",");
-	const projectIds = input.projectIds ?? [];
-	if (projectIds.length > 0) params.projectIds = projectIds.join(",");
+	const projectIds = input.projects ?? [];
+	if (projectIds.length > 0) params.projects = projectIds.join(",");
 	if (input.createOrganizationCredential) params.org = "true";
 	if (input.createUserProvidedCredential) params.user = "true";
 	return params;
@@ -4331,556 +4331,92 @@ function createUserAvatarResource(http) {
 		}
 	};
 }
-const CHANNEL_PLATFORMS = [
-	{
-		key: "slack",
-		name: "Slack",
-		appLogoId: "slack",
-		fallbackDomain: "slack.com",
-		description: "Connect a Slack workspace so this agent can respond in channels, threads, and DMs.",
-		tagline: "Respond in channels, threads, and DMs.",
-		authKind: "oauth",
+const PLATFORM_FALLBACK_DOMAINS = { slack: "slack.com" };
+function projectChannelPlatform(app) {
+	if (!app.gateway) throw new Error(`App ${app.id} does not support gateway bindings`);
+	return ChannelPlatformSchema.parse({
+		key: app.id,
+		name: app.name,
+		appLogoId: app.id,
+		fallbackDomain: PLATFORM_FALLBACK_DOMAINS[app.id] ?? `${app.id}.com`,
+		description: app.integrationDescription,
+		tagline: app.gateway.tagline ?? app.description,
+		authKind: app.authKind,
 		credentialFields: [],
-		capabilities: {
-			mentions: true,
-			reactions: "full",
-			cards: "full",
-			modals: true,
-			streaming: "native",
-			dms: true
-		},
-		supportedModes: [
-			"mention",
-			"all",
-			"dm"
-		],
-		resourceNoun: {
-			singular: "channel",
-			plural: "channels"
+		capabilities: app.gateway.capabilities,
+		supportedModes: app.gateway.supportedModes,
+		resourceNoun: app.gateway.resourceNoun,
+		webhookPathHint: app.gateway.webhookPathHint,
+		supportsChannelDirectory: app.gateway.supportsChannelDirectory,
+		docsUrl: app.gateway.docsUrl
+	});
+}
+function createChannelsResource(http) {
+	const projectPrefix = (projectId) => `/api/projects/${encodeURIComponent(projectId)}`;
+	async function listGatewayPlatforms() {
+		try {
+			const data = await http.get("/api/apps").json();
+			return ListAppsResponseSchema.parse(data).apps.filter((app) => app.gateway).map((app) => projectChannelPlatform(app));
+		} catch (error) {
+			throw await toPlatformError(error);
+		}
+	}
+	return {
+		async listPlatforms() {
+			return listGatewayPlatforms();
 		},
-		webhookPathHint: "/gateways/slack",
-		supportsChannelDirectory: true,
-		docsUrl: "https://chat-sdk.dev/adapters/official/slack"
-	},
-	{
-		key: "discord",
-		name: "Discord",
-		appLogoId: "discord",
-		fallbackDomain: "discord.com",
-		description: "Connect a Discord application so this agent can respond in servers and channels.",
-		tagline: "Respond in servers and channels.",
-		authKind: "credentials",
-		credentialFields: [
-			{
-				key: "botToken",
-				label: "Bot token",
-				placeholder: "Bot token from the Discord developer portal",
-				helpText: "Bot → Reset Token. Shown only once.",
-				type: "password",
-				required: true
-			},
-			{
-				key: "applicationId",
-				label: "Application ID",
-				placeholder: "Application ID",
-				type: "text",
-				required: true
-			},
-			{
-				key: "publicKey",
-				label: "Public key",
-				placeholder: "Public key",
-				helpText: "General Information → Public Key, used to verify interactions.",
-				type: "text",
-				required: true
+		async listAccounts(projectId, platform) {
+			try {
+				const data = await http.get(`${projectPrefix(projectId)}/channels/${encodeURIComponent(platform)}/accounts`).json();
+				return ChannelAccountListResponseSchema.parse(data).accounts;
+			} catch (error) {
+				throw await toPlatformError(error);
 			}
-		],
-		capabilities: {
-			mentions: true,
-			reactions: "full",
-			cards: "full",
-			modals: false,
-			streaming: "post-edit",
-			dms: true
 		},
-		supportedModes: [
-			"mention",
-			"all",
-			"dm"
-		],
-		resourceNoun: {
-			singular: "channel",
-			plural: "channels"
-		},
-		webhookPathHint: "/gateways/discord",
-		supportsChannelDirectory: true,
-		docsUrl: "https://chat-sdk.dev/adapters/official/discord"
-	},
-	{
-		key: "telegram",
-		name: "Telegram",
-		appLogoId: "telegram",
-		fallbackDomain: "telegram.org",
-		description: "Connect a Telegram bot so this agent can respond in chats and groups.",
-		tagline: "Respond in chats and groups.",
-		authKind: "bot-token",
-		credentialFields: [{
-			key: "botToken",
-			label: "Bot token",
-			placeholder: "123456:ABC-DEF…",
-			helpText: "Create a bot with @BotFather and paste its token.",
-			type: "password",
-			required: true
-		}, {
-			key: "botUsername",
-			label: "Bot username",
-			placeholder: "my_agent_bot",
-			type: "text",
-			required: false,
-			prefix: "@"
-		}],
-		capabilities: {
-			mentions: true,
-			reactions: "full",
-			cards: "partial",
-			modals: false,
-			streaming: "drafts",
-			dms: true
-		},
-		supportedModes: [
-			"mention",
-			"all",
-			"dm"
-		],
-		resourceNoun: {
-			singular: "chat",
-			plural: "chats"
-		},
-		webhookPathHint: "/gateways/telegram",
-		supportsChannelDirectory: false,
-		docsUrl: "https://chat-sdk.dev/adapters/official/telegram"
-	},
-	{
-		key: "microsoft-teams",
-		name: "Microsoft Teams",
-		appLogoId: "microsoft-teams",
-		fallbackDomain: "teams.microsoft.com",
-		description: "Connect a Microsoft Teams app so this agent can respond in channels and chats.",
-		tagline: "Respond in channels and chats.",
-		authKind: "credentials",
-		credentialFields: [
-			{
-				key: "appId",
-				label: "App ID",
-				placeholder: "Azure AD application (client) ID",
-				type: "text",
-				required: true
-			},
-			{
-				key: "appPassword",
-				label: "App password",
-				placeholder: "Client secret",
-				type: "password",
-				required: true
-			},
-			{
-				key: "tenantId",
-				label: "Tenant ID",
-				placeholder: "Azure AD tenant ID",
-				type: "text",
-				required: true
+		async listForAgent(projectId, agentId) {
+			try {
+				const data = await http.get(`${projectPrefix(projectId)}/agents/${encodeURIComponent(agentId)}/channels`).json();
+				return ChannelConnectionListResponseSchema.parse(data).connections;
+			} catch (error) {
+				throw await toPlatformError(error);
 			}
-		],
-		capabilities: {
-			mentions: true,
-			reactions: "read-only",
-			cards: "full",
-			modals: true,
-			streaming: "buffered",
-			dms: true
-		},
-		supportedModes: [
-			"mention",
-			"all",
-			"dm"
-		],
-		resourceNoun: {
-			singular: "channel",
-			plural: "channels"
-		},
-		webhookPathHint: "/gateways/teams",
-		supportsChannelDirectory: true,
-		docsUrl: "https://chat-sdk.dev/adapters/official/teams"
-	},
-	{
-		key: "google-chat",
-		name: "Google Chat",
-		appLogoId: "google-chat",
-		fallbackDomain: "chat.google.com",
-		description: "Connect a Google Chat app so this agent can respond in spaces and direct messages.",
-		tagline: "Respond in spaces and DMs.",
-		authKind: "credentials",
-		credentialFields: [{
-			key: "serviceAccountJson",
-			label: "Service account JSON",
-			placeholder: "Paste the service account key JSON",
-			helpText: "IAM → Service Accounts → Keys → Add key → JSON.",
-			type: "textarea",
-			required: true
-		}, {
-			key: "projectNumber",
-			label: "GCP project number",
-			placeholder: "Project number used to verify webhooks",
-			type: "text",
-			required: true
-		}],
-		capabilities: {
-			mentions: true,
-			reactions: "full",
-			cards: "full",
-			modals: false,
-			streaming: "post-edit",
-			dms: true
-		},
-		supportedModes: [
-			"mention",
-			"all",
-			"dm"
-		],
-		resourceNoun: {
-			singular: "space",
-			plural: "spaces"
-		},
-		webhookPathHint: "/gateways/gchat",
-		supportsChannelDirectory: true,
-		docsUrl: "https://chat-sdk.dev/adapters/official/google-chat"
-	}
-];
-function getChannelPlatform(key) {
-	return CHANNEL_PLATFORMS.find((platform) => platform.key === key);
-}
-const CHANNEL_DIRECTORY = {
-	slack: [
-		{
-			id: "C0SUPPORT",
-			name: "support",
-			kind: "public",
-			memberCount: 48
-		},
-		{
-			id: "C0GENERAL",
-			name: "general",
-			kind: "public",
-			memberCount: 132
-		},
-		{
-			id: "C0ENG",
-			name: "engineering",
-			kind: "public",
-			memberCount: 27
-		},
-		{
-			id: "C0INCIDENTS",
-			name: "incidents",
-			kind: "private",
-			memberCount: 12
 		},
-		{
-			id: "C0RANDOM",
-			name: "random",
-			kind: "public",
-			memberCount: 118
-		},
-		{
-			id: "C0ARCHIVE",
-			name: "launch-2025",
-			kind: "public",
-			memberCount: 9,
-			isArchived: true
-		}
-	],
-	discord: [
-		{
-			id: "d-general",
-			name: "general",
-			kind: "public",
-			memberCount: 540
-		},
-		{
-			id: "d-help",
-			name: "help",
-			kind: "public",
-			memberCount: 312
-		},
-		{
-			id: "d-dev",
-			name: "dev",
-			kind: "public",
-			memberCount: 76
-		},
-		{
-			id: "d-staff",
-			name: "staff",
-			kind: "private",
-			memberCount: 8
-		}
-	],
-	telegram: [],
-	"microsoft-teams": [
-		{
-			id: "t-general",
-			name: "General",
-			kind: "public",
-			memberCount: 64
-		},
-		{
-			id: "t-support",
-			name: "Customer Support",
-			kind: "public",
-			memberCount: 22
+		async listChannels(projectId, platform, accountId) {
+			try {
+				const data = await http.get(`${projectPrefix(projectId)}/channels/${encodeURIComponent(platform)}/directory`, { searchParams: { accountId } }).json();
+				return ChannelDirectoryListResponseSchema.parse(data).channels;
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
 		},
-		{
-			id: "t-leads",
-			name: "Leadership",
-			kind: "private",
-			memberCount: 6
-		}
-	],
-	"google-chat": [
-		{
-			id: "spaces/AAA-support",
-			name: "Support",
-			kind: "space",
-			memberCount: 31
+		async bind(projectId, input) {
+			const body = BindChannelBodySchema.parse(input);
+			try {
+				const data = await http.post(`${projectPrefix(projectId)}/agents/${encodeURIComponent(input.agentId)}/channels/bindings`, { json: body }).json();
+				return ChannelConnectionSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
 		},
-		{
-			id: "spaces/AAA-eng",
-			name: "Engineering",
-			kind: "space",
-			memberCount: 44
+		async updateBinding(projectId, input) {
+			const body = UpdateChannelBindingBodySchema.parse({ patch: input.patch });
+			try {
+				const data = await http.put(`${projectPrefix(projectId)}/agents/${encodeURIComponent(input.agentId)}/channels/bindings/${encodeURIComponent(input.bindingId)}`, { json: body }).json();
+				return ChannelConnectionSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
 		},
-		{
-			id: "spaces/AAA-ops",
-			name: "Ops On-call",
-			kind: "space",
-			memberCount: 10
-		}
-	]
-};
-const MOCK_STORAGE_KEY = "keystroke:mock-channels:v1";
-function getBrowserLocalStorage() {
-	if (typeof globalThis !== "object") return null;
-	return globalThis.localStorage ?? null;
-}
-/** A connected Slack workspace with two bindings, so the panel is reviewable. */
-function seedStore() {
-	return { "agent-support": [{
-		id: "chan-conn-slack-support",
-		platform: "slack",
-		agentId: "agent-support",
-		accountLabel: "Keystroke HQ",
-		accountId: "T0KEYSTROKE",
-		connectedAt: "2026-05-28T15:30:00Z",
-		bindings: [{
-			id: "chan-bind-support",
-			channelId: "C0SUPPORT",
-			channelName: "support",
-			channelKind: "public",
-			mode: "all",
-			subscribeOnMention: true,
-			createdAt: "2026-05-28T15:31:00Z",
-			updatedAt: "2026-05-28T15:31:00Z"
-		}, {
-			id: "chan-bind-incidents",
-			channelId: "C0INCIDENTS",
-			channelName: "incidents",
-			channelKind: "private",
-			mode: "mention",
-			subscribeOnMention: true,
-			createdAt: "2026-05-29T09:05:00Z",
-			updatedAt: "2026-05-29T09:05:00Z"
-		}]
-	}] };
-}
-function readStore() {
-	const localStorage = getBrowserLocalStorage();
-	if (!localStorage) return seedStore();
-	try {
-		const raw = localStorage.getItem(MOCK_STORAGE_KEY);
-		if (!raw) {
-			const seeded = seedStore();
-			localStorage.setItem(MOCK_STORAGE_KEY, JSON.stringify(seeded));
-			return seeded;
+		async removeBinding(projectId, input) {
+			try {
+				const response = await http.delete(`${projectPrefix(projectId)}/agents/${encodeURIComponent(input.agentId)}/channels/bindings/${encodeURIComponent(input.bindingId)}`);
+				if (response.status === 204) return null;
+				const data = await response.json();
+				return ChannelConnectionSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
 		}
-		const parsed = JSON.parse(raw);
-		if (!parsed || typeof parsed !== "object") return {};
-		return parsed;
-	} catch {
-		return {};
-	}
-}
-function writeStore(store) {
-	const localStorage = getBrowserLocalStorage();
-	if (!localStorage) return;
-	try {
-		localStorage.setItem(MOCK_STORAGE_KEY, JSON.stringify(store));
-	} catch {}
-}
-function newId(prefix) {
-	const cryptoRef = globalThis.crypto;
-	if (cryptoRef?.randomUUID) return `${prefix}-${cryptoRef.randomUUID()}`;
-	return `${prefix}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
-}
-function requireAgentId(agentId) {
-	const trimmed = agentId.trim();
-	if (!trimmed) throw new Error("Channels require an agent id");
-	return trimmed;
-}
-function clone(value) {
-	return JSON.parse(JSON.stringify(value));
-}
-function defaultAccountLabel(platform) {
-	const meta = getChannelPlatform(platform);
-	return meta ? `${meta.name} workspace` : platform;
-}
-function findConnection(connections, connectionId) {
-	const connection = connections.find((entry) => entry.id === connectionId);
-	if (!connection) throw new Error(`Channel connection not found: ${connectionId}`);
-	return connection;
-}
-function toBinding(input, now) {
-	return {
-		id: newId("chan-bind"),
-		channelId: input.channelId,
-		channelName: input.channelName,
-		channelKind: input.channelKind ?? "public",
-		mode: input.mode ?? "mention",
-		subscribeOnMention: input.subscribeOnMention ?? true,
-		createdAt: now,
-		updatedAt: now
-	};
-}
-function createChannelsResource() {
-	return {
-		/** The supported-platform catalog (static; backend may derive from the adapter registry). */
-		listPlatforms: mock({
-			domain: "channels",
-			method: "listPlatforms",
-			plannedEndpoint: "GET /api/channels/platforms"
-		}, async () => clone(CHANNEL_PLATFORMS)),
-		/** Connections (with their channel bindings) for one agent. */
-		listForAgent: mock({
-			domain: "channels",
-			method: "listForAgent",
-			plannedEndpoint: "GET /api/agents/:agentId/channels"
-		}, async (agentId) => {
-			const id = requireAgentId(agentId);
-			return clone(readStore()[id] ?? []);
-		}),
-		/**
-		* Channel directory for a platform — the picker source. NET-NEW vs. the
-		* current backend (no channel-list endpoint exists). The runtime team needs
-		* to expose this (e.g. Slack `conversations.list`) for a real picker.
-		*/
-		listChannels: mock({
-			domain: "channels",
-			method: "listChannels",
-			plannedEndpoint: "GET /api/channels/:platform/directory"
-		}, async (platform) => clone(CHANNEL_DIRECTORY[platform] ?? [])),
-		/** Connect a platform for an agent (OAuth install or credential entry), optionally with a first binding. */
-		connect: mock({
-			domain: "channels",
-			method: "connect",
-			plannedEndpoint: "POST /api/agents/:agentId/channels"
-		}, async (input) => {
-			const agentId = requireAgentId(input.agentId);
-			const store = readStore();
-			const now = (/* @__PURE__ */ new Date()).toISOString();
-			const connection = {
-				id: newId("chan-conn"),
-				platform: input.platform,
-				agentId,
-				accountLabel: input.accountLabel ?? defaultAccountLabel(input.platform),
-				accountId: newId("acct").toUpperCase(),
-				connectedAt: now,
-				bindings: input.initialBinding ? [toBinding(input.initialBinding, now)] : []
-			};
-			writeStore({
-				...store,
-				[agentId]: [...store[agentId] ?? [], connection]
-			});
-			return clone(connection);
-		}),
-		/** Add a channel binding to an existing connection. */
-		addBinding: mock({
-			domain: "channels",
-			method: "addBinding",
-			plannedEndpoint: "PUT /gateways/:platform/attachments/:channelId"
-		}, async (input) => {
-			const agentId = requireAgentId(input.agentId);
-			const store = readStore();
-			const connections = store[agentId] ?? [];
-			const connection = findConnection(connections, input.connectionId);
-			const now = (/* @__PURE__ */ new Date()).toISOString();
-			connection.bindings = [...connection.bindings, toBinding(input.binding, now)];
-			writeStore({
-				...store,
-				[agentId]: connections
-			});
-			return clone(connection);
-		}),
-		/** Update a binding's listen mode / subscribe flag. */
-		updateBinding: mock({
-			domain: "channels",
-			method: "updateBinding",
-			plannedEndpoint: "PUT /gateways/:platform/attachments/:channelId"
-		}, async (input) => {
-			const agentId = requireAgentId(input.agentId);
-			const store = readStore();
-			const connections = store[agentId] ?? [];
-			const connection = findConnection(connections, input.connectionId);
-			const binding = connection.bindings.find((entry) => entry.id === input.bindingId);
-			if (!binding) throw new Error(`Channel binding not found: ${input.bindingId}`);
-			if (input.patch.mode !== void 0) binding.mode = input.patch.mode;
-			if (input.patch.subscribeOnMention !== void 0) binding.subscribeOnMention = input.patch.subscribeOnMention;
-			binding.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-			writeStore({
-				...store,
-				[agentId]: connections
-			});
-			return clone(connection);
-		}),
-		/** Remove a channel binding. */
-		removeBinding: mock({
-			domain: "channels",
-			method: "removeBinding",
-			plannedEndpoint: "DELETE /gateways/:platform/attachments/:channelId"
-		}, async (input) => {
-			const agentId = requireAgentId(input.agentId);
-			const store = readStore();
-			const connections = store[agentId] ?? [];
-			const connection = findConnection(connections, input.connectionId);
-			connection.bindings = connection.bindings.filter((entry) => entry.id !== input.bindingId);
-			writeStore({
-				...store,
-				[agentId]: connections
-			});
-			return clone(connection);
-		}),
-		/** Disconnect the agent from a platform (removes the connection + its bindings). */
-		disconnect: mock({
-			domain: "channels",
-			method: "disconnect",
-			plannedEndpoint: "DELETE /api/agents/:agentId/channels/:connectionId"
-		}, async (input) => {
-			const agentId = requireAgentId(input.agentId);
-			const store = readStore();
-			const next = (store[agentId] ?? []).filter((entry) => entry.id !== input.connectionId);
-			writeStore({
-				...store,
-				[agentId]: next
-			});
-		})
 	};
 }
 const JWT_RETRY_HEADER = "x-keystroke-jwt-retry";
@@ -4935,7 +4471,7 @@ function createPlatformClient(options) {
 		gatewayAttachments: createGatewayAttachmentsResource(http),
 		projectMetrics: createProjectMetricsResource(http),
 		projectFiles: createProjectFilesResource(http),
-		channels: createChannelsResource(),
+		channels: createChannelsResource(http),
 		members: createMembersResource(http),
 		invitations: createInvitationsResource(http),
 		apiKeys: createApiKeysResource(),
@@ -5382,19 +4918,19 @@ function registerAppCommand(program) {
 }
 //#endregion
 //#region src/commands/connect/parse-connect-scopes.ts
-function parseConnectScopes(scopes, projectIds) {
+function parseConnectScopes(scopes, projectSlugs) {
 	const normalized = scopes.length > 0 ? scopes : ["org"];
 	for (const scope of normalized) if (scope !== "org" && scope !== "user" && scope !== "project") throw new Error(`Unknown scope "${scope}". Expected org, user, or project.`);
 	const createOrganizationCredential = normalized.includes("org");
 	const createUserProvidedCredential = normalized.includes("user");
 	const includesProject = normalized.includes("project");
-	const selectedProjectIds = includesProject ? projectIds : [];
-	if (includesProject && selectedProjectIds.length === 0) throw new Error("--project-id is required when scope includes project");
-	if (!createOrganizationCredential && !createUserProvidedCredential && selectedProjectIds.length === 0) throw new Error("At least one scope is required via --scope and/or --project-id");
+	const selectedProjects = includesProject ? projectSlugs : [];
+	if (includesProject && selectedProjects.length === 0) throw new Error("--project-slug is required when scope includes project");
+	if (!createOrganizationCredential && !createUserProvidedCredential && selectedProjects.length === 0) throw new Error("At least one scope is required via --scope and/or --project-slug");
 	return {
 		createOrganizationCredential,
 		createUserProvidedCredential,
-		projectIds: selectedProjectIds
+		projects: selectedProjects
 	};
 }
 //#endregion
@@ -5430,7 +4966,7 @@ async function runConnect(options) {
 			appId: provider.key,
 			scopes: oauthScopes,
 			permissionMode: "default",
-			projectIds: scopes.projectIds,
+			projects: scopes.projects,
 			createOrganizationCredential: scopes.createOrganizationCredential,
 			createUserProvidedCredential: scopes.createUserProvidedCredential
 		});
@@ -5469,11 +5005,11 @@ function resolveConnectTargetOptions() {
 	if (local) return { local: true };
 	return { orgScoped: true };
 }
-function collectValues(value, previous) {
+function collectValues$1(value, previous) {
 	return previous.concat([value]);
 }
 function registerConnectCommand(program) {
-	program.command("connect [provider]").description("Connect third-party accounts (uses apiTarget; --local for local server)").option("--oauth-scope <scope>", "OAuth permission scope to request (repeatable)", collectValues, []).option("--scope <scope>", "Credential scope: org, user, or project (repeatable)", collectValues, []).option("--project-id <id>", "Project id when scope includes project (repeatable)", collectValues, []).option("--print-url", "Print the authorize URL and exit without opening the browser").action((provider, options) => runCliCommand("Could not fetch connect providers", async (ctx) => {
+	program.command("connect [provider]").description("Connect third-party accounts (uses apiTarget; --local for local server)").option("--oauth-scope <scope>", "OAuth permission scope to request (repeatable)", collectValues$1, []).option("--scope <scope>", "Credential scope: org, user, or project (repeatable)", collectValues$1, []).option("--project-slug <slug>", "Project slug when scope includes project (repeatable)", collectValues$1, []).option("--print-url", "Print the authorize URL and exit without opening the browser").action((provider, options) => runCliCommand("Could not fetch connect providers", async (ctx) => {
 		const providers = await ctx.client.connect.listProviders();
 		if (!provider) {
 			if (providers.length === 0) {
@@ -5489,9 +5025,9 @@ function registerConnectCommand(program) {
 			const available = providers.map((entry) => entry.key).join(", ") || "(none)";
 			throw new Error(`Unknown provider "${provider}". Available: ${available}`);
 		}
-		const hasScopeFlags = options.scope.length > 0 || options.projectId.length > 0;
-		if (ctx.apiTarget.mode === "local" && hasScopeFlags) throw new Error("--scope and --project-id are only supported against the platform API (omit --local)");
-		const credentialScopes = ctx.apiTarget.mode === "platform" ? parseConnectScopes(options.scope, options.projectId) : void 0;
+		const hasScopeFlags = options.scope.length > 0 || options.projectSlug.length > 0;
+		if (ctx.apiTarget.mode === "local" && hasScopeFlags) throw new Error("--scope and --project-slug are only supported against the platform API (omit --local)");
+		const credentialScopes = ctx.apiTarget.mode === "platform" ? parseConnectScopes(options.scope, options.projectSlug) : void 0;
 		const platform = ctx.apiTarget.mode === "platform" ? createCliPlatformClient(createCliConfig()) : void 0;
 		await runConnect({
 			client: ctx.client,
@@ -5505,6 +5041,73 @@ function registerConnectCommand(program) {
 	}, void 0, resolveConnectTargetOptions()));
 }
 //#endregion
+//#region src/commands/project/run-project.ts
+async function withActivePlatformClient(config, fn) {
+	const platform = createCliPlatformClient(config);
+	let active = await platform.organizations.getActive();
+	if (!active) active = await selectActiveOrganization(config);
+	platform.setActiveOrganizationId(active.organization.id);
+	await fn(platform);
+}
+function writeInactiveDeployHints(projects) {
+	const bin = cliBinaryName();
+	for (const project of projects) {
+		if (project.status !== "inactive") continue;
+		process.stderr.write(`Project ${formatProjectLabel(project)} is inactive. Deploy with: ${bin} deploy --project ${formatProjectLabel(project)}\n`);
+	}
+}
+async function runProjectList(config) {
+	await withActivePlatformClient(config, async (platform) => {
+		const projects = await platform.projects.list();
+		process.stdout.write(`${JSON.stringify({ projects }, null, 2)}\n`);
+		if (projects.length === 0) {
+			const bin = cliBinaryName();
+			process.stderr.write(`No projects yet. Create one with: ${bin} project create --name "My project"\n`);
+			return;
+		}
+		writeInactiveDeployHints(projects);
+	});
+}
+async function runProjectMetrics(config, options) {
+	await withActivePlatformClient(config, async (platform) => {
+		const metrics = await platform.projectMetrics.list();
+		if (options.projectRef === void 0) {
+			process.stdout.write(`${JSON.stringify(metrics, null, 2)}\n`);
+			return;
+		}
+		const project = await resolveProjectRef(platform, options.projectRef);
+		const output = Object.fromEntries(Object.entries(metrics).filter(([projectId]) => projectId === project.id));
+		process.stdout.write(`${JSON.stringify(output, null, 2)}\n`);
+	});
+}
+async function runProjectDeploymentsList(config, options) {
+	await withActivePlatformClient(config, async (platform) => {
+		const project = await resolveProjectRef(platform, options.projectRef);
+		const deployments = await platform.deployments.listForProject(project.id);
+		process.stdout.write(`${JSON.stringify({ deployments }, null, 2)}\n`);
+	});
+}
+async function runProjectCreate(config, input) {
+	await withActivePlatformClient(config, async (platform) => {
+		const project = await platform.projects.create(input);
+		process.stdout.write(`${JSON.stringify({ project }, null, 2)}\n`);
+		writeInactiveDeployHints([project]);
+	});
+}
+async function runProjectUpdate(config, input) {
+	await withActivePlatformClient(config, async (platform) => {
+		const { projectId, ...patch } = input;
+		const project = await platform.projects.update(projectId, patch);
+		process.stdout.write(`${JSON.stringify({ project }, null, 2)}\n`);
+	});
+}
+async function runProjectDelete(config, projectId) {
+	await withActivePlatformClient(config, async (platform) => {
+		await platform.projects.delete(projectId);
+		process.stdout.write(`${JSON.stringify({ deleted: projectId }, null, 2)}\n`);
+	});
+}
+//#endregion
 //#region src/commands/credentials/target-options.ts
 function resolveCredentialsTargetOptions(options = {}) {
 	if (options.scopeType === "project") return {
@@ -5515,10 +5118,21 @@ function resolveCredentialsTargetOptions(options = {}) {
 }
 //#endregion
 //#region src/commands/credentials/run-credentials.ts
-async function withActivePlatformClient$1(config, fn) {
-	const platform = createCliPlatformClient(config);
-	await ensureActiveOrganization(config);
-	await fn(platform);
+async function createLocalCredentialsClient(targetOptions) {
+	const config = createCliConfig();
+	const target = await resolveApiTarget(config, {
+		...getCliTargetOptions(),
+		...resolveCredentialsTargetOptions(),
+		...targetOptions
+	});
+	return {
+		config,
+		client: createCliClient(config, {
+			baseUrl: target.baseUrl,
+			platform: target.mode === "platform"
+		}),
+		target
+	};
 }
 function isLocalCredentialsTarget() {
 	return Boolean(getCliTargetOptions().local);
@@ -5534,7 +5148,7 @@ async function runCredentialsCommand(fallback, fn) {
 			});
 			return;
 		}
-		await withActivePlatformClient$1(config, async (platform) => {
+		await withActivePlatformClient(config, async (platform) => {
 			await fn({
 				config,
 				platform,
@@ -5550,15 +5164,14 @@ async function runCredentialsCommand(fallback, fn) {
 	}
 }
 function buildPlatformCreateRequest(args) {
-	const apiKey = Object.values(args.value)[0];
-	if (!apiKey) throw new Error("At least one --set field is required");
+	if (Object.keys(args.value).length === 0) throw new Error("At least one --set field is required");
 	return {
 		appId: args.appId,
 		connectionKind: "manual",
-		apiKey,
-		projectIds: args.scope === "project" && args.projectId ? [args.projectId] : [],
-		createOrganizationCredential: args.scope === "org",
-		createUserProvidedCredential: args.scope === "user"
+		value: args.value,
+		projects: args.targets.projects,
+		createOrganizationCredential: args.targets.createOrganizationCredential,
+		createUserProvidedCredential: args.targets.createUserProvidedCredential
 	};
 }
 function buildPlatformUpdatePatch(args) {
@@ -5573,15 +5186,8 @@ function buildPlatformUpdatePatch(args) {
 function registerCredentialsDeleteCommand(credentials) {
 	credentials.command("delete").description("Delete a credential instance").argument("<id>", "Credential instance id").action((id) => runCredentialsCommand("Delete credential failed", async ({ platform, local }) => {
 		if (local) {
-			const config = createCliConfig();
-			const target = await resolveApiTarget(config, {
-				...getCliTargetOptions(),
-				...resolveCredentialsTargetOptions()
-			});
-			await createCliClient(config, {
-				baseUrl: target.baseUrl,
-				platform: target.mode === "platform"
-			}).credentials.deleteInstance(id);
+			const { client } = await createLocalCredentialsClient();
+			await client.credentials.deleteInstance(id);
 			return;
 		}
 		await platform.credentials.delete(id);
@@ -5592,15 +5198,8 @@ function registerCredentialsDeleteCommand(credentials) {
 function registerCredentialsGetCommand(credentials) {
 	credentials.command("get").description("Get a credential instance by id").argument("<id>", "Credential instance id").action((id) => runCredentialsCommand("Get credential failed", async ({ platform, local }) => {
 		if (local) {
-			const config = createCliConfig();
-			const target = await resolveApiTarget(config, {
-				...getCliTargetOptions(),
-				...resolveCredentialsTargetOptions()
-			});
-			const match = (await createCliClient(config, {
-				baseUrl: target.baseUrl,
-				platform: target.mode === "platform"
-			}).credentials.listInstances()).instances.find((instance) => instance.id === id);
+			const { client } = await createLocalCredentialsClient();
+			const match = (await client.credentials.listInstances()).instances.find((instance) => instance.id === id);
 			if (!match) throw new Error(`Credential ${id} not found`);
 			process.stdout.write(`${JSON.stringify(match, null, 2)}\n`);
 			return;
@@ -5614,15 +5213,8 @@ function registerCredentialsGetCommand(credentials) {
 function registerCredentialsListCommand(credentials) {
 	credentials.command("list").description("List stored credential instances").option("--key <key>", "Filter by credential key (local server only)").action((options) => runCredentialsCommand("List credential instances failed", async ({ platform, local }) => {
 		if (local) {
-			const config = createCliConfig();
-			const target = await resolveApiTarget(config, {
-				...getCliTargetOptions(),
-				...resolveCredentialsTargetOptions()
-			});
-			const result = await createCliClient(config, {
-				baseUrl: target.baseUrl,
-				platform: target.mode === "platform"
-			}).credentials.listInstances(options.key ? { key: options.key } : void 0);
+			const { client } = await createLocalCredentialsClient();
+			const result = await client.credentials.listInstances(options.key ? { key: options.key } : void 0);
 			process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
 			return;
 		}
@@ -5775,83 +5367,119 @@ async function assertNoSetConflict(client, args) {
 	}));
 }
 //#endregion
+//#region src/commands/credentials/parse-set-scopes.ts
+function parseCredentialSetScopes(scopes, projectSlugs) {
+	if (scopes.includes("global")) {
+		if (scopes.length > 1) throw new Error("global scope cannot be combined with org, user, or project");
+		if (projectSlugs.length > 0) throw new Error("global scope cannot be combined with --project-slug");
+		return { global: true };
+	}
+	return parseConnectScopes(scopes, projectSlugs);
+}
+//#endregion
 //#region src/commands/credentials/set.ts
 function registerCredentialsSetCommand(credentials) {
-	credentials.command("set").description("Create a new api_key credential instance").argument("<key>", "Credential key or app id, e.g. exa").requiredOption("--scope <scope>", "org, user, project, or global").option("--project-id <id>", "Project id when scope is project").option("--label <label>", "Human-readable label within the scope").option("--default", "Mark as default for this scope").option("--set <field>", "Credential field as key=value or key=@env:VAR (falls back to project .env when unset in shell)", collectSetValues$1, []).action((key, options) => runCredentialsCommand("Set credential failed", async ({ platform, local }) => {
+	credentials.command("set").description("Create a new api_key credential instance").argument("<key>", "Credential key or app id, e.g. exa").option("--scope <scope>", "org, user, project, or global (repeatable)", collectValues, []).option("--project-slug <slug>", "Project slug when scope includes project (repeatable)", collectValues, []).option("--label <label>", "Human-readable label within the scope").option("--default", "Mark as default for this scope").option("--set <field>", "Credential field as key=value or key=@env:VAR (falls back to project .env when unset in shell)", collectSetValues$1, []).action((key, options) => runCredentialsCommand("Set credential failed", async ({ platform, local }) => {
 		const value = parseCredentialValueFields(options.set);
-		const scopeType = scopeTypeFromCli(options.scope);
-		if (scopeType === "project" && !options.projectId) throw new Error("--project-id is required when scope is project");
+		const parsedScopes = parseCredentialSetScopes(options.scope, options.projectSlug);
 		if (local) {
-			const config = createCliConfig();
-			const target = await resolveApiTarget(config, {
-				...getCliTargetOptions(),
-				...resolveCredentialsTargetOptions({
+			const { client } = await createLocalCredentialsClient();
+			if ("global" in parsedScopes) {
+				const scopeType = scopeTypeFromCli("global");
+				await assertNoSetConflict(client, {
+					key,
+					scope: "global",
 					scopeType,
-					projectId: options.projectId
-				})
-			});
-			const client = createCliClient(config, {
-				baseUrl: target.baseUrl,
-				platform: target.mode === "platform"
-			});
-			await assertNoSetConflict(client, {
-				key,
-				scope: options.scope,
-				scopeType,
-				projectId: options.projectId,
-				label: options.label,
-				setFields: options.set
-			});
-			const result = await client.credentials.createInstance({
-				key,
-				scopeType,
-				scopeId: scopeType === "project" ? options.projectId : void 0,
-				label: options.label,
-				isDefault: options.default,
-				value
-			});
-			process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+					label: options.label,
+					setFields: options.set
+				});
+				const result = await client.credentials.createInstance({
+					key,
+					scopeType,
+					label: options.label,
+					isDefault: options.default,
+					value
+				});
+				process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+				return;
+			}
+			const targets = expandLocalCredentialTargets(parsedScopes);
+			const instances = [];
+			for (const target of targets) {
+				await assertNoSetConflict(client, {
+					key,
+					scope: target.scope,
+					scopeType: target.scopeType,
+					projectId: target.projectSlug,
+					label: options.label,
+					setFields: options.set
+				});
+				instances.push(await client.credentials.createInstance({
+					key,
+					scopeType: target.scopeType,
+					scopeId: target.projectSlug,
+					label: options.label,
+					isDefault: options.default,
+					value
+				}));
+			}
+			if (instances.length === 1) {
+				process.stdout.write(`${JSON.stringify(instances[0], null, 2)}\n`);
+				return;
+			}
+			process.stdout.write(`${JSON.stringify({ instances }, null, 2)}\n`);
 			return;
 		}
-		if (options.scope === "global") throw new Error("global scope is only supported against a local keystroke server");
+		if (options.scope.includes("global") || "global" in parsedScopes) throw new Error("global scope is only supported against a local keystroke server");
 		const created = await platform.credentials.create(buildPlatformCreateRequest({
 			appId: key,
 			value,
-			scope: options.scope,
-			projectId: options.projectId
+			targets: parsedScopes
 		}));
 		if (options.label !== void 0 || options.default !== void 0) {
 			const patch = buildPlatformUpdatePatch({
 				...options.label !== void 0 ? { label: options.label } : {},
 				...options.default !== void 0 ? { isDefault: options.default } : {}
 			});
-			for (const credential of created) {
-				const updated = await platform.credentials.update(credential.id, patch);
-				process.stdout.write(`${JSON.stringify({ credential: updated }, null, 2)}\n`);
-			}
+			const credentials = [];
+			for (const credential of created) credentials.push(await platform.credentials.update(credential.id, patch));
+			process.stdout.write(`${JSON.stringify({ credentials }, null, 2)}\n`);
 			return;
 		}
 		process.stdout.write(`${JSON.stringify({ credentials: created }, null, 2)}\n`);
 	}));
 }
+function collectValues(value, previous) {
+	return previous.concat([value]);
+}
 function collectSetValues$1(value, previous) {
 	return previous.concat([value]);
 }
+function expandLocalCredentialTargets(targets) {
+	const expanded = [];
+	if (targets.createOrganizationCredential) expanded.push({
+		scope: "org",
+		scopeType: scopeTypeFromCli("org")
+	});
+	if (targets.createUserProvidedCredential) expanded.push({
+		scope: "user",
+		scopeType: scopeTypeFromCli("user")
+	});
+	for (const projectSlug of targets.projects) expanded.push({
+		scope: "project",
+		scopeType: scopeTypeFromCli("project"),
+		projectSlug
+	});
+	return expanded;
+}
 //#endregion
 //#region src/commands/credentials/update.ts
 function registerCredentialsUpdateCommand(credentials) {
 	credentials.command("update").description("Update a credential instance").argument("<id>", "Credential instance id").option("--label <label>", "Human-readable label within the scope").option("--default", "Mark as default for this scope").option("--set <field>", "Credential field as key=value or key=@env:VAR", collectSetValues, []).action((id, options) => runCredentialsCommand("Update credential failed", async ({ platform, local }) => {
 		const value = options.set.length > 0 ? parseCredentialValueFields(options.set) : void 0;
 		if (local) {
-			const config = createCliConfig();
-			const target = await resolveApiTarget(config, {
-				...getCliTargetOptions(),
-				...resolveCredentialsTargetOptions()
-			});
-			const result = await createCliClient(config, {
-				baseUrl: target.baseUrl,
-				platform: target.mode === "platform"
-			}).credentials.updateInstance(id, {
+			const { client } = await createLocalCredentialsClient();
+			const result = await client.credentials.updateInstance(id, {
 				...options.label !== void 0 ? { label: options.label } : {},
 				...options.default !== void 0 ? { isDefault: options.default } : {},
 				...value ? { value } : {}
@@ -5992,7 +5620,7 @@ function registerBuildCommand(program) {
 	program.command("build").description("Build the keystroke project for production").option("--dir <path>", "Project directory", process.cwd()).action(async (options) => {
 		try {
 			const root = resolveProjectRoot(options.dir);
-			const { buildApp } = await import("./dist-CcJj87Po.mjs");
+			const { buildApp } = await import("./dist-DkDkM0NH.mjs");
 			await buildApp({ root });
 			process.stdout.write(`Built ${root}\n`);
 		} catch (error) {
@@ -6089,7 +5717,7 @@ async function runDeploy(options) {
 	const client = createCliPlatformClient(config);
 	let source;
 	if (!options.skipBuild) {
-		const { buildApp } = await import("./dist-CcJj87Po.mjs");
+		const { buildApp } = await import("./dist-DkDkM0NH.mjs");
 		source = { files: (await buildApp({
 			root,
 			collectSources: true,
@@ -6189,7 +5817,7 @@ function runtimeChildEnv(parentEnv, overrides) {
 //#region src/project/bootstrap-run.ts
 /** Node args + env for `@keystrokehq/build` bootstrap (shared by start + dev). */
 async function resolveBootstrapRun(options) {
-	const { resolveRuntimeBuildArtifact } = await import("./dist-CcJj87Po.mjs");
+	const { resolveRuntimeBuildArtifact } = await import("./dist-DkDkM0NH.mjs");
 	const loader = pathToFileURL(resolveRuntimeBuildArtifact(options.runtimeNodeModules, "dist/runtime-loader.mjs")).href;
 	const bootstrap = resolveRuntimeBuildArtifact(options.runtimeNodeModules, "dist/bootstrap.mjs");
 	const args = [`--import=${loader}`];
@@ -6339,7 +5967,7 @@ async function runDev(options) {
 	process.on("SIGINT", shutdown);
 	process.on("SIGTERM", shutdown);
 	try {
-		const { watchApp } = await import("./dist-CcJj87Po.mjs");
+		const { watchApp } = await import("./dist-DkDkM0NH.mjs");
 		await watchApp({
 			root,
 			clean: false,
@@ -6367,73 +5995,6 @@ function registerDevCommand(program) {
 	});
 }
 //#endregion
-//#region src/commands/project/run-project.ts
-async function withActivePlatformClient(config, fn) {
-	const platform = createCliPlatformClient(config);
-	let active = await platform.organizations.getActive();
-	if (!active) active = await selectActiveOrganization(config);
-	platform.setActiveOrganizationId(active.organization.id);
-	await fn(platform);
-}
-function writeInactiveDeployHints(projects) {
-	const bin = cliBinaryName();
-	for (const project of projects) {
-		if (project.status !== "inactive") continue;
-		process.stderr.write(`Project ${formatProjectLabel(project)} is inactive. Deploy with: ${bin} deploy --project ${formatProjectLabel(project)}\n`);
-	}
-}
-async function runProjectList(config) {
-	await withActivePlatformClient(config, async (platform) => {
-		const projects = await platform.projects.list();
-		process.stdout.write(`${JSON.stringify({ projects }, null, 2)}\n`);
-		if (projects.length === 0) {
-			const bin = cliBinaryName();
-			process.stderr.write(`No projects yet. Create one with: ${bin} project create --name "My project"\n`);
-			return;
-		}
-		writeInactiveDeployHints(projects);
-	});
-}
-async function runProjectMetrics(config, options) {
-	await withActivePlatformClient(config, async (platform) => {
-		const metrics = await platform.projectMetrics.list();
-		if (options.projectRef === void 0) {
-			process.stdout.write(`${JSON.stringify(metrics, null, 2)}\n`);
-			return;
-		}
-		const project = await resolveProjectRef(platform, options.projectRef);
-		const output = Object.fromEntries(Object.entries(metrics).filter(([projectId]) => projectId === project.id));
-		process.stdout.write(`${JSON.stringify(output, null, 2)}\n`);
-	});
-}
-async function runProjectDeploymentsList(config, options) {
-	await withActivePlatformClient(config, async (platform) => {
-		const project = await resolveProjectRef(platform, options.projectRef);
-		const deployments = await platform.deployments.listForProject(project.id);
-		process.stdout.write(`${JSON.stringify({ deployments }, null, 2)}\n`);
-	});
-}
-async function runProjectCreate(config, input) {
-	await withActivePlatformClient(config, async (platform) => {
-		const project = await platform.projects.create(input);
-		process.stdout.write(`${JSON.stringify({ project }, null, 2)}\n`);
-		writeInactiveDeployHints([project]);
-	});
-}
-async function runProjectUpdate(config, input) {
-	await withActivePlatformClient(config, async (platform) => {
-		const { projectId, ...patch } = input;
-		const project = await platform.projects.update(projectId, patch);
-		process.stdout.write(`${JSON.stringify({ project }, null, 2)}\n`);
-	});
-}
-async function runProjectDelete(config, projectId) {
-	await withActivePlatformClient(config, async (platform) => {
-		await platform.projects.delete(projectId);
-		process.stdout.write(`${JSON.stringify({ deleted: projectId }, null, 2)}\n`);
-	});
-}
-//#endregion
 //#region src/commands/history/run-history.ts
 async function runHistoryList(config, filters) {
 	await withActivePlatformClient(config, async (platform) => {
@@ -6954,7 +6515,7 @@ async function runStart(options) {
 	const apiPort = Number(new URL(serverUrl).port || 80);
 	const runtimeNodeModules = resolveCliRuntimeNodeModules(resolveCliRoot(import.meta.url));
 	ensureNativeDeps(runtimeNodeModules);
-	const { buildApp } = await import("./dist-CcJj87Po.mjs");
+	const { buildApp } = await import("./dist-DkDkM0NH.mjs");
 	await buildApp({
 		root,
 		clean: false
@@ -7102,6 +6663,143 @@ function registerWorkflowCommand(program) {
 	registerWorkflowRunsCommand(workflow);
 }
 //#endregion
+//#region src/commands/channel/run-channel.ts
+async function runChannelPlatformsList(client) {
+	return client.channels.listPlatforms();
+}
+async function runChannelAccounts(client, projectId, platform) {
+	return client.channels.listAccounts(projectId, platform);
+}
+async function runChannelList(client, projectId, agentId) {
+	return client.channels.listForAgent(projectId, agentId);
+}
+async function runChannelDirectory(client, projectId, platform, accountId) {
+	return client.channels.listChannels(projectId, platform, accountId);
+}
+async function runChannelBind(client, projectId, input) {
+	return client.channels.bind(projectId, input);
+}
+async function runChannelUpdateBinding(client, projectId, input) {
+	return client.channels.updateBinding(projectId, input);
+}
+async function runChannelUnbind(client, projectId, input) {
+	return client.channels.removeBinding(projectId, input);
+}
+//#endregion
+//#region src/commands/channel/platforms.ts
+function registerChannelPlatformsCommand(channel) {
+	channel.command("platforms").description("Browse gateway-enabled apps").command("list").description("List apps that support agent external channels").action(() => runCliCommand("List channel platforms failed", async () => {
+		const config = createCliConfig();
+		const client = createCliPlatformClient(config);
+		await ensureActiveOrganization(config);
+		const platforms = await runChannelPlatformsList(client);
+		process.stdout.write(`${JSON.stringify({ platforms }, null, 2)}\n`);
+	}, void 0, { orgScoped: true }));
+}
+//#endregion
+//#region src/commands/channel/resolve-channel-project.ts
+async function resolveChannelProjectId(config, projectRef) {
+	const platform = createCliPlatformClient(config);
+	await ensureActiveOrganization(config);
+	const ref = projectRef?.trim() || getCliTargetOptions().projectId?.trim() || config.get("activeProjectId")?.trim();
+	if (!ref) throw new Error("Project is required. Pass --project <slug> or set an active project.");
+	return (await resolveProjectRef(platform, ref)).id;
+}
+//#endregion
+//#region src/commands/channel/list.ts
+function registerChannelAccountsCommand(channel) {
+	channel.command("accounts").description("List available workspace accounts for a platform").requiredOption("--platform <key>", "Platform key (slack)").option("--project <slug>", "Project slug").action(async (options) => runCliCommand("List channel accounts failed", async () => {
+		const config = createCliConfig();
+		const projectId = await resolveChannelProjectId(config, options.project);
+		const client = createCliPlatformClient(config);
+		await ensureActiveOrganization(config);
+		const accounts = await runChannelAccounts(client, projectId, options.platform);
+		process.stdout.write(`${JSON.stringify({ accounts }, null, 2)}\n`);
+	}));
+}
+function registerChannelListCommand(channel) {
+	channel.command("list").description("List channel bindings for an agent").requiredOption("--agent <id>", "Agent id").option("--project <slug>", "Project slug").action(async (options) => runCliCommand("List agent channels failed", async () => {
+		const config = createCliConfig();
+		const projectId = await resolveChannelProjectId(config, options.project);
+		const client = createCliPlatformClient(config);
+		await ensureActiveOrganization(config);
+		const connections = await runChannelList(client, projectId, options.agent);
+		process.stdout.write(`${JSON.stringify({ connections }, null, 2)}\n`);
+	}));
+}
+function registerChannelDirectoryCommand(channel) {
+	channel.command("directory").description("List channels available to bind from a platform directory").requiredOption("--platform <key>", "Platform key (slack)").requiredOption("--account <id>", "Workspace account id (team id)").option("--project <slug>", "Project slug").action(async (options) => runCliCommand("List channel directory failed", async () => {
+		const config = createCliConfig();
+		const projectId = await resolveChannelProjectId(config, options.project);
+		const client = createCliPlatformClient(config);
+		await ensureActiveOrganization(config);
+		const channels = await runChannelDirectory(client, projectId, options.platform, options.account);
+		process.stdout.write(`${JSON.stringify({ channels }, null, 2)}\n`);
+	}));
+}
+function registerChannelBindCommand(channel) {
+	channel.command("bind").description("Bind an agent to a channel").requiredOption("--agent <id>", "Agent id").requiredOption("--platform <key>", "Platform key (slack)").requiredOption("--account <id>", "Workspace account id (team id)").requiredOption("--channel <id>", "Provider channel id").option("--channel-name <name>", "Provider channel name").option("--mode <mode>", "Listen mode (mention, all, dm)", "mention").option("--project <slug>", "Project slug").action(async (options) => runCliCommand("Bind channel failed", async () => {
+		const config = createCliConfig();
+		const projectId = await resolveChannelProjectId(config, options.project);
+		const client = createCliPlatformClient(config);
+		await ensureActiveOrganization(config);
+		const connection = await runChannelBind(client, projectId, {
+			agentId: options.agent,
+			platform: options.platform,
+			accountId: options.account,
+			binding: {
+				channelId: options.channel,
+				channelName: options.channelName ?? options.channel,
+				mode: options.mode,
+				subscribeOnMention: true
+			}
+		});
+		process.stdout.write(`${JSON.stringify({ connection }, null, 2)}\n`);
+	}));
+}
+function registerChannelUnbindCommand(channel) {
+	channel.command("unbind").description("Remove a channel binding from an agent").requiredOption("--agent <id>", "Agent id").requiredOption("--binding <id>", "Binding id").option("--project <slug>", "Project slug").action(async (options) => runCliCommand("Unbind channel failed", async () => {
+		const config = createCliConfig();
+		const projectId = await resolveChannelProjectId(config, options.project);
+		const client = createCliPlatformClient(config);
+		await ensureActiveOrganization(config);
+		const connection = await runChannelUnbind(client, projectId, {
+			agentId: options.agent,
+			bindingId: options.binding
+		});
+		process.stdout.write(`${JSON.stringify({ connection }, null, 2)}\n`);
+	}));
+}
+function registerChannelUpdateBindingCommand(channel) {
+	channel.command("update-binding").description("Update a channel binding listen mode or thread setting").requiredOption("--agent <id>", "Agent id").requiredOption("--binding <id>", "Binding id").option("--mode <mode>", "Listen mode (mention, all, dm)").option("--threads", "Enable thread follow-up (subscribe on mention)").option("--no-threads", "Disable thread follow-up").option("--project <slug>", "Project slug").action(async (options) => runCliCommand("Update channel binding failed", async () => {
+		const config = createCliConfig();
+		const projectId = await resolveChannelProjectId(config, options.project);
+		const client = createCliPlatformClient(config);
+		await ensureActiveOrganization(config);
+		const patch = {};
+		if (options.mode) patch.mode = options.mode;
+		if (options.threads !== void 0) patch.subscribeOnMention = options.threads;
+		const connection = await runChannelUpdateBinding(client, projectId, {
+			agentId: options.agent,
+			bindingId: options.binding,
+			patch
+		});
+		process.stdout.write(`${JSON.stringify({ connection }, null, 2)}\n`);
+	}));
+}
+//#endregion
+//#region src/commands/channel/index.ts
+function registerChannelCommand(program) {
+	const channel = program.command("channel").description("Manage agent external channel bindings");
+	registerChannelPlatformsCommand(channel);
+	registerChannelAccountsCommand(channel);
+	registerChannelListCommand(channel);
+	registerChannelDirectoryCommand(channel);
+	registerChannelBindCommand(channel);
+	registerChannelUnbindCommand(channel);
+	registerChannelUpdateBindingCommand(channel);
+}
+//#endregion
 //#region src/commands/config/use-project.ts
 async function fetchProjectInOrg(config, projectRef) {
 	return resolveProjectRef(createCliPlatformClient(config), projectRef);
@@ -7317,6 +7015,7 @@ function createProgram() {
 	registerDevCommand(program);
 	registerStartCommand(program);
 	registerAgentCommand(program);
+	registerChannelCommand(program);
 	registerAppCommand(program);
 	registerWorkflowCommand(program);
 	registerTriggerCommand(program);