@keystrokehq/cli 0.0.19 → 0.0.21

package/dist/{current-deployment-workflow-BVliROAz.mjs → current-deployment-workflow-qMfOrRIu.mjs}

@@ -2,10 +2,10 @@
 
 import { A as WorkflowResolutionError, a as ui, g as getHttpStatus, h as getApiErrorCode } from "./keystroke.mjs";
 import { t as assertWorkflowProjectRoot } from "./project-config-DudGRFPO.mjs";
-import { a as readManifestsFromOutDir } from "./dist-Cx0RV8s7.mjs";
-import { t as requireWorkflowsDir } from "./resolve-project-CNQtOWE4.mjs";
-import { t as createSpinnerProgress } from "./spinner-progress-Bx-fYItP.mjs";
-import { a as runWorkflowBuild, n as renderBuildFailure } from "./workflow-build-C8AiYxqp.mjs";
+import { a as readManifestsFromOutDir } from "./dist-Br4m3sFZ.mjs";
+import { t as requireWorkflowsDir } from "./resolve-project-Cj3MFnU0.mjs";
+import { t as createSpinnerProgress } from "./spinner-progress-BtEIJRX4.mjs";
+import { a as runWorkflowBuild, n as renderBuildFailure } from "./workflow-build-Bi1Aacc5.mjs";
 //#region src/commands/workflows/_shared/current-deployment-workflow.ts
 /**
 * Lightweight resolution: gets projectId from keystroke.config.ts and authoredWorkflowId

package/dist/{current.handler-DBl9S67d.mjs → current.handler-Cm_-JLyZ.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { a as ui } from "./keystroke.mjs";
-import { i as requireClient } from "./context-BydAGTiB.mjs";
+import { i as requireClient } from "./context-B2cQ-Nt3.mjs";
 //#region src/commands/org/current.handler.ts
 async function handleOrgCurrent(_options, ctx) {
 	if (!ctx.organizationId) {

package/dist/{delete.handler-Buu7Ip0D.mjs → delete.handler-DtP_zUaq.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { a as ui, j as throwReportedCliExit, y as toErrorMessage } from "./keystroke.mjs";
-import { i as requireClient } from "./context-BydAGTiB.mjs";
+import { i as requireClient } from "./context-B2cQ-Nt3.mjs";
 //#region src/commands/api-keys/delete.handler.ts
 async function handleApiKeysDelete(options, ctx) {
 	const client = requireClient(ctx);

package/dist/{deploy-BPDUTKZD.mjs → deploy-BURTx92e.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { a as createKyInstance, n as auth, r as bundles, s as getClientEnv, t as projects } from "./projects-BndElPAx.mjs";
+import { a as createKyInstance, n as auth, r as bundles, s as getClientEnv, t as projects } from "./projects-ZNcKwds2.mjs";
 //#region ../../packages/workflow-sdk/src/deploy.ts
 function createDeployClient(config = {}) {
 	const env = getClientEnv();

package/dist/{deploy-CzTlgAFj.mjs → deploy-CB6pfCuB.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { t as createTypedCommand } from "./commander-C5qcOo8m.mjs";
+import { t as createTypedCommand } from "./commander-9Kro0Dl3.mjs";
 import { z } from "zod";
 //#region src/commands/deploy/deploy.command.ts
 /**
@@ -64,7 +64,7 @@ function createDeployCommand() {
 		schema: DeployOptionsSchema,
 		optionsConfig: DEPLOY_OPTIONS_CONFIG,
 		contextMode: "auth",
-		loadHandler: async () => (await import("./deploy.handler-CCcJ7y3A.mjs")).handleDeploy
+		loadHandler: async () => (await import("./deploy.handler-Bg0dpSTj.mjs")).handleDeploy
 	});
 	cmd.enablePositionalOptions();
 	cmd.passThroughOptions();

package/dist/{deploy-progress-DK87VKJ-.mjs → deploy-progress-Dlp9aBDW.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { a as ui } from "./keystroke.mjs";
-import { t as createSpinnerProgress } from "./spinner-progress-Bx-fYItP.mjs";
+import { t as createSpinnerProgress } from "./spinner-progress-BtEIJRX4.mjs";
 //#region src/lib/deploy-progress.ts
 function renderItemFailure(event, kind, spinner) {
 	if (event.result === "failure") spinner.fail(`${kind} failed (${event.name})`, void 0, event.error);

package/dist/{deploy.handler-CCcJ7y3A.mjs → deploy.handler-Bg0dpSTj.mjs}

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
 
 import { D as CliExitError, P as logger, a as ui, l as isLocalMode, n as style, t as ANSI } from "./keystroke.mjs";
-import { i as projects } from "./dist-CIInPRGh.mjs";
+import { i as projects } from "./dist-DuJjDZIf.mjs";
 import { t as assertWorkflowProjectRoot } from "./project-config-DudGRFPO.mjs";
-import { r as requireAuthOptions, t as assertProjectConfigMatchesAuthenticatedOrg } from "./context-BydAGTiB.mjs";
-import { i as readAgentManifestsFromOutDir, o as readWorkflowsFromDisk } from "./dist-Cx0RV8s7.mjs";
-import { t as requireWorkflowsDir } from "./resolve-project-CNQtOWE4.mjs";
-import { n as renderBuildFailure, r as renderBuildHeader } from "./workflow-build-C8AiYxqp.mjs";
-import { t as createBuildProgress } from "./build-progress-AR8xow4_.mjs";
-import { t as createDeployProgress } from "./deploy-progress-DK87VKJ-.mjs";
-import { t as withErrorBoundary } from "./error-boundary-B8cmSwJH.mjs";
-import { t as lookupCurrentDeploymentWorkflow } from "./current-deployment-workflow-BVliROAz.mjs";
-import { t as computeWorkflowDiff } from "./diff-utils-B0ED-Igv.mjs";
+import { r as requireAuthOptions, t as assertProjectConfigMatchesAuthenticatedOrg } from "./context-B2cQ-Nt3.mjs";
+import { i as readAgentManifestsFromOutDir, o as readWorkflowsFromDisk } from "./dist-Br4m3sFZ.mjs";
+import { t as requireWorkflowsDir } from "./resolve-project-Cj3MFnU0.mjs";
+import { n as renderBuildFailure, r as renderBuildHeader } from "./workflow-build-Bi1Aacc5.mjs";
+import { t as createBuildProgress } from "./build-progress-nYa14iBP.mjs";
+import { t as createDeployProgress } from "./deploy-progress-Dlp9aBDW.mjs";
+import { t as withErrorBoundary } from "./error-boundary-DVZipk-A.mjs";
+import { t as lookupCurrentDeploymentWorkflow } from "./current-deployment-workflow-qMfOrRIu.mjs";
+import { t as computeWorkflowDiff } from "./diff-utils-CXKNQUXO.mjs";
 import path from "node:path";
 import { access } from "node:fs/promises";
 //#region src/commands/deploy/deploy-diff.ts
@@ -198,7 +198,7 @@ async function handleDeploy(options, ctx) {
 		let outDir;
 		let artifactFilter;
 		try {
-			const { runWorkflowBuild } = await import("./workflow-build-C8AiYxqp.mjs").then((n) => n.o);
+			const { runWorkflowBuild } = await import("./workflow-build-Bi1Aacc5.mjs").then((n) => n.o);
 			const buildOutcome = await runWorkflowBuild({
 				workflowsDir,
 				verbose: options.verbose,
@@ -233,7 +233,7 @@ async function handleDeploy(options, ctx) {
 		const progress = createDeployProgress();
 		let result;
 		try {
-			result = await (deployHandlerDependencies.deployFromDir ?? (await import("./dist-Cx0RV8s7.mjs").then((n) => n.r)).deployFromDir)({
+			result = await (deployHandlerDependencies.deployFromDir ?? (await import("./dist-Br4m3sFZ.mjs").then((n) => n.r)).deployFromDir)({
 				outDir,
 				workflowsDir,
 				client,
@@ -252,15 +252,26 @@ async function handleDeploy(options, ctx) {
 		await new Promise((resolve) => setImmediate(resolve));
 		if (result.success) {
 			renderSuccessSummary(result);
+			emitNewWebhookCredentials(result);
 			return;
 		}
 		renderFailureSummary(result);
 		throw new CliExitError("Deployment failed");
 	}, { json: ctx.jsonMode });
 }
+/**
+* Emit a machine-readable JSON line for each newly issued webhook credential
+* so external tooling (e.g. the e2e setup) can capture the plaintext secret
+* + canonical webhook URL surfaced exactly once by the deploy.
+*/
+function emitNewWebhookCredentials(result) {
+	const creds = result.newWebhookCredentials ?? [];
+	if (creds.length === 0) return;
+	for (const cred of creds) process.stdout.write(`[deploy] new-webhook-credential ${JSON.stringify(cred)}\n`);
+}
 async function handleTaskTargetDeploy(options) {
 	renderBuildHeader(void 0);
-	const buildResult = await (deployHandlerDependencies.buildTaskTargets ?? (await import("./task-target-build-DCV0UDaz.mjs")).buildTaskTargets)({
+	const buildResult = await (deployHandlerDependencies.buildTaskTargets ?? (await import("./task-target-build-CTgl4L42.mjs")).buildTaskTargets)({
 		projectRoot: options.workflowsDir,
 		targetFiles: options.targetFiles,
 		disableSourcemaps: options.options.disableSourcemaps
@@ -278,7 +289,7 @@ async function handleTaskTargetDeploy(options) {
 	const progress = createDeployProgress();
 	let result;
 	try {
-		result = await (deployHandlerDependencies.deployTaskTargets ?? (await import("./task-target-deploy-DmpCWE3u.mjs")).deployTaskTargets)({
+		result = await (deployHandlerDependencies.deployTaskTargets ?? (await import("./task-target-deploy-DeUyfi9H.mjs")).deployTaskTargets)({
 			preparedTasks: buildResult.preparedTasks,
 			client,
 			organizationId: options.projectConfig.organizationId,
@@ -293,6 +304,7 @@ async function handleTaskTargetDeploy(options) {
 	await new Promise((resolve) => setImmediate(resolve));
 	if (result.success) {
 		renderSuccessSummary(result);
+		emitNewWebhookCredentials(result);
 		return;
 	}
 	renderFailureSummary(result);
@@ -300,7 +312,7 @@ async function handleTaskTargetDeploy(options) {
 }
 async function createFullDeployClient(ctx) {
 	const authOptions = requireAuthOptions(ctx);
-	const { createClient } = await import("./src-0XVwHXNp.mjs");
+	const { createClient } = await import("./src-DNhUmpSl.mjs");
 	return createClient({
 		...authOptions,
 		onRequest: (info) => logger.debug(`-> ${info.method} ${info.url}`, {
@@ -315,7 +327,7 @@ async function createFullDeployClient(ctx) {
 }
 async function createTaskDeployClient(ctx) {
 	const authOptions = requireAuthOptions(ctx);
-	return (deployHandlerDependencies.createDeployClient ?? (await import("./deploy-BPDUTKZD.mjs")).createDeployClient)(authOptions);
+	return (deployHandlerDependencies.createDeployClient ?? (await import("./deploy-BURTx92e.mjs")).createDeployClient)(authOptions);
 }
 function renderSuccessSummary(result) {
 	const tasks = result.tasks || [];

package/dist/{detect-env-access-CwkOYeYM-CNTyUzme.mjs → detect-env-access-CwkOYeYM-D4aTZv4R.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { n as __exportAll } from "./chunk-CH6r78ws.mjs";
-import { t as __exportAll$1 } from "./rolldown-runtime-twds-ZHy-8uqgIurC.mjs";
+import { t as __exportAll$1 } from "./rolldown-runtime-twds-ZHy-RuJszab7.mjs";
 import path from "node:path";
 //#region ../../packages/workflow-builder/dist/detect-env-access-CwkOYeYM.mjs
 var detect_env_access_CwkOYeYM_exports = /* @__PURE__ */ __exportAll({

package/dist/{diff.handler-DUVFixeG.mjs → diff.handler-CJPrszL1.mjs}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 
 import { D as CliExitError, a as ui, j as throwReportedCliExit, y as toErrorMessage } from "./keystroke.mjs";
-import { i as projects } from "./dist-CIInPRGh.mjs";
+import { i as projects } from "./dist-DuJjDZIf.mjs";
 import { i as writeJson } from "./output-BWcVRt-T.mjs";
-import { i as requireClient, t as assertProjectConfigMatchesAuthenticatedOrg } from "./context-BydAGTiB.mjs";
-import { n as resolveLocalWorkflowManifest, t as lookupCurrentDeploymentWorkflow } from "./current-deployment-workflow-BVliROAz.mjs";
-import { n as renderDiff, t as computeWorkflowDiff } from "./diff-utils-B0ED-Igv.mjs";
+import { i as requireClient, t as assertProjectConfigMatchesAuthenticatedOrg } from "./context-B2cQ-Nt3.mjs";
+import { n as resolveLocalWorkflowManifest, t as lookupCurrentDeploymentWorkflow } from "./current-deployment-workflow-qMfOrRIu.mjs";
+import { n as renderDiff, t as computeWorkflowDiff } from "./diff-utils-CXKNQUXO.mjs";
 //#region src/commands/workflows/diff/diff.handler.ts
 async function handleWorkflowsDiff(options, ctx) {
 	const resolved = await resolveLocalWorkflowManifest(options.workflow, options.path, { jsonMode: ctx.jsonMode });

package/dist/{dist-Cx0RV8s7.mjs → dist-Br4m3sFZ.mjs}

@@ -3,16 +3,16 @@
 import { n as __exportAll } from "./chunk-CH6r78ws.mjs";
 import { t as assertWorkflowProjectRoot } from "./project-config-DudGRFPO.mjs";
 import { n as SHA256HashSchema } from "./common-AK0q0Oz0.mjs";
-import { c as TriggerUploadDataSchema, d as collectCredentialRequirementEntries } from "./credential-requirements-Ob-7H-0F.mjs";
-import { a as FlowGraphSchema, r as WorkflowBuildManifestSchema } from "./workflow-build-manifest-BKKW9D05.mjs";
-import { t as AgentVersionManifestSchema } from "./agent-manifest-tIsqF2OP.mjs";
-import { n as TaskBuildManifestSchema } from "./task-BRmL2lmw.mjs";
-import { n as FileMetadataSchema } from "./file-metadata-lrX05iRt.mjs";
-import { t as computeProjectSnapshotHash } from "./task-target-deploy-CZBGNC0H-I-tvkGCC.mjs";
-import { a as MANIFEST_FILE_NAME, d as getMetadataRoot, f as getTriggersDir, m as getWorkflowManifestPath, p as getWorkflowArtifactPaths, t as BUILD_DIR_NAME } from "./layout-P1v-Gssz.mjs";
-import { n as resolveProjectBuildOutputDir } from "./utils-BMUWnz1P.mjs";
-import { t as TriggerBuildManifestSchema } from "./trigger-manifest-DxdCjGz_.mjs";
-import { t as batchUpload } from "./upload-BbcMkyVl.mjs";
+import { f as collectCredentialRequirementEntries, u as TriggerUploadDataSchema } from "./credential-requirements-D0mavK8j-CFMf0Xwu.mjs";
+import { a as FlowGraphSchema, r as WorkflowBuildManifestSchema } from "./workflow-build-manifest-1sC52TIG.mjs";
+import { t as AgentVersionManifestSchema } from "./agent-manifest-Pg0aURo7.mjs";
+import { n as TaskBuildManifestSchema } from "./task-BWuIKWh4.mjs";
+import { n as FileMetadataSchema } from "./file-metadata-DQVDjr7M.mjs";
+import { t as computeProjectSnapshotHash } from "./task-target-deploy-dQYnMO8n-d2vdeqXH.mjs";
+import { a as MANIFEST_FILE_NAME, d as getMetadataRoot, f as getTriggersDir, m as getWorkflowManifestPath, p as getWorkflowArtifactPaths, t as BUILD_DIR_NAME } from "./layout-B95Tku8F.mjs";
+import { n as resolveProjectBuildOutputDir } from "./utils-BaxDlCsW.mjs";
+import { t as TriggerBuildManifestSchema } from "./trigger-manifest-C07EM-b2.mjs";
+import { t as batchUpload } from "./upload-CE4H5R1h.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";
 import * as fs from "node:fs/promises";
@@ -274,7 +274,8 @@ function finalizeDeployResult(options) {
 		workflows: options.workflows,
 		agents: options.agents,
 		tasks: options.tasks || [],
-		totalTime: Date.now() - options.startTime
+		totalTime: Date.now() - options.startTime,
+		...options.newWebhookCredentials ? { newWebhookCredentials: options.newWebhookCredentials } : {}
 	};
 	options.onDeployProgressEvent?.({
 		phase: "complete",
@@ -500,7 +501,7 @@ async function registerDeployment(options) {
 			tasks: deploymentTasks
 		});
 	} finally {
-		releasePreparedTaskCallbackBundleCode(preparedTasks);
+		releasePreparedTaskPollBundleCode(preparedTasks);
 	}
 	const deployedWorkflowResults = deployResult.workflows;
 	const deployedAgentResults = deployResult.agents;
@@ -529,14 +530,12 @@ async function registerDeployment(options) {
 	return {
 		workflows: deployedWorkflowResults.map(mapDeployResultStatus),
 		agents: deployedAgentResults.map(mapAgentResultStatus),
-		tasks: deployedTaskResults.map(mapTaskResultStatus)
+		tasks: deployedTaskResults.map(mapTaskResultStatus),
+		...deployResult.newWebhookCredentials ? { newWebhookCredentials: deployResult.newWebhookCredentials } : {}
 	};
 }
-function releasePreparedTaskCallbackBundleCode(preparedTasks) {
-	for (const task of preparedTasks) for (const trigger of task.triggers) {
-		if (trigger.callbackBundle) trigger.callbackBundle.code = "";
-		if (trigger.transformCallbackBundle) trigger.transformCallbackBundle.code = "";
-	}
+function releasePreparedTaskPollBundleCode(preparedTasks) {
+	for (const task of preparedTasks) for (const trigger of task.triggers) if (trigger.pollBundle) trigger.pollBundle.code = "";
 }
 async function syncMetadata(options) {
 	const { client, organizationId, projectId, fileMetadata, onDeployProgressEvent } = options;
@@ -571,7 +570,7 @@ async function hashFile(filePath) {
 }
 /** Top-level build output folder for task bundles; not workflow-shaped (see readTasksFromDisk). */
 const TASKS_OUTPUT_DIR_NAME = "tasks";
-async function readCallbackBundle(baseDir, relativePath) {
+async function readPollBundle(baseDir, relativePath) {
 	const bundlePath = path$1.join(baseDir, relativePath);
 	const code = await fs.readFile(bundlePath, "utf-8");
 	return {
@@ -596,25 +595,23 @@ async function readTriggersFromBuildOutput(buildDir, options) {
 		try {
 			const raw = await fs.readFile(manifestPath, "utf-8");
 			const manifest = TriggerBuildManifestSchema.parse(JSON.parse(raw));
-			const callbackExports = manifest.functions && Object.keys(manifest.functions).length > 0 ? Object.fromEntries(Object.entries(manifest.functions).map(([key, value]) => [key, value.export])) : void 0;
-			const callbackBundlePath = manifest.functions ? Object.values(manifest.functions)[0]?.js : void 0;
-			const transformCallbackExports = manifest.attachmentFunctions && Object.keys(manifest.attachmentFunctions).length > 0 ? Object.fromEntries(Object.entries(manifest.attachmentFunctions).map(([key, value]) => [key, value.export])) : void 0;
-			const transformCallbackBundlePath = manifest.attachmentFunctions ? Object.values(manifest.attachmentFunctions)[0]?.js : void 0;
+			const pollExports = manifest.functions && Object.keys(manifest.functions).length > 0 ? Object.fromEntries(Object.entries(manifest.functions).map(([key, value]) => [key, value.export])) : void 0;
+			const pollBundlePath = manifest.functions ? Object.values(manifest.functions)[0]?.js : void 0;
 			const trigger = TriggerUploadDataSchema.parse({
 				id: manifest.id,
+				authoredTriggerId: manifest.authoredTriggerId,
 				type: manifest.type,
 				...manifest.triggerSource ? { triggerSource: manifest.triggerSource } : {},
+				...manifest.webhookAuthGroupKey ? { webhookAuthGroupKey: manifest.webhookAuthGroupKey } : {},
 				enabled: manifest.enabled,
-				...manifest.path ? { path: manifest.path } : {},
-				...manifest.method ? { method: manifest.method } : {},
 				...manifest.schedule ? { schedule: manifest.schedule } : {},
 				...manifest.timezone ? { timezone: manifest.timezone } : {},
 				...manifest.config ? { config: manifest.config } : {},
 				...manifest.requiredCredentials ? { requiredCredentials: manifest.requiredCredentials } : {},
-				...callbackExports ? { callbackExports } : {},
-				...callbackBundlePath ? { callbackBundle: await readCallbackBundle(triggerDir, callbackBundlePath) } : {},
-				...transformCallbackExports ? { transformCallbackExports } : {},
-				...transformCallbackBundlePath ? { transformCallbackBundle: await readCallbackBundle(triggerDir, transformCallbackBundlePath) } : {}
+				...manifest.filterSchema ? { filterSchema: manifest.filterSchema } : {},
+				...manifest.idempotencyConfig ? { idempotencyConfig: manifest.idempotencyConfig } : {},
+				...pollExports ? { pollExports } : {},
+				...pollBundlePath ? { pollBundle: await readPollBundle(triggerDir, pollBundlePath) } : {}
 			});
 			triggers.push(trigger);
 		} catch (error) {
@@ -693,19 +690,18 @@ async function readTasksFromDisk(outDir, options) {
 			const builtTriggers = await readTriggersFromBuildOutput(path$1.join(taskDir, "build"), options);
 			const triggers = builtTriggers.length > 0 ? builtTriggers : manifestData.triggers.map((trigger, index) => {
 				const runtime = trigger.runtime ?? {};
-				const triggerName = trigger.name ?? `trigger_${index}`;
-				const triggerId = createHash("sha256").update(`${entryName}::${triggerName}`).digest("hex").slice(0, 16);
+				const authoredTriggerId = trigger.id ?? `trigger_${index}`;
+				const triggerId = createHash("sha256").update(`${entryName}::${authoredTriggerId}`).digest("hex").slice(0, 16);
 				const webhookSource = runtime.source && typeof runtime.source === "object" ? runtime.source : null;
 				const sourceType = webhookSource?.type === "app" || webhookSource?.type === "custom" ? webhookSource.type : void 0;
 				return {
 					id: triggerId,
+					authoredTriggerId,
 					type: trigger.triggerType ?? trigger.type,
 					...sourceType ? { triggerSource: sourceType } : {},
 					enabled: trigger.enabled ?? true,
 					...runtime.schedule ? { schedule: runtime.schedule } : {},
 					...runtime.timezone ? { timezone: runtime.timezone } : {},
-					...webhookSource?.path ? { path: webhookSource.path } : {},
-					...webhookSource?.method ? { method: webhookSource.method } : {},
 					...trigger.payload !== void 0 ? { config: { payload: trigger.payload } } : {}
 				};
 			});
@@ -1105,6 +1101,7 @@ async function executeDeploy(options) {
 		workflows: registration.workflows,
 		agents: registration.agents,
 		tasks: registration.tasks,
+		...registration.newWebhookCredentials ? { newWebhookCredentials: registration.newWebhookCredentials } : {},
 		startTime,
 		onDeployProgressEvent
 	});

package/dist/{dist-CIInPRGh.mjs → dist-DuJjDZIf.mjs}

@@ -140,7 +140,30 @@ var KeychainVault = class {
 		return (await this.createEntry(this.service, account)).getPassword();
 	}
 	async set(account, secret) {
-		(await this.createEntry(this.service, account)).setPassword(secret);
+		const entry = await this.createEntry(this.service, account);
+		try {
+			entry.setPassword(secret);
+			return;
+		} catch (error) {
+			try {
+				await this.verifyWritableKeychain(account);
+				entry.deleteCredential();
+				(await this.createEntry(this.service, account)).setPassword(secret);
+			} catch (replacementError) {
+				throw new AggregateError([error, replacementError], "Could not replace the existing keychain credential.");
+			}
+		}
+	}
+	async verifyWritableKeychain(account) {
+		const probeAccount = `${account}:replacement-probe:${process.pid}:${Date.now()}`;
+		const probeEntry = await this.createEntry(this.service, probeAccount);
+		try {
+			probeEntry.setPassword("probe");
+		} finally {
+			try {
+				probeEntry.deleteCredential();
+			} catch {}
+		}
 	}
 	async delete(account) {
 		return (await this.createEntry(this.service, account)).deleteCredential();
@@ -699,11 +722,11 @@ var Credentials = class {
 			secretStorage,
 			orgs: [input.org]
 		};
-		await this.metadata.write(newMeta);
 		await this.secrets.setApiKey({
 			orgId: input.org.organizationId,
 			serverUrl: input.serverUrl
 		}, input.apiKey, secretStorage.kind);
+		await this.metadata.write(newMeta);
 		if (existing) {
 			const previousOrg = existing.orgs.find((org) => org.organizationId === input.org.organizationId);
 			const serverUrlChanged = normalizeCredentialServerUrl(existing.serverUrl) !== normalizeCredentialServerUrl(input.serverUrl);

package/dist/{env.handler-C8kNFz2U.mjs → env.handler-6TrLd3fo.mjs}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 
 import { D as CliExitError, _ as isAuthError, a as ui, j as throwReportedCliExit, m as REAUTH_HINT, n as style, t as ANSI, v as isNetworkError, y as toErrorMessage } from "./keystroke.mjs";
-import { i as projects } from "./dist-CIInPRGh.mjs";
+import { i as projects } from "./dist-DuJjDZIf.mjs";
 import { i as writeJson } from "./output-BWcVRt-T.mjs";
-import { i as requireClient } from "./context-BydAGTiB.mjs";
-import { n as CredentialConnectionIdSchema, r as CredentialScopeSchema, t as ConnectionStatusSchema } from "./schema-BjH_e4Fo.mjs";
-import { a as readManifestsFromOutDir } from "./dist-Cx0RV8s7.mjs";
-import { t as requireWorkflowsDir } from "./resolve-project-CNQtOWE4.mjs";
-import { t as getIntegrationCatalog } from "./integration-catalog-CmvYPvI6.mjs";
-import { t as groupCredentialRequirements } from "./credentials-jRiXEr6P.mjs";
+import { i as requireClient } from "./context-B2cQ-Nt3.mjs";
+import { n as CredentialConnectionIdSchema, r as CredentialScopeSchema, t as ConnectionStatusSchema } from "./schema-DFJiNWyd.mjs";
+import { a as readManifestsFromOutDir } from "./dist-Br4m3sFZ.mjs";
+import { t as requireWorkflowsDir } from "./resolve-project-Cj3MFnU0.mjs";
+import { t as getIntegrationCatalog } from "./integration-catalog-cYlTmOSb.mjs";
+import { t as groupCredentialRequirements } from "./credentials-DQW8xxof.mjs";
 import { z } from "zod";
 import Table from "cli-table3";
 //#region ../../packages/shared-types/src/credentials/api/responses.ts

package/dist/{error-boundary-B8cmSwJH.mjs → error-boundary-DVZipk-A.mjs}

@@ -2,7 +2,7 @@
 
 import { D as CliExitError, P as logger, a as ui, v as isNetworkError, y as toErrorMessage } from "./keystroke.mjs";
 import { r as isJsonMode } from "./output-BWcVRt-T.mjs";
-import { n as renderCredentialSchemaMismatchText, r as writeCredentialSchemaMismatchJson, t as isCredentialSchemaMismatchErrorLike } from "./credential-schema-mismatch-z74ud-YZ.mjs";
+import { n as renderCredentialSchemaMismatchText, r as writeCredentialSchemaMismatchJson, t as isCredentialSchemaMismatchErrorLike } from "./credential-schema-mismatch-kfGeiSB1.mjs";
 //#region src/lib/error-boundary.ts
 async function withErrorBoundary(commandName, fn, options = {}) {
 	const jsonMode = options.json ?? isJsonMode({});

package/dist/{file-metadata-lrX05iRt.mjs → file-metadata-DQVDjr7M.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { a as SourceLocationSchema, r as CapturedVariableSchema } from "./source-analysis-Cs0CTBQk.mjs";
+import { a as SourceLocationSchema, r as CapturedVariableSchema } from "./source-analysis-z2RSZw6X.mjs";
 import { z } from "zod";
 z.enum([
 	"pending",
@@ -47,12 +47,7 @@ z.enum([
 	"PUT",
 	"PATCH"
 ]);
-z.enum([
-	"filter",
-	"idempotencyKey",
-	"verify",
-	"callback"
-]);
+z.enum(["poll"]);
 //#endregion
 //#region ../../packages/shared-types/src/workflows/build-output/file-metadata.ts
 function isNormalizedRelativePath(value) {