@keystrokehq/cli 0.0.19 → 0.0.21

package/dist/{accept.handler-BVmNNAgL.mjs → accept.handler-C6KBLKmW.mjs}

@@ -2,7 +2,7 @@
 
 import { a as ui } from "./keystroke.mjs";
 import { i as writeJson } from "./output-BWcVRt-T.mjs";
-import { i as requireClient } from "./context-BydAGTiB.mjs";
+import { i as requireClient } from "./context-B2cQ-Nt3.mjs";
 import { n as isIamJsonMode, t as handleIamError } from "./iam-command-utils-CSZj4XlH.mjs";
 //#region src/commands/invites/accept.handler.ts
 async function handleInvitesAccept(options, ctx) {

package/dist/{admin-DQlHFuXn.mjs → admin-D2CQoZAN.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-BWcVRt-T.mjs";
-import { t as createTypedCommand } from "./commander-C5qcOo8m.mjs";
+import { t as createTypedCommand } from "./commander-9Kro0Dl3.mjs";
 import { t as OrgRoleSchema } from "./schema-Lbp5lGJu.mjs";
 import { z } from "zod";
 //#region src/commands/admin/orgs.command.ts
@@ -28,21 +28,21 @@ function createAdminOrgsCommand() {
 		description: "Manage organizations as a platform admin",
 		schema: AdminOrgsListOptionsSchema,
 		optionsConfig: { ...JSON_OPTION_CONFIG },
-		loadHandler: async () => (await import("./orgs.list.handler-BMgj9yTD.mjs")).handleAdminOrgsList,
+		loadHandler: async () => (await import("./orgs.list.handler-DDVvSbsT.mjs")).handleAdminOrgsList,
 		subcommands: [
 			createTypedCommand({
 				name: "create",
 				description: "Create an organization (requires system.create_org)",
 				schema: AdminOrgsCreateOptionsSchema,
 				optionsConfig: CREATE_OPTIONS_CONFIG,
-				loadHandler: async () => (await import("./orgs.create.handler-RIYhse_Q.mjs")).handleAdminOrgsCreate
+				loadHandler: async () => (await import("./orgs.create.handler-DF4eEL-2.mjs")).handleAdminOrgsCreate
 			}),
 			createTypedCommand({
 				name: "list",
 				description: "List organizations (requires system.view_orgs)",
 				schema: AdminOrgsListOptionsSchema,
 				optionsConfig: { ...JSON_OPTION_CONFIG },
-				loadHandler: async () => (await import("./orgs.list.handler-BMgj9yTD.mjs")).handleAdminOrgsList
+				loadHandler: async () => (await import("./orgs.list.handler-DDVvSbsT.mjs")).handleAdminOrgsList
 			}),
 			createTypedCommand({
 				name: "get",
@@ -54,7 +54,7 @@ function createAdminOrgsCommand() {
 					description: "Organization ID",
 					key: "orgId"
 				},
-				loadHandler: async () => (await import("./orgs.get.handler-BfOpbSom.mjs")).handleAdminOrgsGet
+				loadHandler: async () => (await import("./orgs.get.handler-BmJnseQa.mjs")).handleAdminOrgsGet
 			})
 		]
 	});
@@ -157,14 +157,14 @@ function createAdminUsersCommand() {
 		description: "Manage platform users",
 		schema: AdminUsersListOptionsSchema,
 		optionsConfig: { ...JSON_OPTION_CONFIG },
-		loadHandler: async () => (await import("./users.list.handler-DdGW-DSg.mjs")).handleAdminUsersList,
+		loadHandler: async () => (await import("./users.list.handler-DZSPvpGF.mjs")).handleAdminUsersList,
 		subcommands: [
 			createTypedCommand({
 				name: "list",
 				description: "List platform users",
 				schema: AdminUsersListOptionsSchema,
 				optionsConfig: { ...JSON_OPTION_CONFIG },
-				loadHandler: async () => (await import("./users.list.handler-DdGW-DSg.mjs")).handleAdminUsersList
+				loadHandler: async () => (await import("./users.list.handler-DZSPvpGF.mjs")).handleAdminUsersList
 			}),
 			createTypedCommand({
 				name: "get",
@@ -176,7 +176,7 @@ function createAdminUsersCommand() {
 					description: "User ID",
 					key: "userId"
 				},
-				loadHandler: async () => (await import("./users.get.handler-DIooG7Wy.mjs")).handleAdminUsersGet
+				loadHandler: async () => (await import("./users.get.handler-DqD2ELK2.mjs")).handleAdminUsersGet
 			}),
 			createTypedCommand({
 				name: "set-role",
@@ -188,7 +188,7 @@ function createAdminUsersCommand() {
 					description: "User ID",
 					key: "userId"
 				},
-				loadHandler: async () => (await import("./users.set-role.handler-Ek-kntLp.mjs")).handleAdminUsersSetRole
+				loadHandler: async () => (await import("./users.set-role.handler-73smNUVF.mjs")).handleAdminUsersSetRole
 			})
 		]
 	});

package/dist/{agents-Dd7UeQCw.mjs → agents-Bn0g5o0o.mjs}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 
 import { a as ui, j as throwReportedCliExit, n as style, t as ANSI, y as toErrorMessage } from "./keystroke.mjs";
-import { i as projects } from "./dist-CIInPRGh.mjs";
+import { i as projects } from "./dist-DuJjDZIf.mjs";
 import { i as writeJson, n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-BWcVRt-T.mjs";
-import { t as createTypedCommand } from "./commander-C5qcOo8m.mjs";
-import { i as readAgentManifestsFromOutDir } from "./dist-Cx0RV8s7.mjs";
-import { t as requireWorkflowsDir } from "./resolve-project-CNQtOWE4.mjs";
-import { t as createSpinnerProgress } from "./spinner-progress-Bx-fYItP.mjs";
-import { a as runWorkflowBuild, n as renderBuildFailure } from "./workflow-build-C8AiYxqp.mjs";
-import { i as resolveTypeHint } from "./schema-display-NVEl_DFY.mjs";
+import { t as createTypedCommand } from "./commander-9Kro0Dl3.mjs";
+import { i as readAgentManifestsFromOutDir } from "./dist-Br4m3sFZ.mjs";
+import { t as requireWorkflowsDir } from "./resolve-project-Cj3MFnU0.mjs";
+import { t as createSpinnerProgress } from "./spinner-progress-BtEIJRX4.mjs";
+import { a as runWorkflowBuild, n as renderBuildFailure } from "./workflow-build-Bi1Aacc5.mjs";
+import { i as resolveTypeHint } from "./schema-display-XrRCdFL0.mjs";
 import { z } from "zod";
 //#region src/commands/agents/inspect-display.ts
 function renderAgentManifestInspect(manifest, options = {}) {

package/dist/{api-nR61stdq.mjs → api-J9UL8pqZ.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { n as CredentialConnectionIdSchema, r as CredentialScopeSchema, t as ConnectionStatusSchema } from "./schema-BjH_e4Fo.mjs";
+import { n as CredentialConnectionIdSchema, r as CredentialScopeSchema, t as ConnectionStatusSchema } from "./schema-DFJiNWyd.mjs";
 import { z } from "zod";
 //#region ../../packages/shared-types/src/connections/api.ts
 /**

package/dist/{api-keys-BsMBFiD_.mjs → api-keys-BixCnZJW.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-BWcVRt-T.mjs";
-import { t as createTypedCommand } from "./commander-C5qcOo8m.mjs";
+import { t as createTypedCommand } from "./commander-9Kro0Dl3.mjs";
 import { z } from "zod";
 //#region src/commands/api-keys/api-keys.command.ts
 const ApiKeysCreateOptionsSchema = JsonOptionSchema.extend({ name: z.string().optional() });
@@ -23,21 +23,21 @@ function createApiKeysCommand() {
 		description: "Manage API keys for your organization",
 		schema: JsonOptionSchema,
 		optionsConfig: { ...JSON_OPTION_CONFIG },
-		loadHandler: async () => (await import("./list.handler-BB-Dcm5B.mjs")).handleApiKeysList,
+		loadHandler: async () => (await import("./list.handler-Do2tVOnu.mjs")).handleApiKeysList,
 		subcommands: [
 			createTypedCommand({
 				name: "list",
 				description: "List all API keys for your organization",
 				schema: JsonOptionSchema,
 				optionsConfig: { ...JSON_OPTION_CONFIG },
-				loadHandler: async () => (await import("./list.handler-BB-Dcm5B.mjs")).handleApiKeysList
+				loadHandler: async () => (await import("./list.handler-Do2tVOnu.mjs")).handleApiKeysList
 			}),
 			createTypedCommand({
 				name: "create",
 				description: "Create a new API key (raw key shown once)",
 				schema: ApiKeysCreateOptionsSchema,
 				optionsConfig: CREATE_OPTIONS_CONFIG,
-				loadHandler: async () => (await import("./create.handler-CBxIPC3r.mjs")).handleApiKeysCreate
+				loadHandler: async () => (await import("./create.handler-v9B0Z9Yf.mjs")).handleApiKeysCreate
 			}),
 			createTypedCommand({
 				name: "delete",
@@ -49,7 +49,7 @@ function createApiKeysCommand() {
 					description: "API key ID to delete",
 					key: "apiKeyId"
 				},
-				loadHandler: async () => (await import("./delete.handler-Buu7Ip0D.mjs")).handleApiKeysDelete
+				loadHandler: async () => (await import("./delete.handler-DtP_zUaq.mjs")).handleApiKeysDelete
 			})
 		]
 	});

package/dist/{auth-ZTuuEoD6.mjs → auth-yCNMT8sJ.mjs}

@@ -2,7 +2,7 @@
 
 import { n as DEFAULT_CLI_WEB_URL } from "./default-urls-BoSm4s9C.mjs";
 import { b as AUTH_TIMEOUT_SECONDS } from "./keystroke.mjs";
-import { t as createTypedCommand } from "./commander-C5qcOo8m.mjs";
+import { t as createTypedCommand } from "./commander-9Kro0Dl3.mjs";
 import { z } from "zod";
 //#region src/commands/auth/auth.command.ts
 const AuthOptionsSchema = z.object({
@@ -10,6 +10,7 @@ const AuthOptionsSchema = z.object({
 	insecureStorage: z.boolean().default(false).describe("Store API keys in plaintext file storage instead of the OS credential store"),
 	timeout: z.coerce.number().int().min(AUTH_TIMEOUT_SECONDS.min).max(AUTH_TIMEOUT_SECONDS.max).default(AUTH_TIMEOUT_SECONDS.default).describe("Timeout in seconds")
 });
+const AuthClearOptionsSchema = z.object({ localOnly: z.boolean().default(false).describe("Remove local credentials without reading the OS credential store for server revocation") });
 const AUTH_OPTIONS_CONFIG = {
 	webUrl: {
 		flag: "--web-url <url>",
@@ -24,34 +25,40 @@ const AUTH_OPTIONS_CONFIG = {
 		description: `Authentication timeout in seconds (default: ${AUTH_TIMEOUT_SECONDS.default})`
 	}
 };
+const AUTH_CLEAR_OPTIONS_CONFIG = { localOnly: {
+	flag: "--local-only",
+	description: "Remove local credentials without revoking the API key on the server"
+} };
 function createAuthCommand() {
 	return createTypedCommand({
 		name: "auth",
 		description: "Authenticate Keystroke CLI via device flow",
 		schema: AuthOptionsSchema,
 		optionsConfig: AUTH_OPTIONS_CONFIG,
-		loadHandler: async () => (await import("./auth.handler-C1dZBdaG.mjs")).handleAuth,
+		contextMode: "auth-metadata",
+		loadHandler: async () => (await import("./auth.handler-BedGpKh1.mjs")).handleAuth,
 		subcommands: [
 			createTypedCommand({
 				name: "clear",
 				description: "Revoke the saved API key and remove local credentials",
-				schema: z.object({}),
-				optionsConfig: {},
-				loadHandler: async () => (await import("./clear.handler-BgeAg2de.mjs")).handleAuthClear
+				schema: AuthClearOptionsSchema,
+				optionsConfig: AUTH_CLEAR_OPTIONS_CONFIG,
+				contextMode: "auth-metadata",
+				loadHandler: async () => (await import("./clear.handler-Cvb9chs4.mjs")).handleAuthClear
 			}),
 			createTypedCommand({
 				name: "test",
 				description: "Verify that the saved API key is valid",
 				schema: z.object({}),
 				optionsConfig: {},
-				loadHandler: async () => (await import("./test.handler-CkkplyX6.mjs")).handleAuthTest
+				loadHandler: async () => (await import("./test.handler-CAsVgOpT.mjs")).handleAuthTest
 			}),
 			createTypedCommand({
 				name: "status",
 				description: "Show the current signed-in identity and organization context",
 				schema: z.object({}),
 				optionsConfig: {},
-				loadHandler: async () => (await import("./status.handler-BsVtDW_V.mjs")).handleAuthStatus
+				loadHandler: async () => (await import("./status.handler-CW-EFhy3.mjs")).handleAuthStatus
 			})
 		]
 	});

package/dist/{auth.handler-C1dZBdaG.mjs → auth.handler-BedGpKh1.mjs}

@@ -2,8 +2,8 @@
 
 import { n as DEFAULT_CLI_WEB_URL, t as DEFAULT_CLI_SERVER_URL } from "./default-urls-BoSm4s9C.mjs";
 import { C as CALLBACK_LOOPBACK_ORIGIN, D as CliExitError, P as logger, S as CALLBACK_LOOPBACK_HOST, T as CLI_AUTH_COMMAND, a as ui, d as resolveCliWebUrl, u as resolveCliServerUrl, w as CALLBACK_PATH, x as AUTH_URL_PATH, y as toErrorMessage } from "./keystroke.mjs";
-import { n as credentials } from "./dist-CIInPRGh.mjs";
-import { t as openBrowser } from "./browser-BpJ8ut9z.mjs";
+import { n as credentials } from "./dist-DuJjDZIf.mjs";
+import { t as openBrowser } from "./browser-Dvv5OQrt.mjs";
 import { hostname } from "node:os";
 import { z } from "zod";
 import { confirm, isCancel } from "@clack/prompts";
@@ -347,23 +347,18 @@ function exitCredentialStoreSaveFailed(error) {
 		reported: true
 	});
 }
-async function warnIfAlreadyAuthenticated(ctx) {
-	if (!ctx.client) return;
-	try {
-		await ctx.client.public.auth.validate();
-	} catch {
-		return;
-	}
+function warnIfSavedCredentialsExist(ctx) {
+	if (ctx.storedOrgs.length === 0) return;
 	const identity = ctx.storedUser?.email ?? "unknown user";
 	const activeOrg = ctx.storedOrgs.find((o) => o.organizationId === ctx.storedActiveOrgId);
 	ui.br();
-	ui.warn("Already authenticated");
-	ui.hint(`Signed in as ${identity}${activeOrg ? ` (${activeOrg.organizationName})` : ""}`);
+	ui.warn("Saved credentials found");
+	ui.hint(`Saved as ${identity}${activeOrg ? ` (${activeOrg.organizationName})` : ""}`);
 	ui.hint("Continuing will add or replace credentials for the selected organization.");
 	ui.br();
 }
 async function handleAuth(options, ctx, overrides) {
-	await warnIfAlreadyAuthenticated(ctx);
+	warnIfSavedCredentialsExist(ctx);
 	const hosts = resolveAuthHosts(options, ctx);
 	printResolvedHosts(hosts);
 	if (options.insecureStorage) {

package/dist/{build-agents-DseUtzd4-CthuIecx.mjs → build-agents-DseUtzd4-DFh2e5Cn.mjs}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 
-import { n as readOptionalJsonSchemaKeys, t as manifestToDeclaredCredentialRequirement } from "./declared-credential-requirements-D6KT-r-e.mjs";
-import { t as AgentVersionManifestSchema } from "./agent-manifest-tIsqF2OP.mjs";
-import { i as createAgentSandboxPackage, n as AGENT_VM_PI_SKILLS_ROOT, r as AGENT_VM_TOOLS_RUNTIME_RELATIVE_PATH, t as AGENT_VM_HOST_CALL_RELATIVE_PATH } from "./agent-bundle-package-DWV6B_5q-FPT0bJaA.mjs";
-import { t as readCredentialKeysFromSchemaObject } from "./read-credential-keys-77a91T8M-B0eiobOd.mjs";
-import { t as bundleSandboxAgentTarget } from "./workflow-bundler-BzHk73PM-WI31RJjH.mjs";
+import { n as readOptionalJsonSchemaKeys, t as manifestToDeclaredCredentialRequirement } from "./declared-credential-requirements-B6h4WRv4.mjs";
+import { t as AgentVersionManifestSchema } from "./agent-manifest-Pg0aURo7.mjs";
+import { i as createAgentSandboxPackage, n as AGENT_VM_PI_SKILLS_ROOT, r as AGENT_VM_TOOLS_RUNTIME_RELATIVE_PATH, t as AGENT_VM_HOST_CALL_RELATIVE_PATH } from "./agent-bundle-package-DWV6B_5q-B-qzc3zC.mjs";
+import { t as readCredentialKeysFromSchemaObject } from "./read-credential-keys-77a91T8M-aLuQvlIq.mjs";
+import { t as bundleSandboxAgentTarget } from "./workflow-bundler-BzHk73PM-xQwAF08W.mjs";
 import { builtinModules } from "node:module";
 import path from "node:path";
 import { lstat, readFile, readdir, realpath } from "node:fs/promises";

package/dist/{build-metadata-C8Ra_Gi--L3l8w0rh.mjs → build-metadata-BB_L45ZS-BtGGjHIV.mjs}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 
 import { i as __toESM } from "./chunk-CH6r78ws.mjs";
-import { n as FileMetadataSchema, t as FILE_METADATA_SCHEMA_VERSION } from "./file-metadata-lrX05iRt.mjs";
-import { d as getMetadataRoot, l as createMetadataOutputFile, n as BUILD_OUTPUT_DIR_NAME, u as getFileMetadataPath } from "./layout-P1v-Gssz.mjs";
-import { l as require_out, s as sha256String, t as BASE_IGNORE_PATTERNS } from "./metadata-layout-Bv-B0nHj-B1c5giJ7.mjs";
-import { a as literalString, c as readStringProperty, i as literalNumber, l as unwrapExpression, n as identifierName, o as parseSourceFile, r as isNode, s as readPropertyValue, t as getFirstObjectArgument, u as visitNode } from "./oxc-B3KI3rf_-Cvx4Z-4H.mjs";
-import { a as getLocalModuleSpecifier, f as resolveLocalModulePath, l as removeEmptyMetadataDirectories, o as getVariableDeclarators, s as isExportedVariableStatement } from "./source-analysis-BBg2E_6G-Ut7kYHOz.mjs";
-import { n as parseRelativeFilePath, r as toRelativeFilePath, t as normalizeRelativeFilePath } from "./normalize-path-CojS-CgQ-D4wSBHgG.mjs";
+import { n as FileMetadataSchema, t as FILE_METADATA_SCHEMA_VERSION } from "./file-metadata-DQVDjr7M.mjs";
+import { d as getMetadataRoot, l as createMetadataOutputFile, n as BUILD_OUTPUT_DIR_NAME, u as getFileMetadataPath } from "./layout-B95Tku8F.mjs";
+import { l as require_out, s as sha256String, t as BASE_IGNORE_PATTERNS } from "./metadata-layout-Bv-B0nHj-CO8mjjSl.mjs";
+import { a as literalString, c as readStringProperty, i as literalNumber, l as unwrapExpression, n as identifierName, o as parseSourceFile, r as isNode, s as readPropertyValue, t as getFirstObjectArgument, u as visitNode } from "./oxc-B3KI3rf_-B9omBIuN.mjs";
+import { a as getLocalModuleSpecifier, f as resolveLocalModulePath, l as removeEmptyMetadataDirectories, o as getVariableDeclarators, s as isExportedVariableStatement } from "./source-analysis-BBg2E_6G-wPP9mjQx.mjs";
+import { n as parseRelativeFilePath, r as toRelativeFilePath, t as normalizeRelativeFilePath } from "./normalize-path-CojS-CgQ-aOM0agxS.mjs";
 import path from "node:path";
 import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
 import { performance } from "node:perf_hooks";
-//#region ../../packages/workflow-builder/dist/build-metadata-C8Ra_Gi-.mjs
+//#region ../../packages/workflow-builder/dist/build-metadata-BB_L45ZS.mjs
 var import_out = /* @__PURE__ */ __toESM(require_out(), 1);
 const IGNORED_IDENTIFIERS = new Set([
 	"undefined",
@@ -523,7 +523,7 @@ function getRecognizedDefinition(expression, importedCoreSymbols, importedTrigge
 		if (callee && (importedSymbol === "cronTrigger" || importedSymbol === "webhookTrigger" || importedSymbol === "pollingTrigger")) return {
 			exportEntryKind: "trigger",
 			kind: "trigger",
-			name: readStringProperty(getFirstObjectArgument(unwrappedExpression), "name"),
+			name: readStringProperty(getFirstObjectArgument(unwrappedExpression), "id"),
 			triggerType: importedSymbol === "cronTrigger" ? "cron" : importedSymbol === "webhookTrigger" ? "webhook" : "polling",
 			sourceNode: callee
 		};
@@ -532,7 +532,7 @@ function getRecognizedDefinition(expression, importedCoreSymbols, importedTrigge
 			if (importedTriggerCall) return {
 				exportEntryKind: "trigger",
 				kind: "trigger",
-				name: readStringProperty(getFirstObjectArgument(unwrappedExpression), "name"),
+				name: readStringProperty(getFirstObjectArgument(unwrappedExpression), "id"),
 				triggerType: inferImportedTriggerType(importedTriggerCall),
 				sourceNode: callee
 			};

package/dist/{build-progress-AR8xow4_.mjs → build-progress-nYa14iBP.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { P as logger } from "./keystroke.mjs";
-import { n as formatProgressDuration, t as createSpinnerProgress } from "./spinner-progress-Bx-fYItP.mjs";
+import { n as formatProgressDuration, t as createSpinnerProgress } from "./spinner-progress-BtEIJRX4.mjs";
 //#region src/lib/build-progress.ts
 const NEW_STAGE_LABELS = {
 	start: "Starting build",

package/dist/{build-tasks-GVuMLS0h-BaPhhGXO.mjs → build-tasks-C09SdfjC-B0F7BZZG.mjs}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 
-import { n as TaskBuildManifestSchema } from "./task-BRmL2lmw.mjs";
-import { n as bundleWorkflowTarget } from "./workflow-bundler-BzHk73PM-WI31RJjH.mjs";
-import { t as buildTriggerArtifacts } from "./trigger-artifacts-RizI57RC-DjhOsdOm.mjs";
+import { n as TaskBuildManifestSchema } from "./task-BWuIKWh4.mjs";
+import { n as bundleWorkflowTarget } from "./workflow-bundler-BzHk73PM-xQwAF08W.mjs";
+import { t as buildTriggerArtifacts } from "./trigger-artifacts-BcRScRSp-C-JBJ6y8.mjs";
 import { performance } from "node:perf_hooks";
-//#region ../../packages/workflow-builder/dist/build-tasks-GVuMLS0h.mjs
+//#region ../../packages/workflow-builder/dist/build-tasks-C09SdfjC.mjs
 async function buildTaskArtifact(options) {
 	const { discoveredWorkflow, taskMetadata, projectRoot } = options;
 	const totalStartedAt = performance.now();

package/dist/{build-workflows-CV4tBo6S-szwrAGWT.mjs → build-workflows-BZ_m97Pr-DKANy85L.mjs}

@@ -1,19 +1,19 @@
 #!/usr/bin/env node
 
-import { f as deduplicateCredentialRequirementEntries } from "./credential-requirements-Ob-7H-0F.mjs";
-import { r as WorkflowBuildManifestSchema, t as WORKFLOW_MANIFEST_GENERATOR } from "./workflow-build-manifest-BKKW9D05.mjs";
-import { a as MANIFEST_FILE_NAME, i as FLOW_FILE_NAME, r as BUNDLE_FILE_NAME, s as SOURCE_MAP_FILE_NAME, t as BUILD_DIR_NAME } from "./layout-P1v-Gssz.mjs";
-import { t as runWithConcurrency } from "./concurrency-gXn9Rw8x-BTlfau8D.mjs";
-import { n as WorkflowLoaderProtocolError, r as WorkflowMetadataLoadError, s as createLoaderProtocolFailure } from "./import-module--8x5SLum-DjPUZr4i.mjs";
-import { r as toRelativeFilePath } from "./normalize-path-CojS-CgQ-D4wSBHgG.mjs";
-import { n as bundleWorkflowTarget } from "./workflow-bundler-BzHk73PM-WI31RJjH.mjs";
-import { t as buildTriggerArtifacts } from "./trigger-artifacts-RizI57RC-DjhOsdOm.mjs";
+import { p as deduplicateCredentialRequirementEntries } from "./credential-requirements-D0mavK8j-CFMf0Xwu.mjs";
+import { r as WorkflowBuildManifestSchema, t as WORKFLOW_MANIFEST_GENERATOR } from "./workflow-build-manifest-1sC52TIG.mjs";
+import { a as MANIFEST_FILE_NAME, i as FLOW_FILE_NAME, r as BUNDLE_FILE_NAME, s as SOURCE_MAP_FILE_NAME, t as BUILD_DIR_NAME } from "./layout-B95Tku8F.mjs";
+import { t as runWithConcurrency } from "./concurrency-gXn9Rw8x-CnBnF2cg.mjs";
+import { n as WorkflowLoaderProtocolError, r as WorkflowMetadataLoadError, s as createLoaderProtocolFailure } from "./import-module-y0glInUe-DxX0-BRO.mjs";
+import { r as toRelativeFilePath } from "./normalize-path-CojS-CgQ-aOM0agxS.mjs";
+import { n as bundleWorkflowTarget } from "./workflow-bundler-BzHk73PM-xQwAF08W.mjs";
+import { t as buildTriggerArtifacts } from "./trigger-artifacts-BcRScRSp-C-JBJ6y8.mjs";
 import * as path$1 from "node:path";
 import { readFile } from "node:fs/promises";
 import { realpathSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { performance } from "node:perf_hooks";
-//#region ../../packages/workflow-builder/dist/build-workflows-CV4tBo6S.mjs
+//#region ../../packages/workflow-builder/dist/build-workflows-BZ_m97Pr.mjs
 /**
 * Resolves and categorizes all dependencies for a workflow manifest.
 * - Local files: relative paths with SHA256 content hashes

package/dist/{build.handler-DJrEMCBw.mjs → build.handler-CyDc8jiZ.mjs}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 
 import { D as CliExitError } from "./keystroke.mjs";
-import { i as projects } from "./dist-CIInPRGh.mjs";
-import { t as requireWorkflowsDir } from "./resolve-project-CNQtOWE4.mjs";
-import { a as runWorkflowBuild, i as renderBuildSummary, n as renderBuildFailure, r as renderBuildHeader } from "./workflow-build-C8AiYxqp.mjs";
-import { t as createBuildProgress } from "./build-progress-AR8xow4_.mjs";
-import { t as withErrorBoundary } from "./error-boundary-B8cmSwJH.mjs";
+import { i as projects } from "./dist-DuJjDZIf.mjs";
+import { t as requireWorkflowsDir } from "./resolve-project-Cj3MFnU0.mjs";
+import { a as runWorkflowBuild, i as renderBuildSummary, n as renderBuildFailure, r as renderBuildHeader } from "./workflow-build-Bi1Aacc5.mjs";
+import { t as createBuildProgress } from "./build-progress-nYa14iBP.mjs";
+import { t as withErrorBoundary } from "./error-boundary-DVZipk-A.mjs";
 //#region src/commands/workflows/build.handler.ts
 async function handleWorkflowsBuild(options, _ctx) {
 	return withErrorBoundary("Build", async () => {

package/dist/{clear-cache.handler-CTLQ1PIN.mjs → clear-cache.handler-FmJPHdWG.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { a as ui } from "./keystroke.mjs";
-import { i as projects } from "./dist-CIInPRGh.mjs";
+import { i as projects } from "./dist-DuJjDZIf.mjs";
 //#region src/commands/projects/clear-cache.handler.ts
 async function handleProjectsClearCache(_options, _ctx) {
 	if (await projects.clear()) ui.success("Projects cache cleared.");

package/dist/{clear.handler-BgeAg2de.mjs → clear.handler-Cvb9chs4.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 import { P as logger, a as ui, p as AUTH_HINT, y as toErrorMessage } from "./keystroke.mjs";
-import { n as credentials } from "./dist-CIInPRGh.mjs";
-import { createClient } from "./src-0XVwHXNp.mjs";
+import { n as credentials } from "./dist-DuJjDZIf.mjs";
+import { createClient } from "./src-DNhUmpSl.mjs";
 //#region src/commands/auth/clear.handler.ts
 async function tryRevokeKey(apiKey, apiKeyId, baseUrl, organizationId) {
 	try {
@@ -29,7 +29,7 @@ async function readApiKeyForRevocation(organizationId) {
 		return null;
 	}
 }
-async function handleAuthClear(_options, ctx) {
+async function handleAuthClear(options, ctx) {
 	const storedOrgs = ctx.storedOrgs;
 	const serverUrl = ctx.storedServerUrls?.serverUrl;
 	if (storedOrgs.length === 0) {
@@ -40,25 +40,39 @@ async function handleAuthClear(_options, ctx) {
 		return;
 	}
 	if (ctx.organizationId && ctx.orgSource === "flag") {
-		const apiKey = await readApiKeyForRevocation(ctx.organizationId);
+		if (!storedOrgs.find((org) => org.organizationId === ctx.organizationId)) {
+			ui.warn(`No stored credentials for organization ${ctx.organizationId}.`);
+			return;
+		}
+		let apiKey = null;
+		if (!options.localOnly && serverUrl) {
+			ui.hint("Your OS credential store may ask for permission to read the saved API key.");
+			apiKey = await readApiKeyForRevocation(ctx.organizationId);
+		}
 		const removed = await credentials.removeOrg(ctx.organizationId);
 		if (!removed) {
 			ui.warn(`No stored credentials for organization ${ctx.organizationId}.`);
 			return;
 		}
-		if (removed.apiKeyId && serverUrl && apiKey) await tryRevokeKey(apiKey, removed.apiKeyId, serverUrl, removed.organizationId);
+		if (options.localOnly) ui.hint("Skipped server revocation because --local-only was provided.");
+		else if (removed.apiKeyId && serverUrl && apiKey) await tryRevokeKey(apiKey, removed.apiKeyId, serverUrl, removed.organizationId);
 		ui.success(`Credentials removed for ${removed.organizationName}.`);
 		return;
 	}
 	const revokeInputs = [];
-	for (const org of storedOrgs) if (org.apiKeyId && serverUrl) {
-		const apiKey = await readApiKeyForRevocation(org.organizationId);
-		if (apiKey) revokeInputs.push({
-			apiKey,
-			apiKeyId: org.apiKeyId,
-			baseUrl: serverUrl,
-			organizationId: org.organizationId
-		});
+	if (options.localOnly) ui.hint("Skipped server revocation because --local-only was provided.");
+	else {
+		const revocableOrgs = storedOrgs.filter((org) => org.apiKeyId && serverUrl);
+		if (revocableOrgs.length > 0) ui.hint("Your OS credential store may ask for permission to read saved API keys.");
+		for (const org of revocableOrgs) if (org.apiKeyId && serverUrl) {
+			const apiKey = await readApiKeyForRevocation(org.organizationId);
+			if (apiKey) revokeInputs.push({
+				apiKey,
+				apiKeyId: org.apiKeyId,
+				baseUrl: serverUrl,
+				organizationId: org.organizationId
+			});
+		}
 	}
 	await credentials.clear();
 	for (const revokeInput of revokeInputs) await tryRevokeKey(revokeInput.apiKey, revokeInput.apiKeyId, revokeInput.baseUrl, revokeInput.organizationId);

package/dist/{commander-C5qcOo8m.mjs → commander-9Kro0Dl3.mjs}

@@ -78,16 +78,13 @@ function createTypedCommand(params) {
 			const globalOpts = cmd.optsWithGlobals();
 			if (globalOpts.debug) setDebug(true);
 			const contextMode = params.contextMode ?? "full";
-			const contextModule = await import("./context-BydAGTiB.mjs").then((n) => n.n);
-			const base = contextMode === "auth" ? await contextModule.resolveAuthContext({
+			const contextModule = await import("./context-B2cQ-Nt3.mjs").then((n) => n.n);
+			const contextOptions = {
 				apiKey: globalOpts.apiKey,
 				serverUrl: globalOpts.serverUrl,
 				org: globalOpts.org
-			}) : await contextModule.resolveBaseContext({
-				apiKey: globalOpts.apiKey,
-				serverUrl: globalOpts.serverUrl,
-				org: globalOpts.org
-			});
+			};
+			const base = contextMode === "auth" ? await contextModule.resolveAuthContext(contextOptions) : contextMode === "auth-metadata" ? await contextModule.resolveAuthMetadataContext(contextOptions) : await contextModule.resolveBaseContext(contextOptions);
 			captureCliTelemetryResolvedContext(base);
 			base.jsonMode = jsonMode;
 			const typedBase = base;

package/dist/{connect-BtBKoXpi.mjs → connect-DzVxjeYr.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-BWcVRt-T.mjs";
-import { t as createTypedCommand } from "./commander-C5qcOo8m.mjs";
+import { t as createTypedCommand } from "./commander-9Kro0Dl3.mjs";
 import { z } from "zod";
 //#region src/commands/connect/connect.command.ts
 const ConnectOptionsSchema = JsonOptionSchema.extend({
@@ -37,7 +37,7 @@ function createConnectCommand() {
 		description: "Connect an official integration via OAuth (e.g., keystroke connect slack)",
 		schema: ConnectOptionsSchema,
 		optionsConfig: CONNECT_OPTIONS_CONFIG,
-		loadHandler: async () => (await import("./connect.handler-E8CmLRSF.mjs")).handleConnect,
+		loadHandler: async () => (await import("./connect.handler-DFQdxkWZ.mjs")).handleConnect,
 		argument: {
 			name: "integrationId",
 			description: "Integration to connect (e.g., slack, linear)",

package/dist/{connect.handler-E8CmLRSF.mjs → connect.handler-DFQdxkWZ.mjs}

@@ -2,9 +2,9 @@
 
 import { a as ui, j as throwReportedCliExit, p as AUTH_HINT, v as isNetworkError, y as toErrorMessage } from "./keystroke.mjs";
 import { i as writeJson } from "./output-BWcVRt-T.mjs";
-import { t as openBrowser } from "./browser-BpJ8ut9z.mjs";
-import { i as InitiateConnectionResponseSchema, n as ConnectionStatusResponseSchema, r as InitiateConnectionRequestSchema } from "./api-nR61stdq.mjs";
-import { t as getIntegrationCatalog } from "./integration-catalog-CmvYPvI6.mjs";
+import { t as openBrowser } from "./browser-Dvv5OQrt.mjs";
+import { i as InitiateConnectionResponseSchema, n as ConnectionStatusResponseSchema, r as InitiateConnectionRequestSchema } from "./api-J9UL8pqZ.mjs";
+import { t as getIntegrationCatalog } from "./integration-catalog-cYlTmOSb.mjs";
 //#region src/commands/connect/connect.handler.ts
 function formatIntegrationLabel(catalog, integrationId) {
 	return catalog.lookupByPublicId(integrationId)?.name ?? integrationId;

package/dist/{context-BydAGTiB.mjs → context-B2cQ-Nt3.mjs}

@@ -2,8 +2,8 @@
 
 import { n as __exportAll } from "./chunk-CH6r78ws.mjs";
 import { D as CliExitError, E as AuthenticationError, P as logger, _ as isAuthError, a as ui, c as getProcessEnv, m as REAUTH_HINT, p as AUTH_HINT, s as getEnv, y as toErrorMessage } from "./keystroke.mjs";
-import { n as credentials } from "./dist-CIInPRGh.mjs";
-import { t as resolveCliCredentials } from "./resolve-cli-credentials-DytxgMwn.mjs";
+import { n as credentials } from "./dist-DuJjDZIf.mjs";
+import { t as resolveCliCredentials } from "./resolve-cli-credentials-DaMDaamj.mjs";
 import { a as writeJsonError } from "./output-BWcVRt-T.mjs";
 //#region src/lib/context.ts
 var context_exports = /* @__PURE__ */ __exportAll({
@@ -11,6 +11,7 @@ var context_exports = /* @__PURE__ */ __exportAll({
 	requireAuthOptions: () => requireAuthOptions,
 	requireClient: () => requireClient,
 	resolveAuthContext: () => resolveAuthContext,
+	resolveAuthMetadataContext: () => resolveAuthMetadataContext,
 	resolveBaseContext: () => resolveBaseContext,
 	validateApiKey: () => validateApiKey
 });
@@ -37,7 +38,7 @@ async function resolveBaseContext(overrides = {}) {
 	const authContext = await resolveAuthContext(overrides);
 	let client = null;
 	if (authContext.apiKey && authContext.baseUrl) try {
-		const { createClient } = await import("./src-0XVwHXNp.mjs");
+		const { createClient } = await import("./src-DNhUmpSl.mjs");
 		client = createClient({
 			apiKey: authContext.apiKey,
 			baseUrl: authContext.baseUrl,
@@ -112,6 +113,31 @@ async function resolveAuthContext(overrides = {}) {
 		metadataFilePath: auth.metadataFilePath
 	};
 }
+async function resolveAuthMetadataContext(overrides = {}) {
+	const env = getEnv();
+	const processEnv = getProcessEnv();
+	const storedOrgs = await credentials.listOrgs();
+	const storedUser = await credentials.getUser();
+	const storedActiveOrgId = await credentials.getActiveOrgId();
+	const storedServerUrls = await credentials.getServerUrls();
+	const credentialStorageInfo = await resolveCredentialStorageInfo();
+	const orgRaw = overrides.org ?? env.KEYSTROKE_ORG_ID ?? storedActiveOrgId;
+	const orgSource = overrides.org ? "flag" : env.KEYSTROKE_ORG_ID ? "env" : storedActiveOrgId ? "credentials" : void 0;
+	return {
+		apiKey: overrides.apiKey ?? env.KEYSTROKE_API_KEY,
+		baseUrl: overrides.serverUrl ?? processEnv.SERVER_URL ?? storedServerUrls?.serverUrl ?? env.SERVER_URL,
+		jsonMode: false,
+		organizationId: orgRaw,
+		orgSource,
+		storedOrgs,
+		storedUser,
+		storedActiveOrgId,
+		storedServerUrls,
+		credentialStorageInfo,
+		credentialReadError: void 0,
+		metadataFilePath: credentials.metadataFilePath
+	};
+}
 async function resolveCredentialStorageInfo() {
 	try {
 		return await credentials.getStorageInfo();

package/dist/{create.handler-CBxIPC3r.mjs → create.handler-v9B0Z9Yf.mjs}

@@ -2,7 +2,7 @@
 
 import { a as ui, j as throwReportedCliExit, y as toErrorMessage } from "./keystroke.mjs";
 import { i as writeJson } from "./output-BWcVRt-T.mjs";
-import { i as requireClient } from "./context-BydAGTiB.mjs";
+import { i as requireClient } from "./context-B2cQ-Nt3.mjs";
 //#region src/commands/api-keys/create.handler.ts
 async function handleApiKeysCreate(options, ctx) {
 	const client = requireClient(ctx);

package/dist/{credential-env-map-BA4LNI7x.mjs → credential-env-map-Dvp00a4M.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { r as getKeystrokeProjectPath } from "./paths-JzzFkXQA-CEipIeVl.mjs";
-import "./dist-CIInPRGh.mjs";
+import "./dist-DuJjDZIf.mjs";
 import * as fs from "node:fs/promises";
 import { z } from "zod";
 //#region src/lib/credential-env-map.ts