@keystrokehq/cli 0.0.154 → 0.0.156

package/dist/index.mjs

@@ -3605,11 +3605,38 @@ function createOrganizationsResource(http, options = {}) {
 		}
 	};
 }
+function listSearchParams(options) {
+	const params = {};
+	const projectId = options?.projectId?.trim();
+	if (projectId) params.projectId = projectId;
+	if (options?.admin) params.admin = "true";
+	return Object.keys(params).length > 0 ? params : void 0;
+}
+function createAgentsResource(http) {
+	return {
+		async list(options) {
+			try {
+				const data = await http.get("/api/agents", { searchParams: listSearchParams(options) }).json();
+				return AgentSummaryListResponseSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async get(agentId) {
+			try {
+				const data = await http.get(`/api/agents/${encodeURIComponent(agentId)}`).json();
+				return AgentSummaryDetailResponseSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		}
+	};
+}
 function createProjectsResource(http) {
 	return {
-		async list() {
+		async list(options) {
 			try {
-				const data = await http.get("/api/projects").json();
+				const data = await http.get("/api/projects", { searchParams: listSearchParams(options) }).json();
 				return ListProjectsResponseSchema.parse(data).projects;
 			} catch (error) {
 				throw await toPlatformError(error);
@@ -3669,48 +3696,20 @@ function createProjectsResource(http) {
 	};
 }
 function createProjectMetricsResource(http) {
-	return { async list() {
+	return { async list(options) {
 		try {
-			const data = await http.get("/api/projects/metrics").json();
+			const data = await http.get("/api/projects/metrics", { searchParams: listSearchParams(options) }).json();
 			return ListProjectMetricsResponseSchema.parse(data).metrics;
 		} catch (error) {
 			throw await toPlatformError(error);
 		}
 	} };
 }
-function listSearchParams$2(options) {
-	const projectId = options?.projectId?.trim();
-	return projectId ? { projectId } : void 0;
-}
-function createAgentsResource(http) {
-	return {
-		async list(options) {
-			try {
-				const data = await http.get("/api/agents", { searchParams: listSearchParams$2(options) }).json();
-				return AgentSummaryListResponseSchema.parse(data);
-			} catch (error) {
-				throw await toPlatformError(error);
-			}
-		},
-		async get(agentId) {
-			try {
-				const data = await http.get(`/api/agents/${encodeURIComponent(agentId)}`).json();
-				return AgentSummaryDetailResponseSchema.parse(data);
-			} catch (error) {
-				throw await toPlatformError(error);
-			}
-		}
-	};
-}
-function listSearchParams$1(options) {
-	const projectId = options?.projectId?.trim();
-	return projectId ? { projectId } : void 0;
-}
 function createWorkflowsResource(http) {
 	return {
 		async list(options) {
 			try {
-				const data = await http.get("/api/workflows", { searchParams: listSearchParams$1(options) }).json();
+				const data = await http.get("/api/workflows", { searchParams: listSearchParams(options) }).json();
 				return WorkflowSummaryListResponseSchema.parse(data);
 			} catch (error) {
 				throw await toPlatformError(error);
@@ -3726,10 +3725,6 @@ function createWorkflowsResource(http) {
 		}
 	};
 }
-function listSearchParams(options) {
-	const projectId = options?.projectId?.trim();
-	return projectId ? { projectId } : void 0;
-}
 function createSkillsResource(http) {
 	return {
 		async list(options) {
@@ -3761,7 +3756,9 @@ function createTeamRequestsResource(http) {
 	} };
 }
 function createRecentsResource(http) {
-	return { async list() {
+	return { 
+	/** Always the viewer's own recents, scoped to their project memberships. */
+async list() {
 		try {
 			const data = await http.get("/api/recents").json();
 			return RecentResourceListResponseSchema.parse(data);
@@ -4010,11 +4007,13 @@ function createHistoryResource(http) {
 		/** Runs across projects the current user can access in the active org. */
 		async list(filters) {
 			try {
-				const parsedFilters = filters ? HistoryRunListQuerySchema.parse(filters) : void 0;
+				const { admin, ...queryFilters } = filters ?? {};
+				const parsedFilters = Object.keys(queryFilters).length ? HistoryRunListQuerySchema.parse(queryFilters) : void 0;
 				const searchParams = new URLSearchParams();
 				if (parsedFilters?.project) searchParams.set("project", parsedFilters.project);
 				if (parsedFilters?.status) searchParams.set("status", parsedFilters.status);
 				if (parsedFilters?.kind) searchParams.set("kind", parsedFilters.kind);
+				if (admin) searchParams.set("admin", "true");
 				const query = searchParams.toString();
 				const data = await http.get(query ? `api/history?${query}` : "api/history").json();
 				return HistoryRunListResponseSchema.parse(data);
@@ -4677,6 +4676,13 @@ function parseJsonOption(value, flag) {
 	}
 }
 //#endregion
+//#region src/organization/require-admin-role.ts
+async function requireAdminRole(config) {
+	await ensureActiveOrganization(config);
+	const active = await createCliPlatformClient(config).organizations.getActive();
+	if (!active || active.role !== "owner" && active.role !== "admin") throw new Error("--admin requires org owner or admin");
+}
+//#endregion
 //#region src/resolve-project-target.ts
 async function resolveActiveProject(config, platform) {
 	const ref = getCliTargetOptions().projectId ?? config.get("activeProjectId");
@@ -4691,12 +4697,16 @@ async function resolveActiveProjectId(config) {
 //#endregion
 //#region src/commands/agent/list.ts
 function registerAgentListCommand(agent) {
-	agent.command("list").description("List agents in the active organization").action(() => runCliCommand("List agents failed", async () => {
+	agent.command("list").description("List agents in the active organization").option("--admin", "List all org resources (org owner or admin only)").action((options) => runCliCommand("List agents failed", async () => {
 		const config = createCliConfig();
 		const client = createCliPlatformClient(config);
 		await ensureActiveOrganization(config);
+		if (options.admin) await requireAdminRole(config);
 		const projectId = await resolveActiveProjectId(config);
-		const result = await client.agents.list(projectId ? { projectId } : void 0);
+		const result = await client.agents.list({
+			...projectId ? { projectId } : {},
+			...options.admin ? { admin: true } : {}
+		});
 		process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
 	}, void 0, { orgScoped: true }));
 }
@@ -4738,6 +4748,131 @@ function registerAgentCommand(program) {
 	registerAgentSessionsCommand(agent);
 }
 //#endregion
+//#region src/commands/project/run-project.ts
+async function withActivePlatformClient(config, fn) {
+	const platform = createCliPlatformClient(config);
+	let active = await platform.organizations.getActive();
+	if (!active) active = await selectActiveOrganization(config);
+	platform.setActiveOrganizationId(active.organization.id);
+	await fn(platform);
+}
+function writeInactiveDeployHints(projects) {
+	const bin = cliBinaryName();
+	for (const project of projects) {
+		if (project.status !== "inactive") continue;
+		process.stderr.write(`Project ${formatProjectLabel(project)} is inactive. Deploy with: ${bin} deploy --project ${formatProjectLabel(project)}\n`);
+	}
+}
+async function runProjectList(config, options = {}) {
+	if (options.admin) await requireAdminRole(config);
+	await withActivePlatformClient(config, async (platform) => {
+		const projects = await platform.projects.list(options.admin ? { admin: true } : void 0);
+		process.stdout.write(`${JSON.stringify({ projects }, null, 2)}\n`);
+		if (projects.length === 0) {
+			const bin = cliBinaryName();
+			process.stderr.write(`No projects yet. Create one with: ${bin} project create --name "My project"\n`);
+			return;
+		}
+		writeInactiveDeployHints(projects);
+	});
+}
+async function runProjectMetrics(config, options = {}) {
+	if (options.admin) await requireAdminRole(config);
+	await withActivePlatformClient(config, async (platform) => {
+		const metrics = await platform.projectMetrics.list(options.admin ? { admin: true } : void 0);
+		if (options.projectRef === void 0) {
+			process.stdout.write(`${JSON.stringify(metrics, null, 2)}\n`);
+			return;
+		}
+		const project = await resolveProjectRef(platform, options.projectRef);
+		const output = Object.fromEntries(Object.entries(metrics).filter(([projectId]) => projectId === project.id));
+		process.stdout.write(`${JSON.stringify(output, null, 2)}\n`);
+	});
+}
+async function runProjectDeploymentsList(config, options) {
+	await withActivePlatformClient(config, async (platform) => {
+		const project = await resolveProjectRef(platform, options.projectRef);
+		const deployments = await platform.deployments.listForProject(project.id);
+		process.stdout.write(`${JSON.stringify({ deployments }, null, 2)}\n`);
+	});
+}
+async function runProjectCreate(config, input) {
+	await withActivePlatformClient(config, async (platform) => {
+		const project = await platform.projects.create(input);
+		process.stdout.write(`${JSON.stringify({ project }, null, 2)}\n`);
+		writeInactiveDeployHints([project]);
+	});
+}
+async function runProjectUpdate(config, input) {
+	await withActivePlatformClient(config, async (platform) => {
+		const { projectId, ...patch } = input;
+		const project = await platform.projects.update(projectId, patch);
+		process.stdout.write(`${JSON.stringify({ project }, null, 2)}\n`);
+	});
+}
+async function runProjectDelete(config, projectId) {
+	await withActivePlatformClient(config, async (platform) => {
+		await platform.projects.delete(projectId);
+		process.stdout.write(`${JSON.stringify({ deleted: projectId }, null, 2)}\n`);
+	});
+}
+//#endregion
+//#region src/commands/api-key/run-api-key.ts
+async function runApiKeyList(config) {
+	await withActivePlatformClient(config, async (platform) => {
+		const apiKeys = await platform.apiKeys.list();
+		process.stdout.write(`${JSON.stringify({ apiKeys }, null, 2)}\n`);
+	});
+}
+async function runApiKeyCreate(config, input) {
+	await withActivePlatformClient(config, async (platform) => {
+		const apiKey = await platform.apiKeys.create(input);
+		process.stdout.write(`${JSON.stringify({ apiKey }, null, 2)}\n`);
+	});
+}
+async function runApiKeyRevoke(config, apiKeyId) {
+	await withActivePlatformClient(config, async (platform) => {
+		await platform.apiKeys.revoke(apiKeyId);
+		process.stdout.write(`${JSON.stringify({ revoked: apiKeyId }, null, 2)}\n`);
+	});
+}
+//#endregion
+//#region src/commands/api-key/index.ts
+async function handleApiKeyError(fallback, action) {
+	const config = createCliConfig();
+	try {
+		await action();
+	} catch (error) {
+		process.stderr.write(`${formatCliError(error, fallback, {
+			serverUrl: getPlatformUrl(config),
+			webUrl: getWebUrl(config)
+		})}\n`);
+		process.exitCode = 1;
+	}
+}
+function registerApiKeyCommand(program) {
+	const apiKey = program.command("api-key").description("Manage org-scoped platform API keys");
+	apiKey.command("list").description("List API keys in the active organization").action(async () => {
+		const config = createCliConfig();
+		await handleApiKeyError("List API keys failed", async () => {
+			await runApiKeyList(config);
+		});
+	});
+	apiKey.command("create").description("Create an API key in the active organization").requiredOption("--name <name>", "API key name").action(async (options) => {
+		const config = createCliConfig();
+		await handleApiKeyError("Create API key failed", async () => {
+			await runApiKeyCreate(config, { name: options.name });
+		});
+	});
+	apiKey.command("revoke").description("Revoke an API key").argument("<apiKeyId>", "API key id").option("-y, --yes", "Skip confirmation prompt").action(async (apiKeyId, options) => {
+		const config = createCliConfig();
+		await handleApiKeyError("Revoke API key failed", async () => {
+			if (!options.yes) throw new Error("Pass --yes to confirm API key revocation");
+			await runApiKeyRevoke(config, apiKeyId);
+		});
+	});
+}
+//#endregion
 //#region src/commands/app/run-app-list.ts
 async function runAppList(client) {
 	return client.apps.listCatalog();
@@ -4883,73 +5018,6 @@ function registerConnectCommand(program) {
 	}, void 0, resolveConnectTargetOptions()));
 }
 //#endregion
-//#region src/commands/project/run-project.ts
-async function withActivePlatformClient(config, fn) {
-	const platform = createCliPlatformClient(config);
-	let active = await platform.organizations.getActive();
-	if (!active) active = await selectActiveOrganization(config);
-	platform.setActiveOrganizationId(active.organization.id);
-	await fn(platform);
-}
-function writeInactiveDeployHints(projects) {
-	const bin = cliBinaryName();
-	for (const project of projects) {
-		if (project.status !== "inactive") continue;
-		process.stderr.write(`Project ${formatProjectLabel(project)} is inactive. Deploy with: ${bin} deploy --project ${formatProjectLabel(project)}\n`);
-	}
-}
-async function runProjectList(config) {
-	await withActivePlatformClient(config, async (platform) => {
-		const projects = await platform.projects.list();
-		process.stdout.write(`${JSON.stringify({ projects }, null, 2)}\n`);
-		if (projects.length === 0) {
-			const bin = cliBinaryName();
-			process.stderr.write(`No projects yet. Create one with: ${bin} project create --name "My project"\n`);
-			return;
-		}
-		writeInactiveDeployHints(projects);
-	});
-}
-async function runProjectMetrics(config, options) {
-	await withActivePlatformClient(config, async (platform) => {
-		const metrics = await platform.projectMetrics.list();
-		if (options.projectRef === void 0) {
-			process.stdout.write(`${JSON.stringify(metrics, null, 2)}\n`);
-			return;
-		}
-		const project = await resolveProjectRef(platform, options.projectRef);
-		const output = Object.fromEntries(Object.entries(metrics).filter(([projectId]) => projectId === project.id));
-		process.stdout.write(`${JSON.stringify(output, null, 2)}\n`);
-	});
-}
-async function runProjectDeploymentsList(config, options) {
-	await withActivePlatformClient(config, async (platform) => {
-		const project = await resolveProjectRef(platform, options.projectRef);
-		const deployments = await platform.deployments.listForProject(project.id);
-		process.stdout.write(`${JSON.stringify({ deployments }, null, 2)}\n`);
-	});
-}
-async function runProjectCreate(config, input) {
-	await withActivePlatformClient(config, async (platform) => {
-		const project = await platform.projects.create(input);
-		process.stdout.write(`${JSON.stringify({ project }, null, 2)}\n`);
-		writeInactiveDeployHints([project]);
-	});
-}
-async function runProjectUpdate(config, input) {
-	await withActivePlatformClient(config, async (platform) => {
-		const { projectId, ...patch } = input;
-		const project = await platform.projects.update(projectId, patch);
-		process.stdout.write(`${JSON.stringify({ project }, null, 2)}\n`);
-	});
-}
-async function runProjectDelete(config, projectId) {
-	await withActivePlatformClient(config, async (platform) => {
-		await platform.projects.delete(projectId);
-		process.stdout.write(`${JSON.stringify({ deleted: projectId }, null, 2)}\n`);
-	});
-}
-//#endregion
 //#region src/commands/credentials/target-options.ts
 function resolveCredentialsTargetOptions(options = {}) {
 	if (options.scopeType === "project") return {
@@ -5839,6 +5907,7 @@ function registerDevCommand(program) {
 //#endregion
 //#region src/commands/history/run-history.ts
 async function runHistoryList(config, filters) {
+	if (filters?.admin) await requireAdminRole(config);
 	await withActivePlatformClient(config, async (platform) => {
 		const runs = await platform.history.list(filters);
 		process.stdout.write(`${JSON.stringify(runs, null, 2)}\n`);
@@ -5860,13 +5929,14 @@ async function runHistoryCancel(config, runId) {
 //#region src/commands/history/index.ts
 function registerHistoryCommand(program) {
 	const history = program.command("history").description("List, inspect, and cancel platform run history");
-	history.command("list").description("List runs across projects in the active organization").option("--project <id>", "Filter by project id").option("--status <status>", "Filter by status (pending, running, sleeping, waiting_hook, completed, failed, canceled)").option("--kind <kind>", "Filter by kind (workflow or agent)").action(async (options) => {
+	history.command("list").description("List runs across projects in the active organization").option("--project <id>", "Filter by project id").option("--status <status>", "Filter by status (pending, running, sleeping, waiting_hook, completed, failed, canceled)").option("--kind <kind>", "Filter by kind (workflow or agent)").option("--admin", "List all org resources (org owner or admin only)").action(async (options) => {
 		const config = createCliConfig();
 		try {
 			await runHistoryList(config, {
 				...options.project ? { project: options.project } : {},
 				...options.status ? { status: options.status } : {},
-				...options.kind ? { kind: options.kind } : {}
+				...options.kind ? { kind: options.kind } : {},
+				...options.admin ? { admin: true } : {}
 			});
 		} catch (error) {
 			process.stderr.write(`${formatCliError(error, "List history failed", {
@@ -6229,6 +6299,15 @@ function registerInitCommand(program) {
 	});
 }
 //#endregion
+//#region src/active-project.ts
+function clearActiveProjectIfMatches(config, project) {
+	const activeProjectId = config.get("activeProjectId");
+	if (activeProjectId === project.id || activeProjectId === project.slug) config.delete("activeProjectId");
+}
+function clearActiveProject(config) {
+	if (config.get("activeProjectId") !== void 0) config.delete("activeProjectId");
+}
+//#endregion
 //#region src/commands/organization/run-organization.ts
 async function runOrganizationUpdate(config, input) {
 	await withActivePlatformClient(config, async (platform) => {
@@ -6236,30 +6315,312 @@ async function runOrganizationUpdate(config, input) {
 		process.stdout.write(`${JSON.stringify({ organization }, null, 2)}\n`);
 	});
 }
+async function runOrganizationMembersList(config) {
+	await withActivePlatformClient(config, async (platform) => {
+		const members = await platform.members.listOrganizationMembers();
+		process.stdout.write(`${JSON.stringify({ members }, null, 2)}\n`);
+	});
+}
+async function runOrganizationMembersInvite(config, input) {
+	await withActivePlatformClient(config, async (platform) => {
+		const result = await platform.members.inviteOrganizationMembers(input);
+		process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+	});
+}
+async function runOrganizationMembersRole(config, input) {
+	await withActivePlatformClient(config, async (platform) => {
+		const member = await platform.members.updateOrganizationMember(input.userId, { role: input.role });
+		process.stdout.write(`${JSON.stringify({ member }, null, 2)}\n`);
+	});
+}
+async function runOrganizationMembersRemove(config, userId) {
+	await withActivePlatformClient(config, async (platform) => {
+		await platform.members.removeOrganizationMember(userId);
+		process.stdout.write(`${JSON.stringify({ removed: userId }, null, 2)}\n`);
+	});
+}
+async function runOrganizationLeave(config) {
+	const platformUrl = getPlatformUrl(config);
+	const token = getAccessToken(platformUrl);
+	if (!token) throw new Error("Not authenticated. Run `keystroke auth login` first.");
+	const user = await getSessionWithBearer(platformUrl, token);
+	if (!user) throw new Error("Session expired. Run `keystroke auth login` again.");
+	await withActivePlatformClient(config, async (platform) => {
+		await platform.members.removeOrganizationMember(user.id);
+		platform.setActiveOrganizationId(null);
+		config.delete("activeOrganizationId");
+		clearActiveProject(config);
+		process.stdout.write(`${JSON.stringify({ left: user.id }, null, 2)}\n`);
+	});
+}
 //#endregion
 //#region src/commands/organization/index.ts
+function collectEmails$1(value, previous) {
+	return [...previous, value];
+}
+function parseInvitableRole(role) {
+	if (role === "admin" || role === "builder") return role;
+	throw new Error("Role must be admin or builder");
+}
+async function handleOrganizationError(fallback, action) {
+	const config = createCliConfig();
+	try {
+		await action();
+	} catch (error) {
+		process.stderr.write(`${formatCliError(error, fallback, {
+			serverUrl: getPlatformUrl(config),
+			webUrl: getWebUrl(config)
+		})}\n`);
+		process.exitCode = 1;
+	}
+}
 function registerOrganizationCommand(program) {
-	program.command("organization").description("Manage the active organization").command("update").description("Update the active organization's display name").requiredOption("--name <name>", "Organization display name").action(async (options) => {
+	const organization = program.command("organization").alias("org").description("Manage the active organization");
+	organization.command("update").description("Update the active organization's display name").requiredOption("--name <name>", "Organization display name").action(async (options) => {
 		const config = createCliConfig();
-		try {
+		await handleOrganizationError("Update organization failed", async () => {
 			await runOrganizationUpdate(config, { name: options.name });
-		} catch (error) {
-			process.stderr.write(`${formatCliError(error, "Update organization failed", {
-				serverUrl: getPlatformUrl(config),
-				webUrl: getWebUrl(config)
-			})}\n`);
-			process.exitCode = 1;
-		}
+		});
+	});
+	organization.command("leave").description("Leave the active organization").option("-y, --yes", "Skip confirmation prompt").action(async (options) => {
+		const config = createCliConfig();
+		await handleOrganizationError("Leave organization failed", async () => {
+			if (!options.yes) throw new Error("Pass --yes to confirm leaving the active organization");
+			await runOrganizationLeave(config);
+		});
+	});
+	const members = organization.command("members").description("Manage organization members in the active organization");
+	members.command("list").description("List members in the active organization").action(async () => {
+		const config = createCliConfig();
+		await handleOrganizationError("List organization members failed", async () => {
+			await runOrganizationMembersList(config);
+		});
+	});
+	members.command("invite").description("Invite people to the active organization").requiredOption("--email <email>", "Email address (repeat for multiple)", collectEmails$1, []).requiredOption("--role <role>", "Member role (admin or builder)").action(async (options) => {
+		const config = createCliConfig();
+		await handleOrganizationError("Invite organization members failed", async () => {
+			await runOrganizationMembersInvite(config, {
+				emails: options.email,
+				role: parseInvitableRole(options.role)
+			});
+		});
+	});
+	members.command("role").description("Update a member's role in the active organization").argument("<userId>", "Member user id").requiredOption("--role <role>", "Member role (admin or builder)").action(async (userId, options) => {
+		const config = createCliConfig();
+		await handleOrganizationError("Update organization member role failed", async () => {
+			await runOrganizationMembersRole(config, {
+				userId,
+				role: parseInvitableRole(options.role)
+			});
+		});
+	});
+	members.command("remove").description("Remove a member from the active organization").argument("<userId>", "Member user id").action(async (userId) => {
+		const config = createCliConfig();
+		await handleOrganizationError("Remove organization member failed", async () => {
+			await runOrganizationMembersRemove(config, userId);
+		});
+	});
+}
+//#endregion
+//#region src/commands/project/run-project-members.ts
+async function resolveMembersProject(platform, config, projectRef) {
+	const ref = projectRef ?? getCliTargetOptions().projectId ?? config.get("activeProjectId");
+	if (!ref) throw new Error("Usage: keystroke --project <slug> project members <command>");
+	return resolveProjectRef(platform, ref);
+}
+async function runProjectMembersList(config, options) {
+	await withActivePlatformClient(config, async (platform) => {
+		const project = await resolveMembersProject(platform, config, options.projectRef);
+		const members = await platform.members.listForProject(project.id);
+		process.stdout.write(`${JSON.stringify({ members }, null, 2)}\n`);
+	});
+}
+async function runProjectMembersInvite(config, input) {
+	await withActivePlatformClient(config, async (platform) => {
+		const project = await resolveMembersProject(platform, config, input.projectRef);
+		const result = await platform.members.inviteToProject({
+			projectId: project.id,
+			emails: input.emails,
+			role: input.role
+		});
+		process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+	});
+}
+async function runProjectMembersRole(config, input) {
+	await withActivePlatformClient(config, async (platform) => {
+		const project = await resolveMembersProject(platform, config, input.projectRef);
+		const member = await platform.members.updateProjectMember(project.id, input.userId, { role: input.role });
+		process.stdout.write(`${JSON.stringify({ member }, null, 2)}\n`);
+	});
+}
+async function runProjectMembersRemove(config, input) {
+	await withActivePlatformClient(config, async (platform) => {
+		const project = await resolveMembersProject(platform, config, input.projectRef);
+		await platform.members.removeProjectMember(project.id, input.userId);
+		process.stdout.write(`${JSON.stringify({ removed: input.userId }, null, 2)}\n`);
+	});
+}
+async function runProjectMembersLeave(config, options) {
+	await withActivePlatformClient(config, async (platform) => {
+		const project = await resolveMembersProject(platform, config, options.projectRef);
+		await platform.members.leaveProject(project.id);
+		clearActiveProjectIfMatches(config, project);
+		process.stdout.write(`${JSON.stringify({ left: project.id }, null, 2)}\n`);
+	});
+}
+//#endregion
+//#region src/commands/project/members.ts
+function collectEmails(value, previous) {
+	return [...previous, value];
+}
+function parseProjectRole$1(role) {
+	if (role === "admin" || role === "builder") return role;
+	throw new Error("Role must be admin or builder");
+}
+function resolveProjectRefOption$1(config, optionsProject) {
+	return optionsProject ?? getCliTargetOptions().projectId ?? config.get("activeProjectId");
+}
+function projectRefInput$1(config, optionsProject) {
+	const projectRef = resolveProjectRefOption$1(config, optionsProject);
+	return projectRef ? { projectRef } : {};
+}
+async function handleProjectMembersError(fallback, action) {
+	const config = createCliConfig();
+	try {
+		await action();
+	} catch (error) {
+		process.stderr.write(`${formatCliError(error, fallback, {
+			serverUrl: getPlatformUrl(config),
+			webUrl: getWebUrl(config)
+		})}\n`);
+		process.exitCode = 1;
+	}
+}
+function registerProjectMembersCommand(project) {
+	const members = project.command("members").description("Manage members for a platform project");
+	members.command("list").description("List members for a project").option("--project <slug>", "Project slug").action(async (options) => {
+		const config = createCliConfig();
+		await handleProjectMembersError("List project members failed", async () => {
+			await runProjectMembersList(config, projectRefInput$1(config, options.project));
+		});
+	});
+	members.command("invite").description("Invite people to a project").option("--project <slug>", "Project slug").requiredOption("--email <email>", "Email address (repeat for multiple)", collectEmails, []).requiredOption("--role <role>", "Project role (admin or builder)").action(async (options) => {
+		const config = createCliConfig();
+		await handleProjectMembersError("Invite project members failed", async () => {
+			await runProjectMembersInvite(config, {
+				...projectRefInput$1(config, options.project),
+				emails: options.email,
+				role: parseProjectRole$1(options.role)
+			});
+		});
+	});
+	members.command("role").description("Update a project member role").argument("<userId>", "Member user id").option("--project <slug>", "Project slug").requiredOption("--role <role>", "Project role (admin or builder)").action(async (userId, options) => {
+		const config = createCliConfig();
+		await handleProjectMembersError("Update project member role failed", async () => {
+			await runProjectMembersRole(config, {
+				...projectRefInput$1(config, options.project),
+				userId,
+				role: parseProjectRole$1(options.role)
+			});
+		});
+	});
+	members.command("remove").description("Remove a member from a project").argument("<userId>", "Member user id").option("--project <slug>", "Project slug").action(async (userId, options) => {
+		const config = createCliConfig();
+		await handleProjectMembersError("Remove project member failed", async () => {
+			await runProjectMembersRemove(config, {
+				...projectRefInput$1(config, options.project),
+				userId
+			});
+		});
+	});
+	members.command("leave").description("Leave a project as the current user").option("--project <slug>", "Project slug").option("-y, --yes", "Skip confirmation prompt").action(async (options) => {
+		const config = createCliConfig();
+		await handleProjectMembersError("Leave project failed", async () => {
+			if (!options.yes) throw new Error("Pass --yes to confirm leaving the project");
+			await runProjectMembersLeave(config, projectRefInput$1(config, options.project));
+		});
+	});
+}
+//#endregion
+//#region src/commands/project/run-project-settings.ts
+async function resolveSettingsProject(platform, config, projectRef) {
+	const ref = projectRef ?? getCliTargetOptions().projectId ?? config.get("activeProjectId");
+	if (!ref) throw new Error("Usage: keystroke --project <slug> project settings <command>");
+	return resolveProjectRef(platform, ref);
+}
+async function runProjectSettingsGet(config, options) {
+	await withActivePlatformClient(config, async (platform) => {
+		const project = await resolveSettingsProject(platform, config, options.projectRef);
+		const settings = await platform.projectSettings.get(project.id);
+		process.stdout.write(`${JSON.stringify({ settings }, null, 2)}\n`);
+	});
+}
+async function runProjectSettingsUpdate(config, input) {
+	await withActivePlatformClient(config, async (platform) => {
+		const project = await resolveSettingsProject(platform, config, input.projectRef);
+		const { projectRef: _projectRef, ...patch } = input;
+		const settings = await platform.projectSettings.update(project.id, patch);
+		process.stdout.write(`${JSON.stringify({ settings }, null, 2)}\n`);
+	});
+}
+//#endregion
+//#region src/commands/project/settings.ts
+function resolveProjectRefOption(config, optionsProject) {
+	return optionsProject ?? getCliTargetOptions().projectId ?? config.get("activeProjectId");
+}
+function projectRefInput(config, optionsProject) {
+	const projectRef = resolveProjectRefOption(config, optionsProject);
+	return projectRef ? { projectRef } : {};
+}
+function parseProjectRole(role) {
+	if (role === "admin" || role === "builder") return role;
+	throw new Error("Default role must be admin or builder");
+}
+function parseInvitePermission(permission) {
+	if (permission === "admin" || permission === "all") return permission;
+	throw new Error("Invite permission must be admin or all");
+}
+async function handleProjectSettingsError(fallback, action) {
+	const config = createCliConfig();
+	try {
+		await action();
+	} catch (error) {
+		process.stderr.write(`${formatCliError(error, fallback, {
+			serverUrl: getPlatformUrl(config),
+			webUrl: getWebUrl(config)
+		})}\n`);
+		process.exitCode = 1;
+	}
+}
+function registerProjectSettingsCommand(project) {
+	const settings = project.command("settings").description("View and update project governance settings");
+	settings.command("get").description("Get settings for a project").option("--project <slug>", "Project slug").action(async (options) => {
+		const config = createCliConfig();
+		await handleProjectSettingsError("Get project settings failed", async () => {
+			await runProjectSettingsGet(config, projectRefInput(config, options.project));
+		});
+	});
+	settings.command("update").description("Update settings for a project").option("--project <slug>", "Project slug").option("--description <description>", "Project description").option("--default-role <role>", "Default role for new members (admin or builder)").option("--invite-permission <permission>", "Who can invite members (admin or all)").action(async (options) => {
+		const config = createCliConfig();
+		await handleProjectSettingsError("Update project settings failed", async () => {
+			if (options.description === void 0 && options.defaultRole === void 0 && options.invitePermission === void 0) throw new Error("At least one of --description, --default-role, or --invite-permission is required");
+			await runProjectSettingsUpdate(config, {
+				...projectRefInput(config, options.project),
+				...options.description !== void 0 ? { description: options.description } : {},
+				...options.defaultRole !== void 0 ? { defaultRole: parseProjectRole(options.defaultRole) } : {},
+				...options.invitePermission !== void 0 ? { invitePermission: parseInvitePermission(options.invitePermission) } : {}
+			});
+		});
 	});
 }
 //#endregion
 //#region src/commands/project/index.ts
 function registerProjectCommand(program) {
 	const project = program.command("project").description("List, create, update, and delete platform projects");
-	project.command("list").description("List projects in the active organization").action(async () => {
+	project.command("list").description("List projects in the active organization").option("--admin", "List all org resources (org owner or admin only)").action(async (options) => {
 		const config = createCliConfig();
 		try {
-			await runProjectList(config);
+			await runProjectList(config, { ...options.admin ? { admin: true } : {} });
 		} catch (error) {
 			process.stderr.write(`${formatCliError(error, "List projects failed", {
 				serverUrl: getPlatformUrl(config),
@@ -6268,10 +6629,13 @@ function registerProjectCommand(program) {
 			process.exitCode = 1;
 		}
 	});
-	project.command("metrics").description("List rollup metrics for projects in the active organization").option("--project <slug>", "Return metrics for a single project").action(async (options) => {
+	project.command("metrics").description("List rollup metrics for projects in the active organization").option("--project <slug>", "Return metrics for a single project").option("--admin", "List all org resources (org owner or admin only)").action(async (options) => {
 		const config = createCliConfig();
 		try {
-			await runProjectMetrics(config, { ...options.project ? { projectRef: options.project } : {} });
+			await runProjectMetrics(config, {
+				...options.project ? { projectRef: options.project } : {},
+				...options.admin ? { admin: true } : {}
+			});
 		} catch (error) {
 			process.stderr.write(`${formatCliError(error, "List project metrics failed", {
 				serverUrl: getPlatformUrl(config),
@@ -6343,6 +6707,8 @@ function registerProjectCommand(program) {
 			process.exitCode = 1;
 		}
 	});
+	registerProjectMembersCommand(project);
+	registerProjectSettingsCommand(project);
 }
 //#endregion
 //#region src/commands/start.ts
@@ -6452,12 +6818,16 @@ function registerTriggerCommand(program) {
 //#endregion
 //#region src/commands/workflow/list.ts
 function registerWorkflowListCommand(workflow) {
-	workflow.command("list").description("List workflows in the active organization").action(() => runCliCommand("List workflows failed", async () => {
+	workflow.command("list").description("List workflows in the active organization").option("--admin", "List all org resources (org owner or admin only)").action((options) => runCliCommand("List workflows failed", async () => {
 		const config = createCliConfig();
 		const client = createCliPlatformClient(config);
 		await ensureActiveOrganization(config);
+		if (options.admin) await requireAdminRole(config);
 		const projectId = await resolveActiveProjectId(config);
-		const result = await client.workflows.list(projectId ? { projectId } : void 0);
+		const result = await client.workflows.list({
+			...projectId ? { projectId } : {},
+			...options.admin ? { admin: true } : {}
+		});
 		process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
 	}, void 0, { orgScoped: true }));
 }
@@ -6760,12 +7130,16 @@ function registerConfigCommand(program) {
 //#endregion
 //#region src/commands/skill/index.ts
 function registerSkillCommand(program) {
-	program.command("skill").description("Inspect platform skills").command("list").description("List skills in the active organization").action(() => runCliCommand("List skills failed", async () => {
+	program.command("skill").description("Inspect platform skills").command("list").description("List skills in the active organization").option("--admin", "List all org resources (org owner or admin only)").action((options) => runCliCommand("List skills failed", async () => {
 		const config = createCliConfig();
 		const client = createCliPlatformClient(config);
 		await ensureActiveOrganization(config);
+		if (options.admin) await requireAdminRole(config);
 		const projectId = await resolveActiveProjectId(config);
-		const result = await client.skills.list(projectId ? { projectId } : void 0);
+		const result = await client.skills.list({
+			...projectId ? { projectId } : {},
+			...options.admin ? { admin: true } : {}
+		});
 		process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
 	}, void 0, { orgScoped: true }));
 }
@@ -6845,6 +7219,7 @@ function createProgram() {
 	registerConnectCommand(program);
 	registerConfigCommand(program);
 	registerOrganizationCommand(program);
+	registerApiKeyCommand(program);
 	registerProjectCommand(program);
 	registerHistoryCommand(program);
 	registerCredentialsCommand(program);