@keystrokehq/cli 0.0.16 → 0.0.18

package/dist/{accept.handler-BPwp_UAE.mjs → accept.handler-B7QzdKCh.mjs}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
-import { n as ui } from "./keystroke.mjs";
-import { i as writeJson } from "./output-CGdYhH0p.mjs";
-import { i as requireClient } from "./context-B1L8pZsH.mjs";
-import { n as isIamJsonMode, t as handleIamError } from "./iam-command-utils-ByLX0A-V.mjs";
+import { a as ui } from "./keystroke.mjs";
+import { i as writeJson } from "./output-BWcVRt-T.mjs";
+import { i as requireClient } from "./context-Bid-Rqj7.mjs";
+import { n as isIamJsonMode, t as handleIamError } from "./iam-command-utils-CSZj4XlH.mjs";
 //#region src/commands/invites/accept.handler.ts
 async function handleInvitesAccept(options, ctx) {
 	const client = requireClient(ctx);

package/dist/{admin-Bb9Hx-gO.mjs → admin-CYpulx_A.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
-import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-CGdYhH0p.mjs";
-import { t as createTypedCommand } from "./commander-D15UZVjp.mjs";
-import { t as OrgRoleSchema } from "./schema-_FQrHcIS.mjs";
+import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-BWcVRt-T.mjs";
+import { t as createTypedCommand } from "./commander-BE37hxR3.mjs";
+import { t as OrgRoleSchema } from "./schema-Lbp5lGJu.mjs";
 import { z } from "zod";
 //#region src/commands/admin/orgs.command.ts
 const AdminOrgsCreateOptionsSchema = JsonOptionSchema.extend({ name: z.string().min(1) });
@@ -28,21 +28,21 @@ function createAdminOrgsCommand() {
 		description: "Manage organizations as a platform admin",
 		schema: AdminOrgsListOptionsSchema,
 		optionsConfig: { ...JSON_OPTION_CONFIG },
-		loadHandler: async () => (await import("./orgs.list.handler-BNjoTJvV.mjs")).handleAdminOrgsList,
+		loadHandler: async () => (await import("./orgs.list.handler-CJ2byIEj.mjs")).handleAdminOrgsList,
 		subcommands: [
 			createTypedCommand({
 				name: "create",
 				description: "Create an organization (requires system.create_org)",
 				schema: AdminOrgsCreateOptionsSchema,
 				optionsConfig: CREATE_OPTIONS_CONFIG,
-				loadHandler: async () => (await import("./orgs.create.handler-vXQgDJZ_.mjs")).handleAdminOrgsCreate
+				loadHandler: async () => (await import("./orgs.create.handler-B4naNUSN.mjs")).handleAdminOrgsCreate
 			}),
 			createTypedCommand({
 				name: "list",
 				description: "List organizations (requires system.view_orgs)",
 				schema: AdminOrgsListOptionsSchema,
 				optionsConfig: { ...JSON_OPTION_CONFIG },
-				loadHandler: async () => (await import("./orgs.list.handler-BNjoTJvV.mjs")).handleAdminOrgsList
+				loadHandler: async () => (await import("./orgs.list.handler-CJ2byIEj.mjs")).handleAdminOrgsList
 			}),
 			createTypedCommand({
 				name: "get",
@@ -54,7 +54,7 @@ function createAdminOrgsCommand() {
 					description: "Organization ID",
 					key: "orgId"
 				},
-				loadHandler: async () => (await import("./orgs.get.handler-D_Jfl18x.mjs")).handleAdminOrgsGet
+				loadHandler: async () => (await import("./orgs.get.handler-Ci_JrT08.mjs")).handleAdminOrgsGet
 			})
 		]
 	});
@@ -157,14 +157,14 @@ function createAdminUsersCommand() {
 		description: "Manage platform users",
 		schema: AdminUsersListOptionsSchema,
 		optionsConfig: { ...JSON_OPTION_CONFIG },
-		loadHandler: async () => (await import("./users.list.handler-BSTIniF1.mjs")).handleAdminUsersList,
+		loadHandler: async () => (await import("./users.list.handler-CacJz6eC.mjs")).handleAdminUsersList,
 		subcommands: [
 			createTypedCommand({
 				name: "list",
 				description: "List platform users",
 				schema: AdminUsersListOptionsSchema,
 				optionsConfig: { ...JSON_OPTION_CONFIG },
-				loadHandler: async () => (await import("./users.list.handler-BSTIniF1.mjs")).handleAdminUsersList
+				loadHandler: async () => (await import("./users.list.handler-CacJz6eC.mjs")).handleAdminUsersList
 			}),
 			createTypedCommand({
 				name: "get",
@@ -176,7 +176,7 @@ function createAdminUsersCommand() {
 					description: "User ID",
 					key: "userId"
 				},
-				loadHandler: async () => (await import("./users.get.handler-D0WO6D1K.mjs")).handleAdminUsersGet
+				loadHandler: async () => (await import("./users.get.handler-Bd0OBI-E.mjs")).handleAdminUsersGet
 			}),
 			createTypedCommand({
 				name: "set-role",
@@ -188,7 +188,7 @@ function createAdminUsersCommand() {
 					description: "User ID",
 					key: "userId"
 				},
-				loadHandler: async () => (await import("./users.set-role.handler-DAKdSkbn.mjs")).handleAdminUsersSetRole
+				loadHandler: async () => (await import("./users.set-role.handler-bZMQtUR0.mjs")).handleAdminUsersSetRole
 			})
 		]
 	});

package/dist/{agents-CbmvvOAx.mjs → agents-Co6Jy_N8.mjs}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 
-import { N as throwReportedCliExit, f as ANSI, n as ui, p as style, x as toErrorMessage } from "./keystroke.mjs";
-import { d as trackProject } from "./dist-BF6r1hfv.mjs";
-import { i as writeJson, n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-CGdYhH0p.mjs";
-import { t as createTypedCommand } from "./commander-D15UZVjp.mjs";
-import { i as readAgentManifestsFromOutDir } from "./dist-FQYQ2FLm.mjs";
-import { t as requireWorkflowsDir } from "./resolve-project-CURYMjex.mjs";
-import { t as createSpinnerProgress } from "./spinner-progress-DfkMzwGx.mjs";
-import { a as runWorkflowBuild, n as renderBuildFailure } from "./workflow-build-C9rQQ4qU.mjs";
-import { i as resolveTypeHint } from "./schema-display-CNqiYBIb.mjs";
+import { a as ui, j as throwReportedCliExit, n as style, t as ANSI, y as toErrorMessage } from "./keystroke.mjs";
+import { i as projects } from "./dist-CIInPRGh.mjs";
+import { i as writeJson, n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-BWcVRt-T.mjs";
+import { t as createTypedCommand } from "./commander-BE37hxR3.mjs";
+import { i as readAgentManifestsFromOutDir } from "./dist-WFPTDQB3.mjs";
+import { t as requireWorkflowsDir } from "./resolve-project-CNQtOWE4.mjs";
+import { t as createSpinnerProgress } from "./spinner-progress-Bx-fYItP.mjs";
+import { a as runWorkflowBuild, n as renderBuildFailure } from "./workflow-build-_WNsLKwW.mjs";
+import { i as resolveTypeHint } from "./schema-display-NVEl_DFY.mjs";
 import { z } from "zod";
 //#region src/commands/agents/inspect-display.ts
 function renderAgentManifestInspect(manifest, options = {}) {
@@ -114,7 +114,7 @@ const agentInspectDependencies = {
 };
 async function handleAgentsInspect(options, ctx) {
 	const resolved = await resolveAgentManifest(options.agent, options.path, { jsonMode: ctx.jsonMode });
-	trackProject(resolved.workflowsDir);
+	projects.track(resolved.workflowsDir);
 	if (ctx.jsonMode) {
 		writeJson({
 			manifest: resolved.manifest,

package/dist/{api-jkf0TTgD.mjs → api-DsK8M-ZH.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { n as CredentialConnectionIdSchema, r as CredentialScopeSchema, t as ConnectionStatusSchema } from "./schema-O9xTWad_.mjs";
+import { n as CredentialConnectionIdSchema, r as CredentialScopeSchema, t as ConnectionStatusSchema } from "./schema-BjH_e4Fo.mjs";
 import { z } from "zod";
 //#region ../../packages/shared-types/src/connections/api.ts
 /**

package/dist/{api-keys-DJlyIf10.mjs → api-keys-BUCLzRv_.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
-import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-CGdYhH0p.mjs";
-import { t as createTypedCommand } from "./commander-D15UZVjp.mjs";
+import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-BWcVRt-T.mjs";
+import { t as createTypedCommand } from "./commander-BE37hxR3.mjs";
 import { z } from "zod";
 //#region src/commands/api-keys/api-keys.command.ts
 const ApiKeysCreateOptionsSchema = JsonOptionSchema.extend({ name: z.string().optional() });
@@ -23,21 +23,21 @@ function createApiKeysCommand() {
 		description: "Manage API keys for your organization",
 		schema: JsonOptionSchema,
 		optionsConfig: { ...JSON_OPTION_CONFIG },
-		loadHandler: async () => (await import("./list.handler-CBEXiTAK.mjs")).handleApiKeysList,
+		loadHandler: async () => (await import("./list.handler-BdRsjRlf.mjs")).handleApiKeysList,
 		subcommands: [
 			createTypedCommand({
 				name: "list",
 				description: "List all API keys for your organization",
 				schema: JsonOptionSchema,
 				optionsConfig: { ...JSON_OPTION_CONFIG },
-				loadHandler: async () => (await import("./list.handler-CBEXiTAK.mjs")).handleApiKeysList
+				loadHandler: async () => (await import("./list.handler-BdRsjRlf.mjs")).handleApiKeysList
 			}),
 			createTypedCommand({
 				name: "create",
 				description: "Create a new API key (raw key shown once)",
 				schema: ApiKeysCreateOptionsSchema,
 				optionsConfig: CREATE_OPTIONS_CONFIG,
-				loadHandler: async () => (await import("./create.handler-DF1Ye4nr.mjs")).handleApiKeysCreate
+				loadHandler: async () => (await import("./create.handler-Cp9CV6SN.mjs")).handleApiKeysCreate
 			}),
 			createTypedCommand({
 				name: "delete",
@@ -49,7 +49,7 @@ function createApiKeysCommand() {
 					description: "API key ID to delete",
 					key: "apiKeyId"
 				},
-				loadHandler: async () => (await import("./delete.handler-Bude0SVP.mjs")).handleApiKeysDelete
+				loadHandler: async () => (await import("./delete.handler-D4ElSAcr.mjs")).handleApiKeysDelete
 			})
 		]
 	});

package/dist/{auth-DpDEkJz7.mjs → auth-niNm-yNT.mjs}

@@ -1,12 +1,13 @@
 #!/usr/bin/env node
 
-import { n as DEFAULT_CLI_WEB_URL } from "./default-urls-BS4twrsS.mjs";
-import { S as AUTH_TIMEOUT_SECONDS } from "./keystroke.mjs";
-import { t as createTypedCommand } from "./commander-D15UZVjp.mjs";
+import { n as DEFAULT_CLI_WEB_URL } from "./default-urls-CTQqM1_A.mjs";
+import { b as AUTH_TIMEOUT_SECONDS } from "./keystroke.mjs";
+import { t as createTypedCommand } from "./commander-BE37hxR3.mjs";
 import { z } from "zod";
 //#region src/commands/auth/auth.command.ts
 const AuthOptionsSchema = z.object({
 	webUrl: z.url().optional().describe("Keystroke web URL"),
+	insecureStorage: z.boolean().default(false).describe("Store API keys in plaintext file storage instead of the OS credential store"),
 	timeout: z.coerce.number().int().min(AUTH_TIMEOUT_SECONDS.min).max(AUTH_TIMEOUT_SECONDS.max).default(AUTH_TIMEOUT_SECONDS.default).describe("Timeout in seconds")
 });
 const AUTH_OPTIONS_CONFIG = {
@@ -14,6 +15,10 @@ const AUTH_OPTIONS_CONFIG = {
 		flag: "--web-url <url>",
 		description: `Keystroke web URL (default: saved credentials, WEB_URL env, or ${DEFAULT_CLI_WEB_URL})`
 	},
+	insecureStorage: {
+		flag: "--insecure-storage",
+		description: "Store the API key in plaintext file storage instead of the OS credential store"
+	},
 	timeout: {
 		flag: "--timeout <seconds>",
 		description: `Authentication timeout in seconds (default: ${AUTH_TIMEOUT_SECONDS.default})`
@@ -25,28 +30,28 @@ function createAuthCommand() {
 		description: "Authenticate Keystroke CLI via device flow",
 		schema: AuthOptionsSchema,
 		optionsConfig: AUTH_OPTIONS_CONFIG,
-		loadHandler: async () => (await import("./auth.handler-u3qmoUX0.mjs")).handleAuth,
+		loadHandler: async () => (await import("./auth.handler-BTH-Qb00.mjs")).handleAuth,
 		subcommands: [
 			createTypedCommand({
 				name: "clear",
 				description: "Revoke the saved API key and remove local credentials",
 				schema: z.object({}),
 				optionsConfig: {},
-				loadHandler: async () => (await import("./clear.handler-Dpe05eTq.mjs")).handleAuthClear
+				loadHandler: async () => (await import("./clear.handler-BDlwBzX4.mjs")).handleAuthClear
 			}),
 			createTypedCommand({
 				name: "test",
 				description: "Verify that the saved API key is valid",
 				schema: z.object({}),
 				optionsConfig: {},
-				loadHandler: async () => (await import("./test.handler-Dk3CmTa7.mjs")).handleAuthTest
+				loadHandler: async () => (await import("./test.handler-Cq2l7SAr.mjs")).handleAuthTest
 			}),
 			createTypedCommand({
 				name: "status",
 				description: "Show the current signed-in identity and organization context",
 				schema: z.object({}),
 				optionsConfig: {},
-				loadHandler: async () => (await import("./status.handler-DxCJRm1n.mjs")).handleAuthStatus
+				loadHandler: async () => (await import("./status.handler-BsVtDW_V.mjs")).handleAuthStatus
 			})
 		]
 	});

package/dist/{auth.handler-u3qmoUX0.mjs → auth.handler-BTH-Qb00.mjs}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
-import { n as DEFAULT_CLI_WEB_URL, t as DEFAULT_CLI_SERVER_URL } from "./default-urls-BS4twrsS.mjs";
-import { C as AUTH_URL_PATH, D as CLI_AUTH_COMMAND, E as CALLBACK_PATH, T as CALLBACK_LOOPBACK_ORIGIN, c as resolveCliWebUrl, k as CliExitError, n as ui, s as resolveCliServerUrl, u as logger, w as CALLBACK_LOOPBACK_HOST, x as toErrorMessage } from "./keystroke.mjs";
-import { f as upsertOrgCredentials, i as getCredentialsFilePath } from "./dist-BF6r1hfv.mjs";
-import { t as openBrowser } from "./browser-3cUiPlk2.mjs";
+import { n as DEFAULT_CLI_WEB_URL, t as DEFAULT_CLI_SERVER_URL } from "./default-urls-CTQqM1_A.mjs";
+import { C as CALLBACK_LOOPBACK_ORIGIN, D as CliExitError, P as logger, S as CALLBACK_LOOPBACK_HOST, T as CLI_AUTH_COMMAND, a as ui, d as resolveCliWebUrl, u as resolveCliServerUrl, w as CALLBACK_PATH, x as AUTH_URL_PATH, y as toErrorMessage } from "./keystroke.mjs";
+import { n as credentials } from "./dist-CIInPRGh.mjs";
+import { t as openBrowser } from "./browser-BpJ8ut9z.mjs";
 import { hostname } from "node:os";
 import { z } from "zod";
 import { confirm, isCancel } from "@clack/prompts";
@@ -253,8 +253,8 @@ function isLoopbackUrl(rawUrl) {
 	}
 }
 function resolveAuthHosts(options, ctx) {
-	const savedWeb = ctx.storedCredentials?.webUrl;
-	const savedServer = ctx.storedCredentials?.serverUrl;
+	const savedWeb = ctx.storedServerUrls?.webUrl;
+	const savedServer = ctx.storedServerUrls?.serverUrl;
 	const webUrl = resolveCliWebUrl(options.webUrl, savedWeb);
 	const serverUrl = resolveCliServerUrl(ctx.baseUrl);
 	return {
@@ -283,7 +283,7 @@ function printResolvedHosts(hosts) {
 async function confirmLoopbackHostsOrExit(hosts) {
 	ui.br();
 	ui.warn("About to authenticate against a local development environment");
-	if (hosts.webMatchesSaved || hosts.serverMatchesSaved) ui.hint(`Saved at: ${getCredentialsFilePath()} (from a previous keystroke auth run)`);
+	if (hosts.webMatchesSaved || hosts.serverMatchesSaved) ui.hint(`Saved at: ${credentials.metadataFilePath} (from a previous keystroke auth run)`);
 	else ui.hint("Resolved from your environment (WEB_URL / SERVER_URL).");
 	ui.hint(`CLI default is ${DEFAULT_CLI_WEB_URL} / ${DEFAULT_CLI_SERVER_URL}.`);
 	ui.hint("To switch hosts:");
@@ -322,11 +322,30 @@ function printAuthIntro(params) {
 	ui.hint(`Opening browser: ${params.authUrl}`);
 	ui.br();
 }
-function printAuthSuccess(email, organizationName) {
+function printAuthSuccess(params) {
 	ui.success("Authentication successful.");
-	if (email) ui.hint(`Connected as: ${email}`);
-	if (organizationName) ui.hint(`Organization: ${organizationName}`);
-	ui.hint(`Credentials saved to ${getCredentialsFilePath()}`);
+	if (params.email) ui.hint(`Connected as: ${params.email}`);
+	if (params.organizationName) ui.hint(`Organization: ${params.organizationName}`);
+	ui.hint(`Credentials metadata saved to ${credentials.metadataFilePath}`);
+	if (params.insecureStorage) {
+		ui.warn(`API key saved to plaintext file storage at ${credentials.secretsFilePath}`);
+		return;
+	}
+	ui.hint("Secret saved to OS credential store.");
+}
+function isCredentialStoreError(message) {
+	const normalized = message.toLowerCase();
+	return normalized.includes("credential store") || normalized.includes("keychain");
+}
+function exitCredentialStoreSaveFailed(error) {
+	const message = toErrorMessage(error);
+	ui.error("Could not save the API key to the OS credential store.");
+	ui.hint("Unlock your keychain or credential store, then rerun `keystroke auth`.");
+	ui.hint("For intentional plaintext file storage, rerun `keystroke auth --insecure-storage`.");
+	throw new CliExitError(message, {
+		cause: error,
+		reported: true
+	});
 }
 async function warnIfAlreadyAuthenticated(ctx) {
 	if (!ctx.client) return;
@@ -335,9 +354,8 @@ async function warnIfAlreadyAuthenticated(ctx) {
 	} catch {
 		return;
 	}
-	const stored = ctx.storedCredentials;
-	const identity = stored?.user?.email ?? "unknown user";
-	const activeOrg = stored?.orgs.find((o) => o.organizationId === stored?.activeOrgId);
+	const identity = ctx.storedUser?.email ?? "unknown user";
+	const activeOrg = ctx.storedOrgs.find((o) => o.organizationId === ctx.storedActiveOrgId);
 	ui.br();
 	ui.warn("Already authenticated");
 	ui.hint(`Signed in as ${identity}${activeOrg ? ` (${activeOrg.organizationName})` : ""}`);
@@ -348,6 +366,10 @@ async function handleAuth(options, ctx, overrides) {
 	await warnIfAlreadyAuthenticated(ctx);
 	const hosts = resolveAuthHosts(options, ctx);
 	printResolvedHosts(hosts);
+	if (options.insecureStorage) {
+		ui.warn("Using insecure plaintext file storage for this API key.");
+		ui.hint("For CI/headless usage, prefer KEYSTROKE_API_KEY.");
+	}
 	if (shouldConfirmLoopback(hosts)) await confirmLoopbackHostsOrExit(hosts);
 	const { webUrl, serverUrl } = hosts;
 	const timeoutMs = options.timeout * 1e3;
@@ -385,23 +407,34 @@ async function handleAuth(options, ctx, overrides) {
 			email: callbackPayload.userEmail,
 			name: callbackPayload.userName
 		} : void 0;
-		if (callbackPayload.organizationId) await upsertOrgCredentials({
-			orgEntry: {
-				organizationId: callbackPayload.organizationId,
-				organizationName: callbackPayload.organizationName ?? "Unknown",
+		if (callbackPayload.organizationId) try {
+			await credentials.upsertOrg({
+				org: {
+					organizationId: callbackPayload.organizationId,
+					organizationName: callbackPayload.organizationName ?? "Unknown",
+					apiKeyId: callbackPayload.apiKeyId,
+					createdAt: (/* @__PURE__ */ new Date()).toISOString()
+				},
 				apiKey: callbackPayload.apiKey,
-				apiKeyId: callbackPayload.apiKeyId,
-				createdAt: (/* @__PURE__ */ new Date()).toISOString()
-			},
-			serverUrl: callbackPayload.serverUrl,
-			webUrl,
-			user
-		});
+				serverUrl: callbackPayload.serverUrl,
+				webUrl,
+				user,
+				secretStorage: options.insecureStorage ? "file" : "keychain"
+			});
+		} catch (error) {
+			const message = toErrorMessage(error);
+			if (!options.insecureStorage && isCredentialStoreError(message)) exitCredentialStoreSaveFailed(error);
+			throw error;
+		}
 		logger.info("Auth successful", {
 			email: callbackPayload.userEmail,
 			organizationId: callbackPayload.organizationId
 		});
-		printAuthSuccess(callbackPayload.userEmail, callbackPayload.organizationName);
+		printAuthSuccess({
+			email: callbackPayload.userEmail,
+			organizationName: callbackPayload.organizationName,
+			insecureStorage: options.insecureStorage
+		});
 	} catch (error) {
 		if (toErrorMessage(error).includes("Timed out waiting for device authentication")) ui.error(`Authentication timed out after ${options.timeout}s. Re-run ${CLI_AUTH_COMMAND} and complete the browser prompt before timeout.`);
 		throw error;

package/dist/{build-agents-DseUtzd4-VYWtIZy9.mjs → build-agents-DseUtzd4-CthuIecx.mjs}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 
-import { n as readOptionalJsonSchemaKeys, t as manifestToDeclaredCredentialRequirement } from "./declared-credential-requirements-B6h4WRv4.mjs";
-import { t as AgentVersionManifestSchema } from "./agent-manifest-CZdlCTFs.mjs";
-import { i as createAgentSandboxPackage, n as AGENT_VM_PI_SKILLS_ROOT, r as AGENT_VM_TOOLS_RUNTIME_RELATIVE_PATH, t as AGENT_VM_HOST_CALL_RELATIVE_PATH } from "./agent-bundle-package-DWV6B_5q-rRTPU13L.mjs";
-import { t as readCredentialKeysFromSchemaObject } from "./read-credential-keys-77a91T8M-DMmY6oDW.mjs";
-import { t as bundleSandboxAgentTarget } from "./workflow-bundler-BzHk73PM-AIB4-u4Y.mjs";
+import { n as readOptionalJsonSchemaKeys, t as manifestToDeclaredCredentialRequirement } from "./declared-credential-requirements-D6KT-r-e.mjs";
+import { t as AgentVersionManifestSchema } from "./agent-manifest-tIsqF2OP.mjs";
+import { i as createAgentSandboxPackage, n as AGENT_VM_PI_SKILLS_ROOT, r as AGENT_VM_TOOLS_RUNTIME_RELATIVE_PATH, t as AGENT_VM_HOST_CALL_RELATIVE_PATH } from "./agent-bundle-package-DWV6B_5q-FPT0bJaA.mjs";
+import { t as readCredentialKeysFromSchemaObject } from "./read-credential-keys-77a91T8M-B0eiobOd.mjs";
+import { t as bundleSandboxAgentTarget } from "./workflow-bundler-BzHk73PM-WI31RJjH.mjs";
 import { builtinModules } from "node:module";
-import { lstat, readFile, readdir, realpath } from "node:fs/promises";
 import path from "node:path";
+import { lstat, readFile, readdir, realpath } from "node:fs/promises";
 import * as crypto from "node:crypto";
 import { createHash } from "node:crypto";
 import { performance } from "node:perf_hooks";

package/dist/{build-metadata-C8Ra_Gi--BdoyLQMl.mjs → build-metadata-C8Ra_Gi--L3l8w0rh.mjs}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 
 import { i as __toESM } from "./chunk-CH6r78ws.mjs";
-import { n as FileMetadataSchema, t as FILE_METADATA_SCHEMA_VERSION } from "./file-metadata-DaPPpiTh.mjs";
-import { d as getMetadataRoot, l as createMetadataOutputFile, n as BUILD_OUTPUT_DIR_NAME, u as getFileMetadataPath } from "./layout-CXkZEsXI.mjs";
-import { l as require_out, s as sha256String, t as BASE_IGNORE_PATTERNS } from "./metadata-layout-Bv-B0nHj-CqlcZz_g.mjs";
-import { a as literalString, c as readStringProperty, i as literalNumber, l as unwrapExpression, n as identifierName, o as parseSourceFile, r as isNode, s as readPropertyValue, t as getFirstObjectArgument, u as visitNode } from "./oxc-B3KI3rf_-DdiZWqe2.mjs";
-import { a as getLocalModuleSpecifier, f as resolveLocalModulePath, l as removeEmptyMetadataDirectories, o as getVariableDeclarators, s as isExportedVariableStatement } from "./source-analysis-BBg2E_6G-BQqm16RR.mjs";
-import { n as parseRelativeFilePath, r as toRelativeFilePath, t as normalizeRelativeFilePath } from "./normalize-path-CojS-CgQ-DFTvyA27.mjs";
-import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { n as FileMetadataSchema, t as FILE_METADATA_SCHEMA_VERSION } from "./file-metadata-lrX05iRt.mjs";
+import { d as getMetadataRoot, l as createMetadataOutputFile, n as BUILD_OUTPUT_DIR_NAME, u as getFileMetadataPath } from "./layout-P1v-Gssz.mjs";
+import { l as require_out, s as sha256String, t as BASE_IGNORE_PATTERNS } from "./metadata-layout-Bv-B0nHj-B1c5giJ7.mjs";
+import { a as literalString, c as readStringProperty, i as literalNumber, l as unwrapExpression, n as identifierName, o as parseSourceFile, r as isNode, s as readPropertyValue, t as getFirstObjectArgument, u as visitNode } from "./oxc-B3KI3rf_-Cvx4Z-4H.mjs";
+import { a as getLocalModuleSpecifier, f as resolveLocalModulePath, l as removeEmptyMetadataDirectories, o as getVariableDeclarators, s as isExportedVariableStatement } from "./source-analysis-BBg2E_6G-Ut7kYHOz.mjs";
+import { n as parseRelativeFilePath, r as toRelativeFilePath, t as normalizeRelativeFilePath } from "./normalize-path-CojS-CgQ-D4wSBHgG.mjs";
 import path from "node:path";
+import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
 import { performance } from "node:perf_hooks";
 //#region ../../packages/workflow-builder/dist/build-metadata-C8Ra_Gi-.mjs
 var import_out = /* @__PURE__ */ __toESM(require_out(), 1);

package/dist/{build-progress-BZivcVz4.mjs → build-progress-AR8xow4_.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
-import { u as logger } from "./keystroke.mjs";
-import { n as formatProgressDuration, t as createSpinnerProgress } from "./spinner-progress-DfkMzwGx.mjs";
+import { P as logger } from "./keystroke.mjs";
+import { n as formatProgressDuration, t as createSpinnerProgress } from "./spinner-progress-Bx-fYItP.mjs";
 //#region src/lib/build-progress.ts
 const NEW_STAGE_LABELS = {
 	start: "Starting build",

package/dist/{build-tasks-GVuMLS0h-p08mMOyK.mjs → build-tasks-GVuMLS0h-CCxCqd02.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
-import { n as TaskBuildManifestSchema } from "./task-BNXDZU71.mjs";
-import { n as bundleWorkflowTarget } from "./workflow-bundler-BzHk73PM-AIB4-u4Y.mjs";
-import { t as buildTriggerArtifacts } from "./trigger-artifacts-RizI57RC-CxHwCkQ_.mjs";
+import { n as TaskBuildManifestSchema } from "./task-BguWXIiH.mjs";
+import { n as bundleWorkflowTarget } from "./workflow-bundler-BzHk73PM-WI31RJjH.mjs";
+import { t as buildTriggerArtifacts } from "./trigger-artifacts-RizI57RC-DjhOsdOm.mjs";
 import { performance } from "node:perf_hooks";
 //#region ../../packages/workflow-builder/dist/build-tasks-GVuMLS0h.mjs
 async function buildTaskArtifact(options) {

package/dist/{build-workflows-CV4tBo6S-knCnBKTc.mjs → build-workflows-CV4tBo6S-DhFBlp6m.mjs}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 
-import { f as deduplicateCredentialRequirementEntries } from "./credential-requirements-FtBk5JVB.mjs";
-import { r as WorkflowBuildManifestSchema, t as WORKFLOW_MANIFEST_GENERATOR } from "./workflow-build-manifest-OPFqFD6f.mjs";
-import { a as MANIFEST_FILE_NAME, i as FLOW_FILE_NAME, r as BUNDLE_FILE_NAME, s as SOURCE_MAP_FILE_NAME, t as BUILD_DIR_NAME } from "./layout-CXkZEsXI.mjs";
-import { t as runWithConcurrency } from "./concurrency-gXn9Rw8x-BI6HQNfC.mjs";
-import { n as WorkflowLoaderProtocolError, r as WorkflowMetadataLoadError, s as createLoaderProtocolFailure } from "./import-module--8x5SLum-DaUNACER.mjs";
-import { r as toRelativeFilePath } from "./normalize-path-CojS-CgQ-DFTvyA27.mjs";
-import { n as bundleWorkflowTarget } from "./workflow-bundler-BzHk73PM-AIB4-u4Y.mjs";
-import { t as buildTriggerArtifacts } from "./trigger-artifacts-RizI57RC-CxHwCkQ_.mjs";
-import { realpathSync } from "node:fs";
-import { readFile } from "node:fs/promises";
+import { f as deduplicateCredentialRequirementEntries } from "./credential-requirements-DrrQ9x9P.mjs";
+import { r as WorkflowBuildManifestSchema, t as WORKFLOW_MANIFEST_GENERATOR } from "./workflow-build-manifest-B2GqHyWE.mjs";
+import { a as MANIFEST_FILE_NAME, i as FLOW_FILE_NAME, r as BUNDLE_FILE_NAME, s as SOURCE_MAP_FILE_NAME, t as BUILD_DIR_NAME } from "./layout-P1v-Gssz.mjs";
+import { t as runWithConcurrency } from "./concurrency-gXn9Rw8x-BTlfau8D.mjs";
+import { n as WorkflowLoaderProtocolError, r as WorkflowMetadataLoadError, s as createLoaderProtocolFailure } from "./import-module--8x5SLum-D7EiPjwl.mjs";
+import { r as toRelativeFilePath } from "./normalize-path-CojS-CgQ-D4wSBHgG.mjs";
+import { n as bundleWorkflowTarget } from "./workflow-bundler-BzHk73PM-WI31RJjH.mjs";
+import { t as buildTriggerArtifacts } from "./trigger-artifacts-RizI57RC-DjhOsdOm.mjs";
 import * as path$1 from "node:path";
+import { readFile } from "node:fs/promises";
+import { realpathSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { performance } from "node:perf_hooks";
 //#region ../../packages/workflow-builder/dist/build-workflows-CV4tBo6S.mjs

package/dist/{build.handler-BNSC_zhQ.mjs → build.handler-BmlXPhed.mjs}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 
-import { k as CliExitError } from "./keystroke.mjs";
-import { d as trackProject } from "./dist-BF6r1hfv.mjs";
-import { t as requireWorkflowsDir } from "./resolve-project-CURYMjex.mjs";
-import { a as runWorkflowBuild, i as renderBuildSummary, n as renderBuildFailure, r as renderBuildHeader } from "./workflow-build-C9rQQ4qU.mjs";
-import { t as createBuildProgress } from "./build-progress-BZivcVz4.mjs";
-import { t as withErrorBoundary } from "./error-boundary-CyLcinp1.mjs";
+import { D as CliExitError } from "./keystroke.mjs";
+import { i as projects } from "./dist-CIInPRGh.mjs";
+import { t as requireWorkflowsDir } from "./resolve-project-CNQtOWE4.mjs";
+import { a as runWorkflowBuild, i as renderBuildSummary, n as renderBuildFailure, r as renderBuildHeader } from "./workflow-build-_WNsLKwW.mjs";
+import { t as createBuildProgress } from "./build-progress-AR8xow4_.mjs";
+import { t as withErrorBoundary } from "./error-boundary-B8cmSwJH.mjs";
 //#region src/commands/workflows/build.handler.ts
 async function handleWorkflowsBuild(options, _ctx) {
 	return withErrorBoundary("Build", async () => {
 		const workflowsDir = await requireWorkflowsDir(options.path);
-		trackProject(workflowsDir);
+		projects.track(workflowsDir);
 		renderBuildHeader(options.name);
 		const progress = createBuildProgress(options.name ?? "workflow");
 		try {

package/dist/{clear-cache.handler-gr5VmEYB.mjs → clear-cache.handler-CTLQ1PIN.mjs}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 
-import { n as ui } from "./keystroke.mjs";
-import { n as clearStoredProjects } from "./dist-BF6r1hfv.mjs";
+import { a as ui } from "./keystroke.mjs";
+import { i as projects } from "./dist-CIInPRGh.mjs";
 //#region src/commands/projects/clear-cache.handler.ts
 async function handleProjectsClearCache(_options, _ctx) {
-	if (await clearStoredProjects()) ui.success("Projects cache cleared.");
+	if (await projects.clear()) ui.success("Projects cache cleared.");
 	else ui.text("No projects cache found. Nothing to clear.");
 }
 //#endregion

package/dist/clear.handler-BDlwBzX4.mjs

@@ -0,0 +1,68 @@
+#!/usr/bin/env node
+
+import { P as logger, a as ui, p as AUTH_HINT, y as toErrorMessage } from "./keystroke.mjs";
+import { n as credentials } from "./dist-CIInPRGh.mjs";
+import { createClient } from "./src-B0tNjKMg.mjs";
+//#region src/commands/auth/clear.handler.ts
+async function tryRevokeKey(apiKey, apiKeyId, baseUrl, organizationId) {
+	try {
+		await createClient({
+			apiKey,
+			baseUrl,
+			organizationId
+		}).public.auth.revoke({ apiKeyId });
+		logger.info("API key revoked on server", { apiKeyId });
+	} catch (error) {
+		logger.error("Failed to revoke API key on server", { error: toErrorMessage(error) });
+		ui.warn(`Could not revoke API key on server: ${toErrorMessage(error)}`);
+	}
+}
+async function readApiKeyForRevocation(organizationId) {
+	try {
+		return await credentials.getApiKey(organizationId);
+	} catch (error) {
+		logger.warn("Could not read saved API key for server revocation", {
+			error: toErrorMessage(error),
+			organizationId
+		});
+		ui.warn(`Could not read the saved API key for organization ${organizationId}; skipping server revocation and removing local credentials.`);
+		return null;
+	}
+}
+async function handleAuthClear(_options, ctx) {
+	const storedOrgs = ctx.storedOrgs;
+	const serverUrl = ctx.storedServerUrls?.serverUrl;
+	if (storedOrgs.length === 0) {
+		const hadFiles = await credentials.hasStoredCredentials();
+		await credentials.clear();
+		if (hadFiles) ui.success("Local credentials removed.");
+		else ui.text(`No credentials found. ${AUTH_HINT}`);
+		return;
+	}
+	if (ctx.organizationId && ctx.orgSource === "flag") {
+		const apiKey = await readApiKeyForRevocation(ctx.organizationId);
+		const removed = await credentials.removeOrg(ctx.organizationId);
+		if (!removed) {
+			ui.warn(`No stored credentials for organization ${ctx.organizationId}.`);
+			return;
+		}
+		if (removed.apiKeyId && serverUrl && apiKey) await tryRevokeKey(apiKey, removed.apiKeyId, serverUrl, removed.organizationId);
+		ui.success(`Credentials removed for ${removed.organizationName}.`);
+		return;
+	}
+	const revokeInputs = [];
+	for (const org of storedOrgs) if (org.apiKeyId && serverUrl) {
+		const apiKey = await readApiKeyForRevocation(org.organizationId);
+		if (apiKey) revokeInputs.push({
+			apiKey,
+			apiKeyId: org.apiKeyId,
+			baseUrl: serverUrl,
+			organizationId: org.organizationId
+		});
+	}
+	await credentials.clear();
+	for (const revokeInput of revokeInputs) await tryRevokeKey(revokeInput.apiKey, revokeInput.apiKeyId, revokeInput.baseUrl, revokeInput.organizationId);
+	ui.success("All local credentials removed.");
+}
+//#endregion
+export { handleAuthClear };

package/dist/{clear.handler-CtOZ4aRn.mjs → clear.handler-C_pXAeBG.mjs}

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 
-import { t as clearLogFile } from "./dist-BF6r1hfv.mjs";
+import { M as clearLog, N as closeLogger } from "./keystroke.mjs";
 import { log } from "@clack/prompts";
 //#region src/commands/logs/clear.handler.ts
 async function handleLogsClear(_options, _ctx) {
-	if (await clearLogFile()) log.success("Log file cleared.");
+	await closeLogger();
+	if (await clearLog()) log.success("Log file cleared.");
 	else log.message("No log file found. Nothing to clear.");
 }
 //#endregion

package/dist/{commander-D15UZVjp.mjs → commander-BE37hxR3.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
-import { A as InputValidationError, h as AUTH_HINT, k as CliExitError, l as captureCliTelemetryResolvedContext, n as ui, r as createHiddenGlobalOptions, u as logger, x as toErrorMessage, y as isAuthError } from "./keystroke.mjs";
-import { a as writeJsonError, r as isJsonMode } from "./output-CGdYhH0p.mjs";
+import { D as CliExitError, L as setDebug, O as InputValidationError, _ as isAuthError, a as ui, f as captureCliTelemetryResolvedContext, o as createHiddenGlobalOptions, p as AUTH_HINT, y as toErrorMessage } from "./keystroke.mjs";
+import { a as writeJsonError, r as isJsonMode } from "./output-BWcVRt-T.mjs";
 import { Command } from "commander";
 //#region src/lib/commander.ts
 /**
@@ -76,9 +76,9 @@ function createTypedCommand(params) {
 			if ("json" in parsed) jsonMode = isJsonMode(parsed);
 			else if (process.argv.includes("--json")) jsonMode = true;
 			const globalOpts = cmd.optsWithGlobals();
-			if (globalOpts.debug) logger.setDebug(true);
+			if (globalOpts.debug) setDebug(true);
 			const contextMode = params.contextMode ?? "full";
-			const contextModule = await import("./context-B1L8pZsH.mjs").then((n) => n.n);
+			const contextModule = await import("./context-Bid-Rqj7.mjs").then((n) => n.n);
 			const base = contextMode === "auth" ? await contextModule.resolveAuthContext({
 				apiKey: globalOpts.apiKey,
 				serverUrl: globalOpts.serverUrl,