@keystrokehq/cli 0.0.17 → 0.0.18

package/dist/paths-JzzFkXQA-CEipIeVl.mjs

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+
+import * as os from "node:os";
+import * as path$1 from "node:path";
+//#region ../../packages/local-memory/dist/paths-JzzFkXQA.mjs
+/**
+* Single source of truth for the Keystroke local-memory directory name.
+* Every path under ~/.keystroke (and projectRoot/.keystroke) must derive
+* from this constant. This is the only place in the repo where the literal
+* '.keystroke' should appear.
+*/
+const KEYSTROKE_DIR = ".keystroke";
+/**
+* Returns the absolute path to the Keystroke base directory.
+*
+* Defaults to `~/.keystroke` (using `os.homedir()`); tests pass a custom
+* `homeDir` to isolate from the real user home.
+*/
+function getKeystrokeBaseDir(homeDir = os.homedir()) {
+	return path$1.join(homeDir, KEYSTROKE_DIR);
+}
+function validateKeystrokePathSegment(segment) {
+	if (segment.length === 0 || segment.includes("\\") || segment === ".." || segment.split("/").includes("..") || path$1.isAbsolute(segment)) throw new Error(`Invalid .keystroke path segment: ${JSON.stringify(segment)}.`);
+}
+/**
+* Returns an absolute path under a project's local `.keystroke` directory.
+*
+* Use this for project-local state owned by other build/runtime packages while
+* keeping the `.keystroke` directory name centralized in local-memory.
+*/
+function getKeystrokeProjectPath(projectRoot, ...segments) {
+	for (const segment of segments) validateKeystrokePathSegment(segment);
+	return path$1.join(path$1.resolve(projectRoot), KEYSTROKE_DIR, ...segments.flatMap((segment) => segment.split("/")));
+}
+//#endregion
+export { getKeystrokeBaseDir as n, getKeystrokeProjectPath as r, KEYSTROKE_DIR as t };

package/dist/{paused.handler-ST9dCe8E.mjs → paused.handler-BQSQvQhB.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
-import { N as throwReportedCliExit, n as ui, x as toErrorMessage } from "./keystroke.mjs";
-import { i as writeJson } from "./output-CGdYhH0p.mjs";
-import { i as requireClient } from "./context-B1L8pZsH.mjs";
+import { a as ui, j as throwReportedCliExit, y as toErrorMessage } from "./keystroke.mjs";
+import { i as writeJson } from "./output-BWcVRt-T.mjs";
+import { i as requireClient } from "./context-Bid-Rqj7.mjs";
 //#region src/commands/workflows/paused/paused.handler.ts
 async function handleWorkflowsPaused(options, ctx) {
 	const client = requireClient(ctx);

package/dist/{projects-CbquwUlm.mjs → projects-D90_uEC2.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
-import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-CGdYhH0p.mjs";
-import { t as createTypedCommand } from "./commander-D15UZVjp.mjs";
+import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-BWcVRt-T.mjs";
+import { t as createTypedCommand } from "./commander-BE37hxR3.mjs";
 import { z } from "zod";
 //#region src/commands/projects/projects.command.ts
 function createProjectsCommand() {
@@ -10,19 +10,19 @@ function createProjectsCommand() {
 		description: "List tracked Keystroke projects",
 		schema: JsonOptionSchema,
 		optionsConfig: { ...JSON_OPTION_CONFIG },
-		loadHandler: async () => (await import("./list.handler-c-8RpgB9.mjs")).handleProjectsList,
+		loadHandler: async () => (await import("./list.handler-BLkQKiV1.mjs")).handleProjectsList,
 		subcommands: [createTypedCommand({
 			name: "list",
 			description: "List all tracked Keystroke projects",
 			schema: JsonOptionSchema,
 			optionsConfig: { ...JSON_OPTION_CONFIG },
-			loadHandler: async () => (await import("./list.handler-c-8RpgB9.mjs")).handleProjectsList
+			loadHandler: async () => (await import("./list.handler-BLkQKiV1.mjs")).handleProjectsList
 		}), createTypedCommand({
 			name: "clear-cache",
 			description: "Clear the stored projects cache (projects.json)",
 			schema: z.object({}),
 			optionsConfig: {},
-			loadHandler: async () => (await import("./clear-cache.handler-gr5VmEYB.mjs")).handleProjectsClearCache
+			loadHandler: async () => (await import("./clear-cache.handler-CTLQ1PIN.mjs")).handleProjectsClearCache
 		})]
 	});
 }

package/dist/{projects-DfaG_3WP.mjs → projects-fWvIJQ80.mjs}

@@ -2204,7 +2204,7 @@ const bundles = (api) => ({
 			})),
 			purpose
 		} }).json();
-		const { batchUpload } = await import("./upload-wwSPAC5_.mjs").then((n) => n.n);
+		const { batchUpload } = await import("./upload-BbcMkyVl.mjs").then((n) => n.n);
 		return batchUpload(workflows.map((wf) => ({
 			name: wf.workflowName,
 			bundle: wf.bundle,

package/dist/{register.handler-BAx0IC-u.mjs → register.handler-CleQJhtQ.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
-import { N as throwReportedCliExit, b as isNetworkError, h as AUTH_HINT, n as ui, x as toErrorMessage } from "./keystroke.mjs";
-import { i as writeJson } from "./output-CGdYhH0p.mjs";
+import { a as ui, j as throwReportedCliExit, p as AUTH_HINT, v as isNetworkError, y as toErrorMessage } from "./keystroke.mjs";
+import { i as writeJson } from "./output-BWcVRt-T.mjs";
 //#region src/commands/integrations/register.handler.ts
 function exitWithError(ctx, message, opts) {
 	if (ctx.jsonMode) {

package/dist/{requirements.handler-D5dFi7XZ.mjs → requirements.handler-B51sxQSy.mjs}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 
-import { a as getProcessEnv, f as ANSI, n as ui, p as style } from "./keystroke.mjs";
-import { i as writeJson } from "./output-CGdYhH0p.mjs";
-import { a as readManifestsFromOutDir } from "./dist-FQYQ2FLm.mjs";
-import { t as requireWorkflowsDir } from "./resolve-project-CURYMjex.mjs";
-import { t as readCredentialEnvMap } from "./credential-env-map-B2nVJXPn.mjs";
-import { a as loadProjectDotenvFile, c as getTerminalContentWidth, o as manifestGroupKey, s as normalizeManifestScopeToServer, t as buildCredentialWorkflowConsumersByGroup, u as truncateWithEllipsis } from "./list-enrichment-C6u5eI0j.mjs";
-import { t as groupCredentialRequirements } from "./credentials-CiOwDS5y.mjs";
+import { a as ui, c as getProcessEnv, n as style, t as ANSI } from "./keystroke.mjs";
+import { i as writeJson } from "./output-BWcVRt-T.mjs";
+import { a as readManifestsFromOutDir } from "./dist-WFPTDQB3.mjs";
+import { t as requireWorkflowsDir } from "./resolve-project-CNQtOWE4.mjs";
+import { t as readCredentialEnvMap } from "./credential-env-map-BA4LNI7x.mjs";
+import { a as loadProjectDotenvFile, c as getTerminalContentWidth, o as manifestGroupKey, s as normalizeManifestScopeToServer, t as buildCredentialWorkflowConsumersByGroup, u as truncateWithEllipsis } from "./list-enrichment-DYvr3XDb.mjs";
+import { t as groupCredentialRequirements } from "./credentials-DUkVbhvj.mjs";
 //#region src/commands/credentials/requirements/requirements-display.ts
 function dimLabel(label, width = 10) {
 	return style(label.padEnd(width), ANSI.dim);

package/dist/resolve-cli-credentials-DytxgMwn.mjs

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+
+import { n as credentials } from "./dist-CIInPRGh.mjs";
+//#region src/lib/resolve-cli-credentials.ts
+/**
+* Resolves CLI credential inputs using explicit overrides first, then stored
+* credentials. Logger calls (when provided) describe which source won so the
+* user understands the fallback chain.
+*
+* Precedence:
+*   1. `input.apiKey` (e.g. `--api-key` flag)
+*   2. The active org's API key from stored credentials
+*
+* Same precedence for `serverUrl`. Never throws — returns undefined fields
+* when no source is available, leaving the decision to the caller.
+*/
+async function resolveCliCredentials(input = {}) {
+	const cred = input.credentials ?? credentials;
+	let active = null;
+	let urls = null;
+	let readErrorMessage;
+	try {
+		active = await cred.getActiveOrg();
+		urls = await cred.getServerUrls();
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		readErrorMessage = message;
+		input.logger?.warn(`Could not read saved credentials from ${cred.metadataFilePath}: ${message}`);
+	}
+	const apiKey = input.apiKey ?? active?.apiKey;
+	const serverUrl = input.serverUrl ?? urls?.serverUrl;
+	if (!input.apiKey && active?.apiKey) input.logger?.info(`Using saved API key from ${cred.metadataFilePath}`);
+	if (!input.serverUrl && urls?.serverUrl) input.logger?.info(`Using saved API URL from ${cred.metadataFilePath}`);
+	return {
+		apiKey,
+		serverUrl,
+		activeOrg: active ? {
+			organizationId: active.org.organizationId,
+			organizationName: active.org.organizationName,
+			apiKey: active.apiKey
+		} : void 0,
+		metadataFilePath: cred.metadataFilePath,
+		readErrorMessage
+	};
+}
+//#endregion
+export { resolveCliCredentials as t };

package/dist/{resolve-project-CURYMjex.mjs → resolve-project-CNQtOWE4.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
-import { j as ProjectNotFoundError, n as ui } from "./keystroke.mjs";
-import { s as readStoredProjects } from "./dist-BF6r1hfv.mjs";
-import { n as findProjectRoot } from "./project-config-CsBMT4TL.mjs";
+import { a as ui, k as ProjectNotFoundError } from "./keystroke.mjs";
+import { i as projects } from "./dist-CIInPRGh.mjs";
+import { n as findProjectRoot } from "./project-config-DudGRFPO.mjs";
 import path from "node:path";
 //#region src/lib/resolve-project.ts
 /**
@@ -23,10 +23,10 @@ async function requireWorkflowsDir(explicitPath) {
 	const dir = await resolveWorkflowsDir(explicitPath);
 	if (dir) return dir;
 	ui.warn("No keystroke.config.ts found in this directory or any parent directory.");
-	const stored = await readStoredProjects();
-	if (stored?.lastProject) {
-		ui.hint(`Last used project: ${stored.lastProject}`);
-		ui.hint(`  cd ${stored.lastProject}`);
+	const lastProject = await projects.getLast();
+	if (lastProject) {
+		ui.hint(`Last used project: ${lastProject}`);
+		ui.hint(`  cd ${lastProject}`);
 	}
 	ui.hint("Run `keystroke init` to initialize a project, or use --path.");
 	throw new ProjectNotFoundError("No keystroke.config.ts found");

package/dist/{run-polling-BWcLQvm0.mjs → run-polling-CC6y2XXI.mjs}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 
-import { A as InputValidationError, n as ui, x as toErrorMessage } from "./keystroke.mjs";
-import { a as readManifestsFromOutDir } from "./dist-FQYQ2FLm.mjs";
-import { a as validateRequiredFields, n as formatValidationError, t as formatMissingInputError } from "./schema-display-CNqiYBIb.mjs";
-import { n as sleep, t as TERMINAL_STATUSES } from "./run-polling-CwlzB5-9.mjs";
-import * as fs from "node:fs/promises";
+import { O as InputValidationError, a as ui, y as toErrorMessage } from "./keystroke.mjs";
+import { a as readManifestsFromOutDir } from "./dist-WFPTDQB3.mjs";
+import { a as validateRequiredFields, n as formatValidationError, t as formatMissingInputError } from "./schema-display-NVEl_DFY.mjs";
+import { n as sleep, t as TERMINAL_STATUSES } from "./run-polling-DARidqo-.mjs";
 import * as path$1 from "node:path";
+import * as fs from "node:fs/promises";
 import { z } from "zod";
 //#region ../../packages/utils/src/json-schema-validation.ts
 const SCHEMA_CACHE_LIMIT = 256;

package/dist/{run.handler-BiBDLoeH.mjs → run.handler-B31BpZJP.mjs}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 
-import { N as throwReportedCliExit, k as CliExitError, n as ui, x as toErrorMessage } from "./keystroke.mjs";
-import { d as trackProject } from "./dist-BF6r1hfv.mjs";
-import { t as assertWorkflowProjectRoot } from "./project-config-CsBMT4TL.mjs";
-import { i as writeJson } from "./output-CGdYhH0p.mjs";
-import { i as requireClient, t as assertProjectConfigMatchesAuthenticatedOrg } from "./context-B1L8pZsH.mjs";
-import { n as resolveWorkflowsDir } from "./resolve-project-CURYMjex.mjs";
-import { t as lookupCurrentDeploymentWorkflow } from "./current-deployment-workflow-BRUEdPrN.mjs";
-import { i as resolveWorkflowGlobals, o as validateInputOrExit, r as resolveRunInput, s as validateWorkflowGlobalsOrExit, t as pollForCompletion } from "./run-polling-BWcLQvm0.mjs";
+import { D as CliExitError, a as ui, j as throwReportedCliExit, y as toErrorMessage } from "./keystroke.mjs";
+import { i as projects } from "./dist-CIInPRGh.mjs";
+import { t as assertWorkflowProjectRoot } from "./project-config-DudGRFPO.mjs";
+import { i as writeJson } from "./output-BWcVRt-T.mjs";
+import { i as requireClient, t as assertProjectConfigMatchesAuthenticatedOrg } from "./context-Bid-Rqj7.mjs";
+import { n as resolveWorkflowsDir } from "./resolve-project-CNQtOWE4.mjs";
+import { t as lookupCurrentDeploymentWorkflow } from "./current-deployment-workflow-DiwUcKoB.mjs";
+import { i as resolveWorkflowGlobals, o as validateInputOrExit, r as resolveRunInput, s as validateWorkflowGlobalsOrExit, t as pollForCompletion } from "./run-polling-CC6y2XXI.mjs";
 //#region src/commands/workflows/run.handler.ts
 async function handleWorkflowsRun(options, ctx) {
 	const client = requireClient(ctx);
@@ -72,7 +72,7 @@ async function resolveProjectId(options, ctx) {
 	}
 	const projectConfig = await assertWorkflowProjectRoot(workflowsDir);
 	await assertProjectConfigMatchesAuthenticatedOrg(requireClient(ctx), projectConfig);
-	trackProject(workflowsDir);
+	projects.track(workflowsDir);
 	return projectConfig.projectId;
 }
 async function loadCurrentDeploymentWorkflow(client, params) {

package/dist/{runs-Bc3zjk7V.mjs → runs-Bg_qDeQi.mjs}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
-import { N as throwReportedCliExit, f as ANSI, n as ui, p as style, x as toErrorMessage } from "./keystroke.mjs";
-import { i as writeJson, n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-CGdYhH0p.mjs";
-import { t as createTypedCommand } from "./commander-D15UZVjp.mjs";
-import { i as requireClient } from "./context-B1L8pZsH.mjs";
+import { a as ui, j as throwReportedCliExit, n as style, t as ANSI, y as toErrorMessage } from "./keystroke.mjs";
+import { i as writeJson, n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-BWcVRt-T.mjs";
+import { t as createTypedCommand } from "./commander-BE37hxR3.mjs";
+import { i as requireClient } from "./context-Bid-Rqj7.mjs";
 import { z } from "zod";
 //#region src/commands/runs/inspect-display.ts
 function renderRunInspect(input) {

package/dist/{skill-installer-DkRJ6oLi.mjs → skill-installer-BBgN2tzW.mjs}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
-import { k as CliExitError, n as ui } from "./keystroke.mjs";
+import { D as CliExitError, a as ui } from "./keystroke.mjs";
 import { createRequire } from "node:module";
-import { access, cp, mkdir, readFile, readdir, rm, symlink, writeFile } from "node:fs/promises";
 import path from "node:path";
+import { access, cp, mkdir, readFile, readdir, rm, symlink, writeFile } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 import { autocompleteMultiselect, cancel, isCancel, select } from "@clack/prompts";
 //#region src/lib/skill-installer/package.ts

package/dist/{skills-sync.handler-C4ztv1Vu.mjs → skills-sync.handler-DOxudKmV.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
-import { k as CliExitError, n as ui } from "./keystroke.mjs";
-import { i as writeJson, r as isJsonMode } from "./output-CGdYhH0p.mjs";
-import { i as UnknownSkillAgentError, n as resolveSkillInstallChoices, r as installKeystrokeAgentSkills, t as summarizeSkillInstall } from "./skill-installer-DkRJ6oLi.mjs";
+import { D as CliExitError, a as ui } from "./keystroke.mjs";
+import { i as writeJson, r as isJsonMode } from "./output-BWcVRt-T.mjs";
+import { i as UnknownSkillAgentError, n as resolveSkillInstallChoices, r as installKeystrokeAgentSkills, t as summarizeSkillInstall } from "./skill-installer-BBgN2tzW.mjs";
 import path from "node:path";
 //#region src/commands/skills/skills-sync.handler.ts
 async function handleSkillsSync(options, _ctx) {

package/dist/{skills.command-DuL4kLUi.mjs → skills.command-JwKWpGvU.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
-import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-CGdYhH0p.mjs";
-import { t as createTypedCommand } from "./commander-D15UZVjp.mjs";
-import { t as SKILL_INSTALL_METHODS } from "./types-D04ah3uY.mjs";
+import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-BWcVRt-T.mjs";
+import { t as createTypedCommand } from "./commander-BE37hxR3.mjs";
+import { t as SKILL_INSTALL_METHODS } from "./types-BMBuhHhW.mjs";
 import { z } from "zod";
 //#region src/commands/skills/skills.command.ts
 const SkillsCommandOptionsSchema = JsonOptionSchema.extend({
@@ -32,13 +32,13 @@ function createSkillsCommand() {
 		description: "Sync Keystroke agent skills (SKILL.md) from @keystrokehq/skills",
 		schema: SkillsCommandOptionsSchema,
 		optionsConfig: SKILLS_OPTIONS_CONFIG,
-		loadHandler: async () => (await import("./skills.handler-R5KAbioE.mjs")).handleSkillsParent,
+		loadHandler: async () => (await import("./skills.handler-Do9I3dQS.mjs")).handleSkillsParent,
 		subcommands: [createTypedCommand({
 			name: "sync",
 			description: "Install bundled Keystroke skills into selected agent skill directories",
 			schema: SkillsCommandOptionsSchema,
 			optionsConfig: SKILLS_OPTIONS_CONFIG,
-			loadHandler: async () => (await import("./skills-sync.handler-C4ztv1Vu.mjs")).handleSkillsSync
+			loadHandler: async () => (await import("./skills-sync.handler-DOxudKmV.mjs")).handleSkillsSync
 		})]
 	});
 	cmd.enablePositionalOptions();

package/dist/{skills.handler-R5KAbioE.mjs → skills.handler-Do9I3dQS.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { n as ui } from "./keystroke.mjs";
+import { a as ui } from "./keystroke.mjs";
 //#region src/commands/skills/skills.handler.ts
 async function handleSkillsParent(_options, _ctx) {
 	ui.hint("Run `keystroke skills sync --agent claude-code --method symlink` to install bundled Keystroke skills for selected agents.");

package/dist/{source-analysis-BBg2E_6G-BQqm16RR.mjs → source-analysis-BBg2E_6G-Ut7kYHOz.mjs}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 
-import { d as getMetadataRoot } from "./layout-CXkZEsXI.mjs";
-import { t as BASE_IGNORE_PATTERNS } from "./metadata-layout-Bv-B0nHj-CqlcZz_g.mjs";
-import { a as literalString, l as unwrapExpression, n as identifierName, r as isNode } from "./oxc-B3KI3rf_-DdiZWqe2.mjs";
-import { readFile, readdir, rm } from "node:fs/promises";
+import { d as getMetadataRoot } from "./layout-P1v-Gssz.mjs";
+import { t as BASE_IGNORE_PATTERNS } from "./metadata-layout-Bv-B0nHj-B1c5giJ7.mjs";
+import { a as literalString, l as unwrapExpression, n as identifierName, r as isNode } from "./oxc-B3KI3rf_-Cvx4Z-4H.mjs";
 import path from "node:path";
+import { readFile, readdir, rm } from "node:fs/promises";
 //#region ../../packages/workflow-builder/dist/source-analysis-BBg2E_6G.mjs
 async function removeAllMetadataArtifacts(outputDir) {
 	await rm(getMetadataRoot(outputDir), {

package/dist/{spinner-progress-DfkMzwGx.mjs → spinner-progress-Bx-fYItP.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { d as originalConsole, f as ANSI, m as isTTY, p as style, u as logger } from "./keystroke.mjs";
+import { F as originalConsole, P as logger, n as style, r as isTTY, t as ANSI } from "./keystroke.mjs";
 import { writeSync } from "node:fs";
 import { Worker } from "node:worker_threads";
 //#region src/lib/spinner-progress.ts

package/dist/{src-BQdOWkyv.mjs → src-B0tNjKMg.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { a as createKyInstance, i as buildSearchParams, n as auth, r as bundles, s as getClientEnv, t as projects$1 } from "./projects-DfaG_3WP.mjs";
+import { a as createKyInstance, i as buildSearchParams, n as auth, r as bundles, s as getClientEnv, t as projects$1 } from "./projects-fWvIJQ80.mjs";
 //#region ../../packages/workflow-sdk/src/v1/admin.ts
 const admin = (api) => ({
 	orgs: {

package/dist/{status.handler-DxCJRm1n.mjs → status.handler-BsVtDW_V.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { b as isNetworkError, g as REAUTH_HINT, h as AUTH_HINT, n as ui, x as toErrorMessage, y as isAuthError } from "./keystroke.mjs";
+import { _ as isAuthError, a as ui, m as REAUTH_HINT, p as AUTH_HINT, v as isNetworkError, y as toErrorMessage } from "./keystroke.mjs";
 //#region src/commands/auth/status.handler.ts
 async function getValidationStatus(ctx) {
 	if (!ctx.client) return { kind: "not_authenticated" };
@@ -35,7 +35,7 @@ async function getLiveUser(ctx, validation) {
 }
 function getLocalOrganization(ctx) {
 	if (!ctx.organizationId) return;
-	const org = ctx.storedCredentials?.orgs.find((entry) => entry.organizationId === ctx.organizationId);
+	const org = ctx.storedOrgs.find((entry) => entry.organizationId === ctx.organizationId);
 	if (!org) return { id: ctx.organizationId };
 	return {
 		id: org.organizationId,
@@ -82,11 +82,25 @@ function printValidationStatus(validation) {
 			return;
 	}
 }
+function printCredentialStorage(ctx) {
+	const info = ctx.credentialStorageInfo;
+	if (info.secretStorageKind === "keychain") {
+		ui.hint("Credential storage: OS credential store");
+		if (ctx.credentialReadError) {
+			ui.warn("Saved credential metadata exists, but the OS credential store is unavailable.");
+			ui.hint("Unlock your keychain or rerun `keystroke auth`.");
+			ui.hint(`Credential store error: ${ctx.credentialReadError}`);
+		}
+		return;
+	}
+	ui.warn("Credential storage: plaintext file (insecure)");
+	ui.hint(`Secrets: ${info.legacySecretsFilePath}`);
+}
 async function handleAuthStatus(_options, ctx) {
 	const validation = await getValidationStatus(ctx);
 	const liveUser = await getLiveUser(ctx, validation);
 	const organization = getLiveOrganization(liveUser, ctx.organizationId ?? (validation.kind === "valid" ? validation.organizationId : void 0)) ?? getLocalOrganization(ctx);
-	const userEmail = liveUser?.email ?? ctx.storedCredentials?.user?.email;
+	const userEmail = liveUser?.email ?? ctx.storedUser?.email;
 	ui.header("Keystroke CLI auth status");
 	if (userEmail) ui.text(`Signed in as: ${userEmail}`);
 	else if (validation.kind === "not_authenticated") ui.hint("No saved user identity found.");
@@ -95,7 +109,8 @@ async function handleAuthStatus(_options, ctx) {
 	if (ctx.orgSource) ui.hint(`Source: ${ctx.orgSource}`);
 	printValidationStatus(validation);
 	if (ctx.baseUrl) ui.hint(`API URL: ${ctx.baseUrl}`);
-	ui.hint(`Credentials: ${ctx.credentialsPath}`);
+	printCredentialStorage(ctx);
+	ui.hint(`Credentials: ${ctx.metadataFilePath}`);
 }
 //#endregion
 export { handleAuthStatus };

package/dist/{switch.handler-CTwhIcaQ.mjs → switch.handler-Cu81T2HY.mjs}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 
-import { N as throwReportedCliExit, n as ui } from "./keystroke.mjs";
-import { u as setActiveOrg } from "./dist-BF6r1hfv.mjs";
-import { i as requireClient } from "./context-B1L8pZsH.mjs";
+import { a as ui, j as throwReportedCliExit } from "./keystroke.mjs";
+import { n as credentials } from "./dist-CIInPRGh.mjs";
+import { i as requireClient } from "./context-Bid-Rqj7.mjs";
 import { select } from "@clack/prompts";
 //#region src/commands/org/switch.handler.ts
 async function handleOrgSwitch(_options, ctx) {
 	const { user } = await requireClient(ctx).users.getMe();
 	const orgs = user.organizations ?? [];
-	const storedOrgIds = new Set(ctx.storedCredentials?.orgs.map((o) => o.organizationId) ?? []);
+	const storedOrgIds = new Set(ctx.storedOrgs.map((o) => o.organizationId));
 	if (orgs.length === 0) {
 		ui.warn("You do not belong to any organization.");
 		return;
@@ -44,7 +44,7 @@ async function handleOrgSwitch(_options, ctx) {
 		ui.warn(`No stored API key for ${selectedOrg.name}. Run \`keystroke auth\` and select this org to add credentials.`);
 		return;
 	}
-	await setActiveOrg(selected);
+	await credentials.setActiveOrg(selected);
 	ui.success(`Switched to ${selectedOrg.name}`);
 }
 //#endregion

package/dist/{sync-Pssitj6K.mjs → sync-CXNveL61.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { t as createTypedCommand } from "./commander-D15UZVjp.mjs";
+import { t as createTypedCommand } from "./commander-BE37hxR3.mjs";
 import { z } from "zod";
 //#region src/commands/sync/sync.command.ts
 /**
@@ -32,7 +32,7 @@ function createSyncCommand() {
 		description: "Sync local workflows with Keystroke",
 		schema: SyncOptionsSchema,
 		optionsConfig: SYNC_OPTIONS_CONFIG,
-		loadHandler: async () => (await import("./sync.handler-Be0U3x-n.mjs")).handleSync
+		loadHandler: async () => (await import("./sync.handler-7g1yDt0H.mjs")).handleSync
 	});
 }
 //#endregion

package/dist/{sync.handler-Be0U3x-n.mjs → sync.handler-7g1yDt0H.mjs}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 
-import { N as throwReportedCliExit, n as ui, o as isLocalMode, u as logger, x as toErrorMessage } from "./keystroke.mjs";
-import { d as trackProject } from "./dist-BF6r1hfv.mjs";
-import { a as validateApiKey, i as requireClient } from "./context-B1L8pZsH.mjs";
-import { n as deployFromDir } from "./dist-FQYQ2FLm.mjs";
-import { t as requireWorkflowsDir } from "./resolve-project-CURYMjex.mjs";
-import { a as runWorkflowBuild, n as renderBuildFailure, r as renderBuildHeader } from "./workflow-build-C9rQQ4qU.mjs";
-import { t as createBuildProgress } from "./build-progress-BZivcVz4.mjs";
-import { t as createDeployProgress } from "./deploy-progress-DJHph1Fz.mjs";
+import { P as logger, a as ui, j as throwReportedCliExit, l as isLocalMode, y as toErrorMessage } from "./keystroke.mjs";
+import { i as projects } from "./dist-CIInPRGh.mjs";
+import { a as validateApiKey, i as requireClient } from "./context-Bid-Rqj7.mjs";
+import { n as deployFromDir } from "./dist-WFPTDQB3.mjs";
+import { t as requireWorkflowsDir } from "./resolve-project-CNQtOWE4.mjs";
+import { a as runWorkflowBuild, n as renderBuildFailure, r as renderBuildHeader } from "./workflow-build-_WNsLKwW.mjs";
+import { t as createBuildProgress } from "./build-progress-AR8xow4_.mjs";
+import { t as createDeployProgress } from "./deploy-progress-DK87VKJ-.mjs";
 //#region src/commands/sync/sync.handler.ts
 async function handleSync(options, ctx) {
 	try {
@@ -25,7 +25,7 @@ async function handleSync(options, ctx) {
 }
 async function runSingleSync(options, ctx) {
 	const workflowsDir = await requireWorkflowsDir();
-	trackProject(workflowsDir);
+	projects.track(workflowsDir);
 	const client = requireClient(ctx);
 	await validateApiKey(client);
 	logger.info("Starting sync", {

package/dist/{task-BNXDZU71.mjs → task-BguWXIiH.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 import { n as __exportAll } from "./chunk-CH6r78ws.mjs";
-import { a as descriptionString, c as optionalDescriptionString, d as trimmedNonEmptyStringUnbounded, i as createStructuralSchema, n as credentialSetProxyConfigSchema, o as idNoSpacesString, s as jsonSchemaObject, t as CredentialSetManifestSchema, u as trimmedNonEmptyString } from "./schemas-DodkHgnS.mjs";
-import { t as parseCronExpression } from "./cron-parser-C2eJD0yD.mjs";
+import { a as descriptionString, c as optionalDescriptionString, d as trimmedNonEmptyStringUnbounded, i as createStructuralSchema, n as credentialSetProxyConfigSchema, o as idNoSpacesString, s as jsonSchemaObject, t as CredentialSetManifestSchema, u as trimmedNonEmptyString } from "./schemas-B8c7Z5Iy.mjs";
+import { t as parseCronExpression } from "./cron-parser-Dw_cWzFu.mjs";
 import { z } from "zod";
 const SHA256HashSchema = z.string().length(64, "Must be 64 characters").regex(/^[a-f0-9]{64}$/i, "Must be hexadecimal").transform((value) => value);
 const JsonSchemaSchema = z.record(z.string(), z.unknown());

package/dist/{task-target-build-BG6cC3bz.mjs → task-target-build-BaMtXnN7.mjs}

@@ -1,8 +1,10 @@
 #!/usr/bin/env node
 
-import { t as readCredentialKeysFromSchemaObject } from "./read-credential-keys-77a91T8M-DMmY6oDW.mjs";
-import { mkdir, writeFile } from "node:fs/promises";
+import { r as getKeystrokeProjectPath } from "./paths-JzzFkXQA-CEipIeVl.mjs";
+import "./dist-CIInPRGh.mjs";
+import { t as readCredentialKeysFromSchemaObject } from "./read-credential-keys-77a91T8M-B0eiobOd.mjs";
 import path from "node:path";
+import { mkdir, writeFile } from "node:fs/promises";
 import { pathToFileURL } from "node:url";
 import { createHash, randomUUID } from "node:crypto";
 //#region ../../packages/workflow-builder/dist/builder-options-BT2McCyF.mjs
@@ -109,7 +111,7 @@ async function buildTaskTargetFile(options) {
 	return builtTasks;
 }
 async function bundleTaskTargetModule(options) {
-	const [{ rolldown }, { createEnvAccessPlugin, formatEnvAccessError }] = await Promise.all([import("rolldown"), import("./detect-env-access-CwkOYeYM-CZIixHeR.mjs").then((n) => n.n).then((n) => n.n)]);
+	const [{ rolldown }, { createEnvAccessPlugin, formatEnvAccessError }] = await Promise.all([import("rolldown"), import("./detect-env-access-CwkOYeYM-CNTyUzme.mjs").then((n) => n.n).then((n) => n.n)]);
 	const entryId = "\0virtual:task-target-entry";
 	const trackedDependencies = /* @__PURE__ */ new Set();
 	const envViolations = [];
@@ -216,7 +218,7 @@ async function attachTaskTargetTriggers(options) {
 		options.artifact.triggers.push(...buildTaskTriggerArtifactsWithoutBundles(options.entry.taskMetadata.triggers, options.artifact.task.taskId, options.artifact.task.taskName));
 		return [];
 	}
-	const { buildTriggerArtifacts } = await import("./trigger-artifacts-RizI57RC-CxHwCkQ_.mjs").then((n) => n.n);
+	const { buildTriggerArtifacts } = await import("./trigger-artifacts-RizI57RC-DjhOsdOm.mjs").then((n) => n.n);
 	const triggerResult = await buildTriggerArtifacts(options.entry.taskMetadata.triggers, options.artifact.task.taskId, options.artifact.task.taskName, options.projectRoot, {
 		workflowExportName: options.entry.source.localExportName,
 		workflowFilePath: options.entry.runtimeBundlePath
@@ -319,7 +321,7 @@ function createPreparedTaskTarget(artifact, triggers) {
 	};
 }
 async function tryParseTaskBuildManifest(manifest) {
-	const { TaskBuildManifestSchema } = await import("./task-BNXDZU71.mjs").then((n) => n.t);
+	const { TaskBuildManifestSchema } = await import("./task-BguWXIiH.mjs").then((n) => n.t);
 	const result = TaskBuildManifestSchema.safeParse(manifest);
 	return result.success ? result.data : null;
 }
@@ -330,8 +332,7 @@ function readOptionalJsonSchemaKeysFromSchemaObject(schema) {
 	return properties.filter((key) => !required.has(key));
 }
 function getTaskRuntimeBundlePath(projectRoot, target) {
-	const hash = createHash("sha256").update(target.bindingKey).digest("hex").slice(0, 16);
-	return path.join(projectRoot, ".keystroke", "task-target-build", `${hash}.mjs`);
+	return getKeystrokeProjectPath(projectRoot, "task-target-build", `${createHash("sha256").update(target.bindingKey).digest("hex").slice(0, 16)}.mjs`);
 }
 async function writeRuntimeBundle(bundlePath, code) {
 	await mkdir(path.dirname(bundlePath), { recursive: true });

package/dist/{task-target-deploy-CZBGNC0H-Ck724yF4.mjs → task-target-deploy-CZBGNC0H-I-tvkGCC.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { n as SHA256HashSchema } from "./common-BaGFkj3n.mjs";
+import { n as SHA256HashSchema } from "./common-AK0q0Oz0.mjs";
 import { createHash } from "node:crypto";
 //#region ../../packages/shared-types/src/deployments/api/snapshot-payload.ts
 function sortObjectKeysDeep(value) {

package/dist/{task-target-deploy-gMQC8kXU.mjs → task-target-deploy-DmpCWE3u.mjs}

@@ -1,4 +1,4 @@
 #!/usr/bin/env node
 
-import { n as deployTaskTargets } from "./task-target-deploy-CZBGNC0H-Ck724yF4.mjs";
+import { n as deployTaskTargets } from "./task-target-deploy-CZBGNC0H-I-tvkGCC.mjs";
 export { deployTaskTargets };