@keystrokehq/cli 0.0.16 → 0.0.18

package/dist/{org-DUCts2MV.mjs → org-DGS91uc-.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
-import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-CGdYhH0p.mjs";
-import { t as createTypedCommand } from "./commander-D15UZVjp.mjs";
-import { t as OrgRoleSchema } from "./schema-_FQrHcIS.mjs";
+import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-BWcVRt-T.mjs";
+import { t as createTypedCommand } from "./commander-BE37hxR3.mjs";
+import { t as OrgRoleSchema } from "./schema-Lbp5lGJu.mjs";
 import { z } from "zod";
 //#region src/commands/org/invites.command.ts
 const ConfirmJsonSchema$1 = JsonOptionSchema.extend({ confirm: z.boolean().optional() });
@@ -36,14 +36,14 @@ function createOrgInvitesCommand() {
 		description: "Manage organization invitations",
 		schema: OrgInvitesListOptionsSchema,
 		optionsConfig: { ...JSON_OPTION_CONFIG },
-		loadHandler: async () => (await import("./invites.list.handler-CErgY35S.mjs")).handleOrgInvitesList,
+		loadHandler: async () => (await import("./invites.list.handler-CPl4QHfc.mjs")).handleOrgInvitesList,
 		subcommands: [
 			createTypedCommand({
 				name: "list",
 				description: "List organization invites",
 				schema: OrgInvitesListOptionsSchema,
 				optionsConfig: { ...JSON_OPTION_CONFIG },
-				loadHandler: async () => (await import("./invites.list.handler-CErgY35S.mjs")).handleOrgInvitesList
+				loadHandler: async () => (await import("./invites.list.handler-CPl4QHfc.mjs")).handleOrgInvitesList
 			}),
 			createTypedCommand({
 				name: "resend",
@@ -55,7 +55,7 @@ function createOrgInvitesCommand() {
 					description: "Invite ID to resend",
 					key: "inviteId"
 				},
-				loadHandler: async () => (await import("./invites.resend.handler-DRCRIA4F.mjs")).handleOrgInvitesResend
+				loadHandler: async () => (await import("./invites.resend.handler-BAtb3AX4.mjs")).handleOrgInvitesResend
 			}),
 			createTypedCommand({
 				name: "revoke",
@@ -67,7 +67,7 @@ function createOrgInvitesCommand() {
 					description: "Invite ID to revoke",
 					key: "inviteId"
 				},
-				loadHandler: async () => (await import("./invites.revoke.handler-C0FZdAR0.mjs")).handleOrgInvitesRevoke
+				loadHandler: async () => (await import("./invites.revoke.handler-qXOF1Vgx.mjs")).handleOrgInvitesRevoke
 			})
 		]
 	});
@@ -142,28 +142,28 @@ function createOrgMembersCommand() {
 		description: "Manage organization members",
 		schema: MembersListOptionsSchema,
 		optionsConfig: { ...JSON_OPTION_CONFIG },
-		loadHandler: async () => (await import("./members.list.handler-BtuuIgQS.mjs")).handleMembersList,
+		loadHandler: async () => (await import("./members.list.handler-Z4cIbcNg.mjs")).handleMembersList,
 		subcommands: [
 			createTypedCommand({
 				name: "list",
 				description: "List organization members",
 				schema: MembersListOptionsSchema,
 				optionsConfig: { ...JSON_OPTION_CONFIG },
-				loadHandler: async () => (await import("./members.list.handler-BtuuIgQS.mjs")).handleMembersList
+				loadHandler: async () => (await import("./members.list.handler-Z4cIbcNg.mjs")).handleMembersList
 			}),
 			createTypedCommand({
 				name: "invite",
 				description: "Invite a user to the current organization",
 				schema: MembersInviteOptionsSchema,
 				optionsConfig: INVITE_OPTIONS_CONFIG,
-				loadHandler: async () => (await import("./members.invite.handler-B_KVxv5m.mjs")).handleMembersInvite
+				loadHandler: async () => (await import("./members.invite.handler-D4-7fiYC.mjs")).handleMembersInvite
 			}),
 			createTypedCommand({
 				name: "add",
 				description: "Add an existing user to the current organization",
 				schema: MembersAddOptionsSchema,
 				optionsConfig: ADD_OPTIONS_CONFIG,
-				loadHandler: async () => (await import("./members.add.handler-DmYI43rZ.mjs")).handleMembersAdd
+				loadHandler: async () => (await import("./members.add.handler-DBydP0SR.mjs")).handleMembersAdd
 			}),
 			createTypedCommand({
 				name: "update",
@@ -175,7 +175,7 @@ function createOrgMembersCommand() {
 					description: "User ID to update",
 					key: "userId"
 				},
-				loadHandler: async () => (await import("./members.update.handler-D-8izeso.mjs")).handleMembersUpdate
+				loadHandler: async () => (await import("./members.update.handler-B5rBv6dt.mjs")).handleMembersUpdate
 			}),
 			createTypedCommand({
 				name: "remove",
@@ -187,7 +187,7 @@ function createOrgMembersCommand() {
 					description: "User ID to remove",
 					key: "userId"
 				},
-				loadHandler: async () => (await import("./members.remove.handler-Lvg-CqVv.mjs")).handleMembersRemove
+				loadHandler: async () => (await import("./members.remove.handler-J56D83O7.mjs")).handleMembersRemove
 			})
 		]
 	});
@@ -202,28 +202,28 @@ function createOrgCommand() {
 		description: "Manage organization context",
 		schema: OrgOptionsSchema,
 		optionsConfig: ORG_OPTIONS_CONFIG,
-		loadHandler: async () => (await import("./list.handler-Cr_DFAae.mjs")).handleOrgList,
+		loadHandler: async () => (await import("./list.handler-C_iBLBmS.mjs")).handleOrgList,
 		subcommands: [
 			createTypedCommand({
 				name: "list",
 				description: "List your organizations",
 				schema: OrgOptionsSchema,
 				optionsConfig: ORG_OPTIONS_CONFIG,
-				loadHandler: async () => (await import("./list.handler-Cr_DFAae.mjs")).handleOrgList
+				loadHandler: async () => (await import("./list.handler-C_iBLBmS.mjs")).handleOrgList
 			}),
 			createTypedCommand({
 				name: "current",
 				description: "Show the current organization",
 				schema: OrgOptionsSchema,
 				optionsConfig: ORG_OPTIONS_CONFIG,
-				loadHandler: async () => (await import("./current.handler-QZQ-l84v.mjs")).handleOrgCurrent
+				loadHandler: async () => (await import("./current.handler-eCR4nClu.mjs")).handleOrgCurrent
 			}),
 			createTypedCommand({
 				name: "switch",
 				description: "Switch to a different organization",
 				schema: OrgOptionsSchema,
 				optionsConfig: ORG_OPTIONS_CONFIG,
-				loadHandler: async () => (await import("./switch.handler-CTwhIcaQ.mjs")).handleOrgSwitch
+				loadHandler: async () => (await import("./switch.handler-Cu81T2HY.mjs")).handleOrgSwitch
 			}),
 			createOrgMembersCommand(),
 			createOrgInvitesCommand()

package/dist/{orgs.create.handler-vXQgDJZ_.mjs → orgs.create.handler-B4naNUSN.mjs}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
-import { n as ui } from "./keystroke.mjs";
-import { i as writeJson } from "./output-CGdYhH0p.mjs";
-import { i as requireClient } from "./context-B1L8pZsH.mjs";
-import { n as isIamJsonMode, t as handleIamError } from "./iam-command-utils-ByLX0A-V.mjs";
+import { a as ui } from "./keystroke.mjs";
+import { i as writeJson } from "./output-BWcVRt-T.mjs";
+import { i as requireClient } from "./context-Bid-Rqj7.mjs";
+import { n as isIamJsonMode, t as handleIamError } from "./iam-command-utils-CSZj4XlH.mjs";
 //#region src/commands/admin/orgs.create.handler.ts
 async function handleAdminOrgsCreate(options, ctx) {
 	const client = requireClient(ctx);

package/dist/{orgs.get.handler-D_Jfl18x.mjs → orgs.get.handler-Ci_JrT08.mjs}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
-import { n as ui } from "./keystroke.mjs";
-import { i as writeJson } from "./output-CGdYhH0p.mjs";
-import { i as requireClient } from "./context-B1L8pZsH.mjs";
-import { n as isIamJsonMode, t as handleIamError } from "./iam-command-utils-ByLX0A-V.mjs";
+import { a as ui } from "./keystroke.mjs";
+import { i as writeJson } from "./output-BWcVRt-T.mjs";
+import { i as requireClient } from "./context-Bid-Rqj7.mjs";
+import { n as isIamJsonMode, t as handleIamError } from "./iam-command-utils-CSZj4XlH.mjs";
 //#region src/commands/admin/orgs.get.handler.ts
 async function handleAdminOrgsGet(options, ctx) {
 	const client = requireClient(ctx);

package/dist/{orgs.list.handler-BNjoTJvV.mjs → orgs.list.handler-CJ2byIEj.mjs}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
-import { n as ui } from "./keystroke.mjs";
-import { i as writeJson } from "./output-CGdYhH0p.mjs";
-import { i as requireClient } from "./context-B1L8pZsH.mjs";
-import { n as isIamJsonMode, t as handleIamError } from "./iam-command-utils-ByLX0A-V.mjs";
+import { a as ui } from "./keystroke.mjs";
+import { i as writeJson } from "./output-BWcVRt-T.mjs";
+import { i as requireClient } from "./context-Bid-Rqj7.mjs";
+import { n as isIamJsonMode, t as handleIamError } from "./iam-command-utils-CSZj4XlH.mjs";
 import Table from "cli-table3";
 //#region src/commands/admin/orgs.list.handler.ts
 async function handleAdminOrgsList(_options, ctx) {

package/dist/{output-CGdYhH0p.mjs → output-BWcVRt-T.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { N as throwReportedCliExit } from "./keystroke.mjs";
+import { j as throwReportedCliExit } from "./keystroke.mjs";
 import { z } from "zod";
 //#region src/lib/output.ts
 /**

package/dist/paths-JzzFkXQA-CEipIeVl.mjs

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+
+import * as os from "node:os";
+import * as path$1 from "node:path";
+//#region ../../packages/local-memory/dist/paths-JzzFkXQA.mjs
+/**
+* Single source of truth for the Keystroke local-memory directory name.
+* Every path under ~/.keystroke (and projectRoot/.keystroke) must derive
+* from this constant. This is the only place in the repo where the literal
+* '.keystroke' should appear.
+*/
+const KEYSTROKE_DIR = ".keystroke";
+/**
+* Returns the absolute path to the Keystroke base directory.
+*
+* Defaults to `~/.keystroke` (using `os.homedir()`); tests pass a custom
+* `homeDir` to isolate from the real user home.
+*/
+function getKeystrokeBaseDir(homeDir = os.homedir()) {
+	return path$1.join(homeDir, KEYSTROKE_DIR);
+}
+function validateKeystrokePathSegment(segment) {
+	if (segment.length === 0 || segment.includes("\\") || segment === ".." || segment.split("/").includes("..") || path$1.isAbsolute(segment)) throw new Error(`Invalid .keystroke path segment: ${JSON.stringify(segment)}.`);
+}
+/**
+* Returns an absolute path under a project's local `.keystroke` directory.
+*
+* Use this for project-local state owned by other build/runtime packages while
+* keeping the `.keystroke` directory name centralized in local-memory.
+*/
+function getKeystrokeProjectPath(projectRoot, ...segments) {
+	for (const segment of segments) validateKeystrokePathSegment(segment);
+	return path$1.join(path$1.resolve(projectRoot), KEYSTROKE_DIR, ...segments.flatMap((segment) => segment.split("/")));
+}
+//#endregion
+export { getKeystrokeBaseDir as n, getKeystrokeProjectPath as r, KEYSTROKE_DIR as t };

package/dist/{paused.handler-ST9dCe8E.mjs → paused.handler-BQSQvQhB.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
-import { N as throwReportedCliExit, n as ui, x as toErrorMessage } from "./keystroke.mjs";
-import { i as writeJson } from "./output-CGdYhH0p.mjs";
-import { i as requireClient } from "./context-B1L8pZsH.mjs";
+import { a as ui, j as throwReportedCliExit, y as toErrorMessage } from "./keystroke.mjs";
+import { i as writeJson } from "./output-BWcVRt-T.mjs";
+import { i as requireClient } from "./context-Bid-Rqj7.mjs";
 //#region src/commands/workflows/paused/paused.handler.ts
 async function handleWorkflowsPaused(options, ctx) {
 	const client = requireClient(ctx);

package/dist/{projects-CbquwUlm.mjs → projects-D90_uEC2.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
-import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-CGdYhH0p.mjs";
-import { t as createTypedCommand } from "./commander-D15UZVjp.mjs";
+import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-BWcVRt-T.mjs";
+import { t as createTypedCommand } from "./commander-BE37hxR3.mjs";
 import { z } from "zod";
 //#region src/commands/projects/projects.command.ts
 function createProjectsCommand() {
@@ -10,19 +10,19 @@ function createProjectsCommand() {
 		description: "List tracked Keystroke projects",
 		schema: JsonOptionSchema,
 		optionsConfig: { ...JSON_OPTION_CONFIG },
-		loadHandler: async () => (await import("./list.handler-c-8RpgB9.mjs")).handleProjectsList,
+		loadHandler: async () => (await import("./list.handler-BLkQKiV1.mjs")).handleProjectsList,
 		subcommands: [createTypedCommand({
 			name: "list",
 			description: "List all tracked Keystroke projects",
 			schema: JsonOptionSchema,
 			optionsConfig: { ...JSON_OPTION_CONFIG },
-			loadHandler: async () => (await import("./list.handler-c-8RpgB9.mjs")).handleProjectsList
+			loadHandler: async () => (await import("./list.handler-BLkQKiV1.mjs")).handleProjectsList
 		}), createTypedCommand({
 			name: "clear-cache",
 			description: "Clear the stored projects cache (projects.json)",
 			schema: z.object({}),
 			optionsConfig: {},
-			loadHandler: async () => (await import("./clear-cache.handler-gr5VmEYB.mjs")).handleProjectsClearCache
+			loadHandler: async () => (await import("./clear-cache.handler-CTLQ1PIN.mjs")).handleProjectsClearCache
 		})]
 	});
 }

package/dist/{projects-DfaG_3WP.mjs → projects-fWvIJQ80.mjs}

@@ -2204,7 +2204,7 @@ const bundles = (api) => ({
 			})),
 			purpose
 		} }).json();
-		const { batchUpload } = await import("./upload-wwSPAC5_.mjs").then((n) => n.n);
+		const { batchUpload } = await import("./upload-BbcMkyVl.mjs").then((n) => n.n);
 		return batchUpload(workflows.map((wf) => ({
 			name: wf.workflowName,
 			bundle: wf.bundle,

package/dist/{register.handler-BAx0IC-u.mjs → register.handler-CleQJhtQ.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
-import { N as throwReportedCliExit, b as isNetworkError, h as AUTH_HINT, n as ui, x as toErrorMessage } from "./keystroke.mjs";
-import { i as writeJson } from "./output-CGdYhH0p.mjs";
+import { a as ui, j as throwReportedCliExit, p as AUTH_HINT, v as isNetworkError, y as toErrorMessage } from "./keystroke.mjs";
+import { i as writeJson } from "./output-BWcVRt-T.mjs";
 //#region src/commands/integrations/register.handler.ts
 function exitWithError(ctx, message, opts) {
 	if (ctx.jsonMode) {

package/dist/{requirements.handler-D5dFi7XZ.mjs → requirements.handler-B51sxQSy.mjs}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 
-import { a as getProcessEnv, f as ANSI, n as ui, p as style } from "./keystroke.mjs";
-import { i as writeJson } from "./output-CGdYhH0p.mjs";
-import { a as readManifestsFromOutDir } from "./dist-FQYQ2FLm.mjs";
-import { t as requireWorkflowsDir } from "./resolve-project-CURYMjex.mjs";
-import { t as readCredentialEnvMap } from "./credential-env-map-B2nVJXPn.mjs";
-import { a as loadProjectDotenvFile, c as getTerminalContentWidth, o as manifestGroupKey, s as normalizeManifestScopeToServer, t as buildCredentialWorkflowConsumersByGroup, u as truncateWithEllipsis } from "./list-enrichment-C6u5eI0j.mjs";
-import { t as groupCredentialRequirements } from "./credentials-CiOwDS5y.mjs";
+import { a as ui, c as getProcessEnv, n as style, t as ANSI } from "./keystroke.mjs";
+import { i as writeJson } from "./output-BWcVRt-T.mjs";
+import { a as readManifestsFromOutDir } from "./dist-WFPTDQB3.mjs";
+import { t as requireWorkflowsDir } from "./resolve-project-CNQtOWE4.mjs";
+import { t as readCredentialEnvMap } from "./credential-env-map-BA4LNI7x.mjs";
+import { a as loadProjectDotenvFile, c as getTerminalContentWidth, o as manifestGroupKey, s as normalizeManifestScopeToServer, t as buildCredentialWorkflowConsumersByGroup, u as truncateWithEllipsis } from "./list-enrichment-DYvr3XDb.mjs";
+import { t as groupCredentialRequirements } from "./credentials-DUkVbhvj.mjs";
 //#region src/commands/credentials/requirements/requirements-display.ts
 function dimLabel(label, width = 10) {
 	return style(label.padEnd(width), ANSI.dim);

package/dist/resolve-cli-credentials-DytxgMwn.mjs

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+
+import { n as credentials } from "./dist-CIInPRGh.mjs";
+//#region src/lib/resolve-cli-credentials.ts
+/**
+* Resolves CLI credential inputs using explicit overrides first, then stored
+* credentials. Logger calls (when provided) describe which source won so the
+* user understands the fallback chain.
+*
+* Precedence:
+*   1. `input.apiKey` (e.g. `--api-key` flag)
+*   2. The active org's API key from stored credentials
+*
+* Same precedence for `serverUrl`. Never throws — returns undefined fields
+* when no source is available, leaving the decision to the caller.
+*/
+async function resolveCliCredentials(input = {}) {
+	const cred = input.credentials ?? credentials;
+	let active = null;
+	let urls = null;
+	let readErrorMessage;
+	try {
+		active = await cred.getActiveOrg();
+		urls = await cred.getServerUrls();
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		readErrorMessage = message;
+		input.logger?.warn(`Could not read saved credentials from ${cred.metadataFilePath}: ${message}`);
+	}
+	const apiKey = input.apiKey ?? active?.apiKey;
+	const serverUrl = input.serverUrl ?? urls?.serverUrl;
+	if (!input.apiKey && active?.apiKey) input.logger?.info(`Using saved API key from ${cred.metadataFilePath}`);
+	if (!input.serverUrl && urls?.serverUrl) input.logger?.info(`Using saved API URL from ${cred.metadataFilePath}`);
+	return {
+		apiKey,
+		serverUrl,
+		activeOrg: active ? {
+			organizationId: active.org.organizationId,
+			organizationName: active.org.organizationName,
+			apiKey: active.apiKey
+		} : void 0,
+		metadataFilePath: cred.metadataFilePath,
+		readErrorMessage
+	};
+}
+//#endregion
+export { resolveCliCredentials as t };

package/dist/{resolve-project-CURYMjex.mjs → resolve-project-CNQtOWE4.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
-import { j as ProjectNotFoundError, n as ui } from "./keystroke.mjs";
-import { s as readStoredProjects } from "./dist-BF6r1hfv.mjs";
-import { n as findProjectRoot } from "./project-config-CsBMT4TL.mjs";
+import { a as ui, k as ProjectNotFoundError } from "./keystroke.mjs";
+import { i as projects } from "./dist-CIInPRGh.mjs";
+import { n as findProjectRoot } from "./project-config-DudGRFPO.mjs";
 import path from "node:path";
 //#region src/lib/resolve-project.ts
 /**
@@ -23,10 +23,10 @@ async function requireWorkflowsDir(explicitPath) {
 	const dir = await resolveWorkflowsDir(explicitPath);
 	if (dir) return dir;
 	ui.warn("No keystroke.config.ts found in this directory or any parent directory.");
-	const stored = await readStoredProjects();
-	if (stored?.lastProject) {
-		ui.hint(`Last used project: ${stored.lastProject}`);
-		ui.hint(`  cd ${stored.lastProject}`);
+	const lastProject = await projects.getLast();
+	if (lastProject) {
+		ui.hint(`Last used project: ${lastProject}`);
+		ui.hint(`  cd ${lastProject}`);
 	}
 	ui.hint("Run `keystroke init` to initialize a project, or use --path.");
 	throw new ProjectNotFoundError("No keystroke.config.ts found");

package/dist/{run-polling-BWcLQvm0.mjs → run-polling-CC6y2XXI.mjs}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 
-import { A as InputValidationError, n as ui, x as toErrorMessage } from "./keystroke.mjs";
-import { a as readManifestsFromOutDir } from "./dist-FQYQ2FLm.mjs";
-import { a as validateRequiredFields, n as formatValidationError, t as formatMissingInputError } from "./schema-display-CNqiYBIb.mjs";
-import { n as sleep, t as TERMINAL_STATUSES } from "./run-polling-CwlzB5-9.mjs";
-import * as fs from "node:fs/promises";
+import { O as InputValidationError, a as ui, y as toErrorMessage } from "./keystroke.mjs";
+import { a as readManifestsFromOutDir } from "./dist-WFPTDQB3.mjs";
+import { a as validateRequiredFields, n as formatValidationError, t as formatMissingInputError } from "./schema-display-NVEl_DFY.mjs";
+import { n as sleep, t as TERMINAL_STATUSES } from "./run-polling-DARidqo-.mjs";
 import * as path$1 from "node:path";
+import * as fs from "node:fs/promises";
 import { z } from "zod";
 //#region ../../packages/utils/src/json-schema-validation.ts
 const SCHEMA_CACHE_LIMIT = 256;

package/dist/{run.handler-BiBDLoeH.mjs → run.handler-B31BpZJP.mjs}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 
-import { N as throwReportedCliExit, k as CliExitError, n as ui, x as toErrorMessage } from "./keystroke.mjs";
-import { d as trackProject } from "./dist-BF6r1hfv.mjs";
-import { t as assertWorkflowProjectRoot } from "./project-config-CsBMT4TL.mjs";
-import { i as writeJson } from "./output-CGdYhH0p.mjs";
-import { i as requireClient, t as assertProjectConfigMatchesAuthenticatedOrg } from "./context-B1L8pZsH.mjs";
-import { n as resolveWorkflowsDir } from "./resolve-project-CURYMjex.mjs";
-import { t as lookupCurrentDeploymentWorkflow } from "./current-deployment-workflow-BRUEdPrN.mjs";
-import { i as resolveWorkflowGlobals, o as validateInputOrExit, r as resolveRunInput, s as validateWorkflowGlobalsOrExit, t as pollForCompletion } from "./run-polling-BWcLQvm0.mjs";
+import { D as CliExitError, a as ui, j as throwReportedCliExit, y as toErrorMessage } from "./keystroke.mjs";
+import { i as projects } from "./dist-CIInPRGh.mjs";
+import { t as assertWorkflowProjectRoot } from "./project-config-DudGRFPO.mjs";
+import { i as writeJson } from "./output-BWcVRt-T.mjs";
+import { i as requireClient, t as assertProjectConfigMatchesAuthenticatedOrg } from "./context-Bid-Rqj7.mjs";
+import { n as resolveWorkflowsDir } from "./resolve-project-CNQtOWE4.mjs";
+import { t as lookupCurrentDeploymentWorkflow } from "./current-deployment-workflow-DiwUcKoB.mjs";
+import { i as resolveWorkflowGlobals, o as validateInputOrExit, r as resolveRunInput, s as validateWorkflowGlobalsOrExit, t as pollForCompletion } from "./run-polling-CC6y2XXI.mjs";
 //#region src/commands/workflows/run.handler.ts
 async function handleWorkflowsRun(options, ctx) {
 	const client = requireClient(ctx);
@@ -72,7 +72,7 @@ async function resolveProjectId(options, ctx) {
 	}
 	const projectConfig = await assertWorkflowProjectRoot(workflowsDir);
 	await assertProjectConfigMatchesAuthenticatedOrg(requireClient(ctx), projectConfig);
-	trackProject(workflowsDir);
+	projects.track(workflowsDir);
 	return projectConfig.projectId;
 }
 async function loadCurrentDeploymentWorkflow(client, params) {

package/dist/{runs-Bc3zjk7V.mjs → runs-Bg_qDeQi.mjs}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
-import { N as throwReportedCliExit, f as ANSI, n as ui, p as style, x as toErrorMessage } from "./keystroke.mjs";
-import { i as writeJson, n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-CGdYhH0p.mjs";
-import { t as createTypedCommand } from "./commander-D15UZVjp.mjs";
-import { i as requireClient } from "./context-B1L8pZsH.mjs";
+import { a as ui, j as throwReportedCliExit, n as style, t as ANSI, y as toErrorMessage } from "./keystroke.mjs";
+import { i as writeJson, n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-BWcVRt-T.mjs";
+import { t as createTypedCommand } from "./commander-BE37hxR3.mjs";
+import { i as requireClient } from "./context-Bid-Rqj7.mjs";
 import { z } from "zod";
 //#region src/commands/runs/inspect-display.ts
 function renderRunInspect(input) {

package/dist/{skill-installer-DkRJ6oLi.mjs → skill-installer-BBgN2tzW.mjs}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
-import { k as CliExitError, n as ui } from "./keystroke.mjs";
+import { D as CliExitError, a as ui } from "./keystroke.mjs";
 import { createRequire } from "node:module";
-import { access, cp, mkdir, readFile, readdir, rm, symlink, writeFile } from "node:fs/promises";
 import path from "node:path";
+import { access, cp, mkdir, readFile, readdir, rm, symlink, writeFile } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 import { autocompleteMultiselect, cancel, isCancel, select } from "@clack/prompts";
 //#region src/lib/skill-installer/package.ts

package/dist/{skills-sync.handler-C4ztv1Vu.mjs → skills-sync.handler-DOxudKmV.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
-import { k as CliExitError, n as ui } from "./keystroke.mjs";
-import { i as writeJson, r as isJsonMode } from "./output-CGdYhH0p.mjs";
-import { i as UnknownSkillAgentError, n as resolveSkillInstallChoices, r as installKeystrokeAgentSkills, t as summarizeSkillInstall } from "./skill-installer-DkRJ6oLi.mjs";
+import { D as CliExitError, a as ui } from "./keystroke.mjs";
+import { i as writeJson, r as isJsonMode } from "./output-BWcVRt-T.mjs";
+import { i as UnknownSkillAgentError, n as resolveSkillInstallChoices, r as installKeystrokeAgentSkills, t as summarizeSkillInstall } from "./skill-installer-BBgN2tzW.mjs";
 import path from "node:path";
 //#region src/commands/skills/skills-sync.handler.ts
 async function handleSkillsSync(options, _ctx) {

package/dist/{skills.command-DuL4kLUi.mjs → skills.command-JwKWpGvU.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
-import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-CGdYhH0p.mjs";
-import { t as createTypedCommand } from "./commander-D15UZVjp.mjs";
-import { t as SKILL_INSTALL_METHODS } from "./types-D04ah3uY.mjs";
+import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-BWcVRt-T.mjs";
+import { t as createTypedCommand } from "./commander-BE37hxR3.mjs";
+import { t as SKILL_INSTALL_METHODS } from "./types-BMBuhHhW.mjs";
 import { z } from "zod";
 //#region src/commands/skills/skills.command.ts
 const SkillsCommandOptionsSchema = JsonOptionSchema.extend({
@@ -32,13 +32,13 @@ function createSkillsCommand() {
 		description: "Sync Keystroke agent skills (SKILL.md) from @keystrokehq/skills",
 		schema: SkillsCommandOptionsSchema,
 		optionsConfig: SKILLS_OPTIONS_CONFIG,
-		loadHandler: async () => (await import("./skills.handler-R5KAbioE.mjs")).handleSkillsParent,
+		loadHandler: async () => (await import("./skills.handler-Do9I3dQS.mjs")).handleSkillsParent,
 		subcommands: [createTypedCommand({
 			name: "sync",
 			description: "Install bundled Keystroke skills into selected agent skill directories",
 			schema: SkillsCommandOptionsSchema,
 			optionsConfig: SKILLS_OPTIONS_CONFIG,
-			loadHandler: async () => (await import("./skills-sync.handler-C4ztv1Vu.mjs")).handleSkillsSync
+			loadHandler: async () => (await import("./skills-sync.handler-DOxudKmV.mjs")).handleSkillsSync
 		})]
 	});
 	cmd.enablePositionalOptions();

package/dist/{skills.handler-R5KAbioE.mjs → skills.handler-Do9I3dQS.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { n as ui } from "./keystroke.mjs";
+import { a as ui } from "./keystroke.mjs";
 //#region src/commands/skills/skills.handler.ts
 async function handleSkillsParent(_options, _ctx) {
 	ui.hint("Run `keystroke skills sync --agent claude-code --method symlink` to install bundled Keystroke skills for selected agents.");

package/dist/{source-analysis-BBg2E_6G-BQqm16RR.mjs → source-analysis-BBg2E_6G-Ut7kYHOz.mjs}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 
-import { d as getMetadataRoot } from "./layout-CXkZEsXI.mjs";
-import { t as BASE_IGNORE_PATTERNS } from "./metadata-layout-Bv-B0nHj-CqlcZz_g.mjs";
-import { a as literalString, l as unwrapExpression, n as identifierName, r as isNode } from "./oxc-B3KI3rf_-DdiZWqe2.mjs";
-import { readFile, readdir, rm } from "node:fs/promises";
+import { d as getMetadataRoot } from "./layout-P1v-Gssz.mjs";
+import { t as BASE_IGNORE_PATTERNS } from "./metadata-layout-Bv-B0nHj-B1c5giJ7.mjs";
+import { a as literalString, l as unwrapExpression, n as identifierName, r as isNode } from "./oxc-B3KI3rf_-Cvx4Z-4H.mjs";
 import path from "node:path";
+import { readFile, readdir, rm } from "node:fs/promises";
 //#region ../../packages/workflow-builder/dist/source-analysis-BBg2E_6G.mjs
 async function removeAllMetadataArtifacts(outputDir) {
 	await rm(getMetadataRoot(outputDir), {

package/dist/{spinner-progress-DfkMzwGx.mjs → spinner-progress-Bx-fYItP.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { d as originalConsole, f as ANSI, m as isTTY, p as style, u as logger } from "./keystroke.mjs";
+import { F as originalConsole, P as logger, n as style, r as isTTY, t as ANSI } from "./keystroke.mjs";
 import { writeSync } from "node:fs";
 import { Worker } from "node:worker_threads";
 //#region src/lib/spinner-progress.ts

package/dist/{src-BQdOWkyv.mjs → src-B0tNjKMg.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { a as createKyInstance, i as buildSearchParams, n as auth, r as bundles, s as getClientEnv, t as projects$1 } from "./projects-DfaG_3WP.mjs";
+import { a as createKyInstance, i as buildSearchParams, n as auth, r as bundles, s as getClientEnv, t as projects$1 } from "./projects-fWvIJQ80.mjs";
 //#region ../../packages/workflow-sdk/src/v1/admin.ts
 const admin = (api) => ({
 	orgs: {

package/dist/{status.handler-DxCJRm1n.mjs → status.handler-BsVtDW_V.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { b as isNetworkError, g as REAUTH_HINT, h as AUTH_HINT, n as ui, x as toErrorMessage, y as isAuthError } from "./keystroke.mjs";
+import { _ as isAuthError, a as ui, m as REAUTH_HINT, p as AUTH_HINT, v as isNetworkError, y as toErrorMessage } from "./keystroke.mjs";
 //#region src/commands/auth/status.handler.ts
 async function getValidationStatus(ctx) {
 	if (!ctx.client) return { kind: "not_authenticated" };
@@ -35,7 +35,7 @@ async function getLiveUser(ctx, validation) {
 }
 function getLocalOrganization(ctx) {
 	if (!ctx.organizationId) return;
-	const org = ctx.storedCredentials?.orgs.find((entry) => entry.organizationId === ctx.organizationId);
+	const org = ctx.storedOrgs.find((entry) => entry.organizationId === ctx.organizationId);
 	if (!org) return { id: ctx.organizationId };
 	return {
 		id: org.organizationId,
@@ -82,11 +82,25 @@ function printValidationStatus(validation) {
 			return;
 	}
 }
+function printCredentialStorage(ctx) {
+	const info = ctx.credentialStorageInfo;
+	if (info.secretStorageKind === "keychain") {
+		ui.hint("Credential storage: OS credential store");
+		if (ctx.credentialReadError) {
+			ui.warn("Saved credential metadata exists, but the OS credential store is unavailable.");
+			ui.hint("Unlock your keychain or rerun `keystroke auth`.");
+			ui.hint(`Credential store error: ${ctx.credentialReadError}`);
+		}
+		return;
+	}
+	ui.warn("Credential storage: plaintext file (insecure)");
+	ui.hint(`Secrets: ${info.legacySecretsFilePath}`);
+}
 async function handleAuthStatus(_options, ctx) {
 	const validation = await getValidationStatus(ctx);
 	const liveUser = await getLiveUser(ctx, validation);
 	const organization = getLiveOrganization(liveUser, ctx.organizationId ?? (validation.kind === "valid" ? validation.organizationId : void 0)) ?? getLocalOrganization(ctx);
-	const userEmail = liveUser?.email ?? ctx.storedCredentials?.user?.email;
+	const userEmail = liveUser?.email ?? ctx.storedUser?.email;
 	ui.header("Keystroke CLI auth status");
 	if (userEmail) ui.text(`Signed in as: ${userEmail}`);
 	else if (validation.kind === "not_authenticated") ui.hint("No saved user identity found.");
@@ -95,7 +109,8 @@ async function handleAuthStatus(_options, ctx) {
 	if (ctx.orgSource) ui.hint(`Source: ${ctx.orgSource}`);
 	printValidationStatus(validation);
 	if (ctx.baseUrl) ui.hint(`API URL: ${ctx.baseUrl}`);
-	ui.hint(`Credentials: ${ctx.credentialsPath}`);
+	printCredentialStorage(ctx);
+	ui.hint(`Credentials: ${ctx.metadataFilePath}`);
 }
 //#endregion
 export { handleAuthStatus };