@keystrokehq/cli 0.0.17 → 0.0.19

package/dist/paths-JzzFkXQA-CEipIeVl.mjs

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+
+import * as os from "node:os";
+import * as path$1 from "node:path";
+//#region ../../packages/local-memory/dist/paths-JzzFkXQA.mjs
+/**
+* Single source of truth for the Keystroke local-memory directory name.
+* Every path under ~/.keystroke (and projectRoot/.keystroke) must derive
+* from this constant. This is the only place in the repo where the literal
+* '.keystroke' should appear.
+*/
+const KEYSTROKE_DIR = ".keystroke";
+/**
+* Returns the absolute path to the Keystroke base directory.
+*
+* Defaults to `~/.keystroke` (using `os.homedir()`); tests pass a custom
+* `homeDir` to isolate from the real user home.
+*/
+function getKeystrokeBaseDir(homeDir = os.homedir()) {
+	return path$1.join(homeDir, KEYSTROKE_DIR);
+}
+function validateKeystrokePathSegment(segment) {
+	if (segment.length === 0 || segment.includes("\\") || segment === ".." || segment.split("/").includes("..") || path$1.isAbsolute(segment)) throw new Error(`Invalid .keystroke path segment: ${JSON.stringify(segment)}.`);
+}
+/**
+* Returns an absolute path under a project's local `.keystroke` directory.
+*
+* Use this for project-local state owned by other build/runtime packages while
+* keeping the `.keystroke` directory name centralized in local-memory.
+*/
+function getKeystrokeProjectPath(projectRoot, ...segments) {
+	for (const segment of segments) validateKeystrokePathSegment(segment);
+	return path$1.join(path$1.resolve(projectRoot), KEYSTROKE_DIR, ...segments.flatMap((segment) => segment.split("/")));
+}
+//#endregion
+export { getKeystrokeBaseDir as n, getKeystrokeProjectPath as r, KEYSTROKE_DIR as t };

package/dist/{paused.handler-ST9dCe8E.mjs → paused.handler-DAZ1EaLN.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
-import { N as throwReportedCliExit, n as ui, x as toErrorMessage } from "./keystroke.mjs";
-import { i as writeJson } from "./output-CGdYhH0p.mjs";
-import { i as requireClient } from "./context-B1L8pZsH.mjs";
+import { a as ui, j as throwReportedCliExit, y as toErrorMessage } from "./keystroke.mjs";
+import { i as writeJson } from "./output-BWcVRt-T.mjs";
+import { i as requireClient } from "./context-BydAGTiB.mjs";
 //#region src/commands/workflows/paused/paused.handler.ts
 async function handleWorkflowsPaused(options, ctx) {
 	const client = requireClient(ctx);

package/dist/{projects-DfaG_3WP.mjs → projects-BndElPAx.mjs}

@@ -3,6 +3,8 @@
 import { i as __toESM, r as __require, t as __commonJSMin } from "./chunk-CH6r78ws.mjs";
 import { ZodError, z } from "zod";
 import ky from "ky";
+//#region ../../packages/workflow-sdk/src/env.ts
+const optionalNonEmptyString = z.preprocess((value) => value === "" ? void 0 : value, z.string().min(1).optional());
 z.object({
 	SERVER_URL: z.url(),
 	KEYSTROKE_API_KEY: z.string().min(1)
@@ -10,8 +12,8 @@ z.object({
 /** Lenient env for client - only requires what's needed when not overridden by config */
 const clientEnvSchema = z.object({
 	SERVER_URL: z.url().optional(),
-	KEYSTROKE_API_KEY: z.string().min(1).optional(),
-	KEYSTROKE_ORG_ID: z.string().min(1).optional()
+	KEYSTROKE_API_KEY: optionalNonEmptyString,
+	KEYSTROKE_ORG_ID: optionalNonEmptyString
 });
 function getClientEnv() {
 	return clientEnvSchema.parse(process.env);
@@ -2204,7 +2206,7 @@ const bundles = (api) => ({
 			})),
 			purpose
 		} }).json();
-		const { batchUpload } = await import("./upload-wwSPAC5_.mjs").then((n) => n.n);
+		const { batchUpload } = await import("./upload-BbcMkyVl.mjs").then((n) => n.n);
 		return batchUpload(workflows.map((wf) => ({
 			name: wf.workflowName,
 			bundle: wf.bundle,

package/dist/{projects-CbquwUlm.mjs → projects-Cy6CH3fI.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
-import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-CGdYhH0p.mjs";
-import { t as createTypedCommand } from "./commander-D15UZVjp.mjs";
+import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-BWcVRt-T.mjs";
+import { t as createTypedCommand } from "./commander-C5qcOo8m.mjs";
 import { z } from "zod";
 //#region src/commands/projects/projects.command.ts
 function createProjectsCommand() {
@@ -10,19 +10,19 @@ function createProjectsCommand() {
 		description: "List tracked Keystroke projects",
 		schema: JsonOptionSchema,
 		optionsConfig: { ...JSON_OPTION_CONFIG },
-		loadHandler: async () => (await import("./list.handler-c-8RpgB9.mjs")).handleProjectsList,
+		loadHandler: async () => (await import("./list.handler-BLkQKiV1.mjs")).handleProjectsList,
 		subcommands: [createTypedCommand({
 			name: "list",
 			description: "List all tracked Keystroke projects",
 			schema: JsonOptionSchema,
 			optionsConfig: { ...JSON_OPTION_CONFIG },
-			loadHandler: async () => (await import("./list.handler-c-8RpgB9.mjs")).handleProjectsList
+			loadHandler: async () => (await import("./list.handler-BLkQKiV1.mjs")).handleProjectsList
 		}), createTypedCommand({
 			name: "clear-cache",
 			description: "Clear the stored projects cache (projects.json)",
 			schema: z.object({}),
 			optionsConfig: {},
-			loadHandler: async () => (await import("./clear-cache.handler-gr5VmEYB.mjs")).handleProjectsClearCache
+			loadHandler: async () => (await import("./clear-cache.handler-CTLQ1PIN.mjs")).handleProjectsClearCache
 		})]
 	});
 }

package/dist/{register.handler-BAx0IC-u.mjs → register.handler-BXeh5mdb.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
-import { N as throwReportedCliExit, b as isNetworkError, h as AUTH_HINT, n as ui, x as toErrorMessage } from "./keystroke.mjs";
-import { i as writeJson } from "./output-CGdYhH0p.mjs";
+import { a as ui, j as throwReportedCliExit, p as AUTH_HINT, v as isNetworkError, y as toErrorMessage } from "./keystroke.mjs";
+import { i as writeJson } from "./output-BWcVRt-T.mjs";
 //#region src/commands/integrations/register.handler.ts
 function exitWithError(ctx, message, opts) {
 	if (ctx.jsonMode) {
@@ -19,8 +19,8 @@ function exitWithError(ctx, message, opts) {
 /**
 * Handle `keystroke integrations register <integrationId>`.
 *
-* Upserts a `workspace_provider_apps` row by calling
-* `POST /api/v1/admin/workspace-provider-apps` on the server.
+* Upserts an org-scoped custom `provider_apps` row by calling
+* `POST /api/v1/admin/provider-apps` on the server.
 */
 async function handleIntegrationsRegister(options, ctx) {
 	const integrationId = options.integrationId?.trim();
@@ -37,17 +37,27 @@ async function handleIntegrationsRegister(options, ctx) {
 		code: "USAGE_ERROR",
 		hint: `Example: keystroke integrations register ${integrationId} --client-app acmeClientApp`
 	});
+	if (!options.provider) exitWithError(ctx, "Missing --provider <provider>.", {
+		code: "USAGE_ERROR",
+		hint: `Example: keystroke integrations register ${integrationId} --provider slack --client-app acmeClientApp --external-app-id A123`
+	});
+	if (!options.externalAppId) exitWithError(ctx, "Missing --external-app-id <id>.", {
+		code: "USAGE_ERROR",
+		hint: `Example: keystroke integrations register ${integrationId} --provider slack --client-app acmeClientApp --external-app-id A123`
+	});
 	const displayName = options.displayName ?? integrationId;
-	if (!ctx.jsonMode) ui.text(`Registering workspace provider app "${integrationId}"...`);
+	if (!ctx.jsonMode) ui.text(`Registering provider app "${integrationId}"...`);
 	try {
-		const response = await fetch(`${baseUrl}/api/v1/admin/workspace-provider-apps`, {
+		const response = await fetch(`${baseUrl}/api/v1/admin/provider-apps`, {
 			method: "POST",
 			headers: {
 				Authorization: `Bearer ${apiKey}`,
 				"Content-Type": "application/json"
 			},
 			body: JSON.stringify({
-				credentialSetId: integrationId,
+				appRef: integrationId,
+				provider: options.provider,
+				externalAppId: options.externalAppId,
 				clientAppCredentialSetId: options.clientAppCredentialSetId,
 				displayName
 			})
@@ -63,13 +73,12 @@ async function handleIntegrationsRegister(options, ctx) {
 		if (ctx.jsonMode) {
 			writeJson({
 				status: data.created ? "created" : "updated",
-				workspaceProviderApp: data.workspaceProviderApp
+				providerApp: data.providerApp
 			});
 			return;
 		}
-		if (data.created) ui.success(`Registered workspace provider app for "${integrationId}".`);
-		else ui.success(`Updated workspace provider app for "${integrationId}".`);
-		ui.hint("Workspace-authored OAuth connect flows are not available yet. This registration stores the client app metadata for future support.");
+		if (data.created) ui.success(`Registered provider app for "${integrationId}".`);
+		else ui.success(`Updated provider app for "${integrationId}".`);
 	} catch (error) {
 		if (error instanceof Error && error.name === "CliExitError") throw error;
 		if (isNetworkError(error)) exitWithError(ctx, `Could not reach the Keystroke server to register "${integrationId}".`, {

package/dist/{requirements.handler-D5dFi7XZ.mjs → requirements.handler-C5vobjdJ.mjs}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 
-import { a as getProcessEnv, f as ANSI, n as ui, p as style } from "./keystroke.mjs";
-import { i as writeJson } from "./output-CGdYhH0p.mjs";
-import { a as readManifestsFromOutDir } from "./dist-FQYQ2FLm.mjs";
-import { t as requireWorkflowsDir } from "./resolve-project-CURYMjex.mjs";
-import { t as readCredentialEnvMap } from "./credential-env-map-B2nVJXPn.mjs";
-import { a as loadProjectDotenvFile, c as getTerminalContentWidth, o as manifestGroupKey, s as normalizeManifestScopeToServer, t as buildCredentialWorkflowConsumersByGroup, u as truncateWithEllipsis } from "./list-enrichment-C6u5eI0j.mjs";
-import { t as groupCredentialRequirements } from "./credentials-CiOwDS5y.mjs";
+import { a as ui, c as getProcessEnv, n as style, t as ANSI } from "./keystroke.mjs";
+import { i as writeJson } from "./output-BWcVRt-T.mjs";
+import { a as readManifestsFromOutDir } from "./dist-Cx0RV8s7.mjs";
+import { t as requireWorkflowsDir } from "./resolve-project-CNQtOWE4.mjs";
+import { t as readCredentialEnvMap } from "./credential-env-map-BA4LNI7x.mjs";
+import { a as loadProjectDotenvFile, c as getTerminalContentWidth, o as manifestGroupKey, s as normalizeManifestScopeToServer, t as buildCredentialWorkflowConsumersByGroup, u as truncateWithEllipsis } from "./list-enrichment-B9238wom.mjs";
+import { t as groupCredentialRequirements } from "./credentials-jRiXEr6P.mjs";
 //#region src/commands/credentials/requirements/requirements-display.ts
 function dimLabel(label, width = 10) {
 	return style(label.padEnd(width), ANSI.dim);

package/dist/resolve-cli-credentials-DytxgMwn.mjs

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+
+import { n as credentials } from "./dist-CIInPRGh.mjs";
+//#region src/lib/resolve-cli-credentials.ts
+/**
+* Resolves CLI credential inputs using explicit overrides first, then stored
+* credentials. Logger calls (when provided) describe which source won so the
+* user understands the fallback chain.
+*
+* Precedence:
+*   1. `input.apiKey` (e.g. `--api-key` flag)
+*   2. The active org's API key from stored credentials
+*
+* Same precedence for `serverUrl`. Never throws — returns undefined fields
+* when no source is available, leaving the decision to the caller.
+*/
+async function resolveCliCredentials(input = {}) {
+	const cred = input.credentials ?? credentials;
+	let active = null;
+	let urls = null;
+	let readErrorMessage;
+	try {
+		active = await cred.getActiveOrg();
+		urls = await cred.getServerUrls();
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		readErrorMessage = message;
+		input.logger?.warn(`Could not read saved credentials from ${cred.metadataFilePath}: ${message}`);
+	}
+	const apiKey = input.apiKey ?? active?.apiKey;
+	const serverUrl = input.serverUrl ?? urls?.serverUrl;
+	if (!input.apiKey && active?.apiKey) input.logger?.info(`Using saved API key from ${cred.metadataFilePath}`);
+	if (!input.serverUrl && urls?.serverUrl) input.logger?.info(`Using saved API URL from ${cred.metadataFilePath}`);
+	return {
+		apiKey,
+		serverUrl,
+		activeOrg: active ? {
+			organizationId: active.org.organizationId,
+			organizationName: active.org.organizationName,
+			apiKey: active.apiKey
+		} : void 0,
+		metadataFilePath: cred.metadataFilePath,
+		readErrorMessage
+	};
+}
+//#endregion
+export { resolveCliCredentials as t };

package/dist/{resolve-project-CURYMjex.mjs → resolve-project-CNQtOWE4.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
-import { j as ProjectNotFoundError, n as ui } from "./keystroke.mjs";
-import { s as readStoredProjects } from "./dist-BF6r1hfv.mjs";
-import { n as findProjectRoot } from "./project-config-CsBMT4TL.mjs";
+import { a as ui, k as ProjectNotFoundError } from "./keystroke.mjs";
+import { i as projects } from "./dist-CIInPRGh.mjs";
+import { n as findProjectRoot } from "./project-config-DudGRFPO.mjs";
 import path from "node:path";
 //#region src/lib/resolve-project.ts
 /**
@@ -23,10 +23,10 @@ async function requireWorkflowsDir(explicitPath) {
 	const dir = await resolveWorkflowsDir(explicitPath);
 	if (dir) return dir;
 	ui.warn("No keystroke.config.ts found in this directory or any parent directory.");
-	const stored = await readStoredProjects();
-	if (stored?.lastProject) {
-		ui.hint(`Last used project: ${stored.lastProject}`);
-		ui.hint(`  cd ${stored.lastProject}`);
+	const lastProject = await projects.getLast();
+	if (lastProject) {
+		ui.hint(`Last used project: ${lastProject}`);
+		ui.hint(`  cd ${lastProject}`);
 	}
 	ui.hint("Run `keystroke init` to initialize a project, or use --path.");
 	throw new ProjectNotFoundError("No keystroke.config.ts found");

package/dist/{run-polling-BWcLQvm0.mjs → run-polling-BhOdFyh3.mjs}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 
-import { A as InputValidationError, n as ui, x as toErrorMessage } from "./keystroke.mjs";
-import { a as readManifestsFromOutDir } from "./dist-FQYQ2FLm.mjs";
-import { a as validateRequiredFields, n as formatValidationError, t as formatMissingInputError } from "./schema-display-CNqiYBIb.mjs";
-import { n as sleep, t as TERMINAL_STATUSES } from "./run-polling-CwlzB5-9.mjs";
-import * as fs from "node:fs/promises";
+import { O as InputValidationError, a as ui, y as toErrorMessage } from "./keystroke.mjs";
+import { a as readManifestsFromOutDir } from "./dist-Cx0RV8s7.mjs";
+import { a as validateRequiredFields, n as formatValidationError, t as formatMissingInputError } from "./schema-display-NVEl_DFY.mjs";
+import { n as sleep, t as TERMINAL_STATUSES } from "./run-polling-DARidqo-.mjs";
 import * as path$1 from "node:path";
+import * as fs from "node:fs/promises";
 import { z } from "zod";
 //#region ../../packages/utils/src/json-schema-validation.ts
 const SCHEMA_CACHE_LIMIT = 256;

package/dist/{run.handler-BiBDLoeH.mjs → run.handler-BpLmwF_a.mjs}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 
-import { N as throwReportedCliExit, k as CliExitError, n as ui, x as toErrorMessage } from "./keystroke.mjs";
-import { d as trackProject } from "./dist-BF6r1hfv.mjs";
-import { t as assertWorkflowProjectRoot } from "./project-config-CsBMT4TL.mjs";
-import { i as writeJson } from "./output-CGdYhH0p.mjs";
-import { i as requireClient, t as assertProjectConfigMatchesAuthenticatedOrg } from "./context-B1L8pZsH.mjs";
-import { n as resolveWorkflowsDir } from "./resolve-project-CURYMjex.mjs";
-import { t as lookupCurrentDeploymentWorkflow } from "./current-deployment-workflow-BRUEdPrN.mjs";
-import { i as resolveWorkflowGlobals, o as validateInputOrExit, r as resolveRunInput, s as validateWorkflowGlobalsOrExit, t as pollForCompletion } from "./run-polling-BWcLQvm0.mjs";
+import { D as CliExitError, a as ui, j as throwReportedCliExit, y as toErrorMessage } from "./keystroke.mjs";
+import { i as projects } from "./dist-CIInPRGh.mjs";
+import { t as assertWorkflowProjectRoot } from "./project-config-DudGRFPO.mjs";
+import { i as writeJson } from "./output-BWcVRt-T.mjs";
+import { i as requireClient, t as assertProjectConfigMatchesAuthenticatedOrg } from "./context-BydAGTiB.mjs";
+import { n as resolveWorkflowsDir } from "./resolve-project-CNQtOWE4.mjs";
+import { t as lookupCurrentDeploymentWorkflow } from "./current-deployment-workflow-BVliROAz.mjs";
+import { i as resolveWorkflowGlobals, o as validateInputOrExit, r as resolveRunInput, s as validateWorkflowGlobalsOrExit, t as pollForCompletion } from "./run-polling-BhOdFyh3.mjs";
 //#region src/commands/workflows/run.handler.ts
 async function handleWorkflowsRun(options, ctx) {
 	const client = requireClient(ctx);
@@ -72,7 +72,7 @@ async function resolveProjectId(options, ctx) {
 	}
 	const projectConfig = await assertWorkflowProjectRoot(workflowsDir);
 	await assertProjectConfigMatchesAuthenticatedOrg(requireClient(ctx), projectConfig);
-	trackProject(workflowsDir);
+	projects.track(workflowsDir);
 	return projectConfig.projectId;
 }
 async function loadCurrentDeploymentWorkflow(client, params) {

package/dist/{runs-Bc3zjk7V.mjs → runs-DaSd4eXn.mjs}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
-import { N as throwReportedCliExit, f as ANSI, n as ui, p as style, x as toErrorMessage } from "./keystroke.mjs";
-import { i as writeJson, n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-CGdYhH0p.mjs";
-import { t as createTypedCommand } from "./commander-D15UZVjp.mjs";
-import { i as requireClient } from "./context-B1L8pZsH.mjs";
+import { a as ui, j as throwReportedCliExit, n as style, t as ANSI, y as toErrorMessage } from "./keystroke.mjs";
+import { i as writeJson, n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-BWcVRt-T.mjs";
+import { t as createTypedCommand } from "./commander-C5qcOo8m.mjs";
+import { i as requireClient } from "./context-BydAGTiB.mjs";
 import { z } from "zod";
 //#region src/commands/runs/inspect-display.ts
 function renderRunInspect(input) {

package/dist/{schemas-DodkHgnS.mjs → schemas-BxFPUGWT.mjs}

@@ -46,10 +46,11 @@ function idNoSpacesString(fieldName) {
 }
 /**
 * Non-empty trimmed string for credential definition ids.
-* Only allows letters, numbers, hyphens, and underscores.
+* Allows namespaced ids such as `keystroke:slack` plus letters, numbers,
+* hyphens, and underscores.
 */
 function credentialSetIdString(fieldName) {
-	return z.string().trim().min(1, { error: `${fieldName} cannot be empty` }).max(255, { error: `${fieldName} cannot exceed 255 characters` }).refine((s) => /^[a-zA-Z0-9_-]+$/.test(s), { error: `${fieldName} must only contain letters, numbers, hyphens, and underscores` });
+	return z.string().trim().min(1, { error: `${fieldName} cannot be empty` }).max(255, { error: `${fieldName} cannot exceed 255 characters` }).refine((s) => /^[a-zA-Z0-9_:-]+$/.test(s), { error: `${fieldName} must only contain letters, numbers, hyphens, underscores, and colons` });
 }
 function optionalTrimmedNonEmptyString(fieldName) {
 	return trimmedNonEmptyString(fieldName).optional();

package/dist/{skill-installer-DkRJ6oLi.mjs → skill-installer-BBgN2tzW.mjs}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
-import { k as CliExitError, n as ui } from "./keystroke.mjs";
+import { D as CliExitError, a as ui } from "./keystroke.mjs";
 import { createRequire } from "node:module";
-import { access, cp, mkdir, readFile, readdir, rm, symlink, writeFile } from "node:fs/promises";
 import path from "node:path";
+import { access, cp, mkdir, readFile, readdir, rm, symlink, writeFile } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 import { autocompleteMultiselect, cancel, isCancel, select } from "@clack/prompts";
 //#region src/lib/skill-installer/package.ts

package/dist/{skills-sync.handler-C4ztv1Vu.mjs → skills-sync.handler-DOxudKmV.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
-import { k as CliExitError, n as ui } from "./keystroke.mjs";
-import { i as writeJson, r as isJsonMode } from "./output-CGdYhH0p.mjs";
-import { i as UnknownSkillAgentError, n as resolveSkillInstallChoices, r as installKeystrokeAgentSkills, t as summarizeSkillInstall } from "./skill-installer-DkRJ6oLi.mjs";
+import { D as CliExitError, a as ui } from "./keystroke.mjs";
+import { i as writeJson, r as isJsonMode } from "./output-BWcVRt-T.mjs";
+import { i as UnknownSkillAgentError, n as resolveSkillInstallChoices, r as installKeystrokeAgentSkills, t as summarizeSkillInstall } from "./skill-installer-BBgN2tzW.mjs";
 import path from "node:path";
 //#region src/commands/skills/skills-sync.handler.ts
 async function handleSkillsSync(options, _ctx) {

package/dist/{skills.command-DuL4kLUi.mjs → skills.command-DQc_qGAF.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
-import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-CGdYhH0p.mjs";
-import { t as createTypedCommand } from "./commander-D15UZVjp.mjs";
-import { t as SKILL_INSTALL_METHODS } from "./types-D04ah3uY.mjs";
+import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-BWcVRt-T.mjs";
+import { t as createTypedCommand } from "./commander-C5qcOo8m.mjs";
+import { t as SKILL_INSTALL_METHODS } from "./types-BMBuhHhW.mjs";
 import { z } from "zod";
 //#region src/commands/skills/skills.command.ts
 const SkillsCommandOptionsSchema = JsonOptionSchema.extend({
@@ -32,13 +32,13 @@ function createSkillsCommand() {
 		description: "Sync Keystroke agent skills (SKILL.md) from @keystrokehq/skills",
 		schema: SkillsCommandOptionsSchema,
 		optionsConfig: SKILLS_OPTIONS_CONFIG,
-		loadHandler: async () => (await import("./skills.handler-R5KAbioE.mjs")).handleSkillsParent,
+		loadHandler: async () => (await import("./skills.handler-Do9I3dQS.mjs")).handleSkillsParent,
 		subcommands: [createTypedCommand({
 			name: "sync",
 			description: "Install bundled Keystroke skills into selected agent skill directories",
 			schema: SkillsCommandOptionsSchema,
 			optionsConfig: SKILLS_OPTIONS_CONFIG,
-			loadHandler: async () => (await import("./skills-sync.handler-C4ztv1Vu.mjs")).handleSkillsSync
+			loadHandler: async () => (await import("./skills-sync.handler-DOxudKmV.mjs")).handleSkillsSync
 		})]
 	});
 	cmd.enablePositionalOptions();

package/dist/{skills.handler-R5KAbioE.mjs → skills.handler-Do9I3dQS.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { n as ui } from "./keystroke.mjs";
+import { a as ui } from "./keystroke.mjs";
 //#region src/commands/skills/skills.handler.ts
 async function handleSkillsParent(_options, _ctx) {
 	ui.hint("Run `keystroke skills sync --agent claude-code --method symlink` to install bundled Keystroke skills for selected agents.");

package/dist/{source-analysis-BBg2E_6G-BQqm16RR.mjs → source-analysis-BBg2E_6G-Ut7kYHOz.mjs}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 
-import { d as getMetadataRoot } from "./layout-CXkZEsXI.mjs";
-import { t as BASE_IGNORE_PATTERNS } from "./metadata-layout-Bv-B0nHj-CqlcZz_g.mjs";
-import { a as literalString, l as unwrapExpression, n as identifierName, r as isNode } from "./oxc-B3KI3rf_-DdiZWqe2.mjs";
-import { readFile, readdir, rm } from "node:fs/promises";
+import { d as getMetadataRoot } from "./layout-P1v-Gssz.mjs";
+import { t as BASE_IGNORE_PATTERNS } from "./metadata-layout-Bv-B0nHj-B1c5giJ7.mjs";
+import { a as literalString, l as unwrapExpression, n as identifierName, r as isNode } from "./oxc-B3KI3rf_-Cvx4Z-4H.mjs";
 import path from "node:path";
+import { readFile, readdir, rm } from "node:fs/promises";
 //#region ../../packages/workflow-builder/dist/source-analysis-BBg2E_6G.mjs
 async function removeAllMetadataArtifacts(outputDir) {
 	await rm(getMetadataRoot(outputDir), {

package/dist/{spinner-progress-DfkMzwGx.mjs → spinner-progress-Bx-fYItP.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { d as originalConsole, f as ANSI, m as isTTY, p as style, u as logger } from "./keystroke.mjs";
+import { F as originalConsole, P as logger, n as style, r as isTTY, t as ANSI } from "./keystroke.mjs";
 import { writeSync } from "node:fs";
 import { Worker } from "node:worker_threads";
 //#region src/lib/spinner-progress.ts

package/dist/{src-BQdOWkyv.mjs → src-0XVwHXNp.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { a as createKyInstance, i as buildSearchParams, n as auth, r as bundles, s as getClientEnv, t as projects$1 } from "./projects-DfaG_3WP.mjs";
+import { a as createKyInstance, i as buildSearchParams, n as auth, r as bundles, s as getClientEnv, t as projects$1 } from "./projects-BndElPAx.mjs";
 //#region ../../packages/workflow-sdk/src/v1/admin.ts
 const admin = (api) => ({
 	orgs: {

package/dist/{status.handler-DxCJRm1n.mjs → status.handler-BsVtDW_V.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { b as isNetworkError, g as REAUTH_HINT, h as AUTH_HINT, n as ui, x as toErrorMessage, y as isAuthError } from "./keystroke.mjs";
+import { _ as isAuthError, a as ui, m as REAUTH_HINT, p as AUTH_HINT, v as isNetworkError, y as toErrorMessage } from "./keystroke.mjs";
 //#region src/commands/auth/status.handler.ts
 async function getValidationStatus(ctx) {
 	if (!ctx.client) return { kind: "not_authenticated" };
@@ -35,7 +35,7 @@ async function getLiveUser(ctx, validation) {
 }
 function getLocalOrganization(ctx) {
 	if (!ctx.organizationId) return;
-	const org = ctx.storedCredentials?.orgs.find((entry) => entry.organizationId === ctx.organizationId);
+	const org = ctx.storedOrgs.find((entry) => entry.organizationId === ctx.organizationId);
 	if (!org) return { id: ctx.organizationId };
 	return {
 		id: org.organizationId,
@@ -82,11 +82,25 @@ function printValidationStatus(validation) {
 			return;
 	}
 }
+function printCredentialStorage(ctx) {
+	const info = ctx.credentialStorageInfo;
+	if (info.secretStorageKind === "keychain") {
+		ui.hint("Credential storage: OS credential store");
+		if (ctx.credentialReadError) {
+			ui.warn("Saved credential metadata exists, but the OS credential store is unavailable.");
+			ui.hint("Unlock your keychain or rerun `keystroke auth`.");
+			ui.hint(`Credential store error: ${ctx.credentialReadError}`);
+		}
+		return;
+	}
+	ui.warn("Credential storage: plaintext file (insecure)");
+	ui.hint(`Secrets: ${info.legacySecretsFilePath}`);
+}
 async function handleAuthStatus(_options, ctx) {
 	const validation = await getValidationStatus(ctx);
 	const liveUser = await getLiveUser(ctx, validation);
 	const organization = getLiveOrganization(liveUser, ctx.organizationId ?? (validation.kind === "valid" ? validation.organizationId : void 0)) ?? getLocalOrganization(ctx);
-	const userEmail = liveUser?.email ?? ctx.storedCredentials?.user?.email;
+	const userEmail = liveUser?.email ?? ctx.storedUser?.email;
 	ui.header("Keystroke CLI auth status");
 	if (userEmail) ui.text(`Signed in as: ${userEmail}`);
 	else if (validation.kind === "not_authenticated") ui.hint("No saved user identity found.");
@@ -95,7 +109,8 @@ async function handleAuthStatus(_options, ctx) {
 	if (ctx.orgSource) ui.hint(`Source: ${ctx.orgSource}`);
 	printValidationStatus(validation);
 	if (ctx.baseUrl) ui.hint(`API URL: ${ctx.baseUrl}`);
-	ui.hint(`Credentials: ${ctx.credentialsPath}`);
+	printCredentialStorage(ctx);
+	ui.hint(`Credentials: ${ctx.metadataFilePath}`);
 }
 //#endregion
 export { handleAuthStatus };

package/dist/{switch.handler-CTwhIcaQ.mjs → switch.handler-CCjMrRZN.mjs}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 
-import { N as throwReportedCliExit, n as ui } from "./keystroke.mjs";
-import { u as setActiveOrg } from "./dist-BF6r1hfv.mjs";
-import { i as requireClient } from "./context-B1L8pZsH.mjs";
+import { a as ui, j as throwReportedCliExit } from "./keystroke.mjs";
+import { n as credentials } from "./dist-CIInPRGh.mjs";
+import { i as requireClient } from "./context-BydAGTiB.mjs";
 import { select } from "@clack/prompts";
 //#region src/commands/org/switch.handler.ts
 async function handleOrgSwitch(_options, ctx) {
 	const { user } = await requireClient(ctx).users.getMe();
 	const orgs = user.organizations ?? [];
-	const storedOrgIds = new Set(ctx.storedCredentials?.orgs.map((o) => o.organizationId) ?? []);
+	const storedOrgIds = new Set(ctx.storedOrgs.map((o) => o.organizationId));
 	if (orgs.length === 0) {
 		ui.warn("You do not belong to any organization.");
 		return;
@@ -44,7 +44,7 @@ async function handleOrgSwitch(_options, ctx) {
 		ui.warn(`No stored API key for ${selectedOrg.name}. Run \`keystroke auth\` and select this org to add credentials.`);
 		return;
 	}
-	await setActiveOrg(selected);
+	await credentials.setActiveOrg(selected);
 	ui.success(`Switched to ${selectedOrg.name}`);
 }
 //#endregion

package/dist/{sync-Pssitj6K.mjs → sync-BdTQDZjP.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { t as createTypedCommand } from "./commander-D15UZVjp.mjs";
+import { t as createTypedCommand } from "./commander-C5qcOo8m.mjs";
 import { z } from "zod";
 //#region src/commands/sync/sync.command.ts
 /**
@@ -32,7 +32,7 @@ function createSyncCommand() {
 		description: "Sync local workflows with Keystroke",
 		schema: SyncOptionsSchema,
 		optionsConfig: SYNC_OPTIONS_CONFIG,
-		loadHandler: async () => (await import("./sync.handler-Be0U3x-n.mjs")).handleSync
+		loadHandler: async () => (await import("./sync.handler-DjY8nqbB.mjs")).handleSync
 	});
 }
 //#endregion

package/dist/{sync.handler-Be0U3x-n.mjs → sync.handler-DjY8nqbB.mjs}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 
-import { N as throwReportedCliExit, n as ui, o as isLocalMode, u as logger, x as toErrorMessage } from "./keystroke.mjs";
-import { d as trackProject } from "./dist-BF6r1hfv.mjs";
-import { a as validateApiKey, i as requireClient } from "./context-B1L8pZsH.mjs";
-import { n as deployFromDir } from "./dist-FQYQ2FLm.mjs";
-import { t as requireWorkflowsDir } from "./resolve-project-CURYMjex.mjs";
-import { a as runWorkflowBuild, n as renderBuildFailure, r as renderBuildHeader } from "./workflow-build-C9rQQ4qU.mjs";
-import { t as createBuildProgress } from "./build-progress-BZivcVz4.mjs";
-import { t as createDeployProgress } from "./deploy-progress-DJHph1Fz.mjs";
+import { P as logger, a as ui, j as throwReportedCliExit, l as isLocalMode, y as toErrorMessage } from "./keystroke.mjs";
+import { i as projects } from "./dist-CIInPRGh.mjs";
+import { a as validateApiKey, i as requireClient } from "./context-BydAGTiB.mjs";
+import { n as deployFromDir } from "./dist-Cx0RV8s7.mjs";
+import { t as requireWorkflowsDir } from "./resolve-project-CNQtOWE4.mjs";
+import { a as runWorkflowBuild, n as renderBuildFailure, r as renderBuildHeader } from "./workflow-build-C8AiYxqp.mjs";
+import { t as createBuildProgress } from "./build-progress-AR8xow4_.mjs";
+import { t as createDeployProgress } from "./deploy-progress-DK87VKJ-.mjs";
 //#region src/commands/sync/sync.handler.ts
 async function handleSync(options, ctx) {
 	try {
@@ -25,7 +25,7 @@ async function handleSync(options, ctx) {
 }
 async function runSingleSync(options, ctx) {
 	const workflowsDir = await requireWorkflowsDir();
-	trackProject(workflowsDir);
+	projects.track(workflowsDir);
 	const client = requireClient(ctx);
 	await validateApiKey(client);
 	logger.info("Starting sync", {

package/dist/{task-BNXDZU71.mjs → task-BRmL2lmw.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 import { n as __exportAll } from "./chunk-CH6r78ws.mjs";
-import { a as descriptionString, c as optionalDescriptionString, d as trimmedNonEmptyStringUnbounded, i as createStructuralSchema, n as credentialSetProxyConfigSchema, o as idNoSpacesString, s as jsonSchemaObject, t as CredentialSetManifestSchema, u as trimmedNonEmptyString } from "./schemas-DodkHgnS.mjs";
-import { t as parseCronExpression } from "./cron-parser-C2eJD0yD.mjs";
+import { a as descriptionString, c as optionalDescriptionString, d as trimmedNonEmptyStringUnbounded, i as createStructuralSchema, n as credentialSetProxyConfigSchema, o as idNoSpacesString, s as jsonSchemaObject, t as CredentialSetManifestSchema, u as trimmedNonEmptyString } from "./schemas-BxFPUGWT.mjs";
+import { t as parseCronExpression } from "./cron-parser-Dw_cWzFu.mjs";
 import { z } from "zod";
 const SHA256HashSchema = z.string().length(64, "Must be 64 characters").regex(/^[a-f0-9]{64}$/i, "Must be hexadecimal").transform((value) => value);
 const JsonSchemaSchema = z.record(z.string(), z.unknown());