@keystrokehq/cli 0.0.22 → 0.0.23

package/dist/{accept.handler-C6KBLKmW.mjs → accept.handler-tvT9pleH.mjs}

@@ -2,7 +2,7 @@
 
 import { a as ui } from "./keystroke.mjs";
 import { i as writeJson } from "./output-BWcVRt-T.mjs";
-import { i as requireClient } from "./context-B2cQ-Nt3.mjs";
+import { i as requireClient } from "./context-DHOTSgPb.mjs";
 import { n as isIamJsonMode, t as handleIamError } from "./iam-command-utils-CSZj4XlH.mjs";
 //#region src/commands/invites/accept.handler.ts
 async function handleInvitesAccept(options, ctx) {

package/dist/{admin-D2CQoZAN.mjs → admin-DsAQ0WWj.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-BWcVRt-T.mjs";
-import { t as createTypedCommand } from "./commander-9Kro0Dl3.mjs";
+import { t as createTypedCommand } from "./commander-BTMzBiLq.mjs";
 import { t as OrgRoleSchema } from "./schema-Lbp5lGJu.mjs";
 import { z } from "zod";
 //#region src/commands/admin/orgs.command.ts
@@ -28,21 +28,21 @@ function createAdminOrgsCommand() {
 		description: "Manage organizations as a platform admin",
 		schema: AdminOrgsListOptionsSchema,
 		optionsConfig: { ...JSON_OPTION_CONFIG },
-		loadHandler: async () => (await import("./orgs.list.handler-DDVvSbsT.mjs")).handleAdminOrgsList,
+		loadHandler: async () => (await import("./orgs.list.handler-ZRdb-yu5.mjs")).handleAdminOrgsList,
 		subcommands: [
 			createTypedCommand({
 				name: "create",
 				description: "Create an organization (requires system.create_org)",
 				schema: AdminOrgsCreateOptionsSchema,
 				optionsConfig: CREATE_OPTIONS_CONFIG,
-				loadHandler: async () => (await import("./orgs.create.handler-DF4eEL-2.mjs")).handleAdminOrgsCreate
+				loadHandler: async () => (await import("./orgs.create.handler-B_7WjV3s.mjs")).handleAdminOrgsCreate
 			}),
 			createTypedCommand({
 				name: "list",
 				description: "List organizations (requires system.view_orgs)",
 				schema: AdminOrgsListOptionsSchema,
 				optionsConfig: { ...JSON_OPTION_CONFIG },
-				loadHandler: async () => (await import("./orgs.list.handler-DDVvSbsT.mjs")).handleAdminOrgsList
+				loadHandler: async () => (await import("./orgs.list.handler-ZRdb-yu5.mjs")).handleAdminOrgsList
 			}),
 			createTypedCommand({
 				name: "get",
@@ -54,7 +54,7 @@ function createAdminOrgsCommand() {
 					description: "Organization ID",
 					key: "orgId"
 				},
-				loadHandler: async () => (await import("./orgs.get.handler-BmJnseQa.mjs")).handleAdminOrgsGet
+				loadHandler: async () => (await import("./orgs.get.handler-BgjeDmfl.mjs")).handleAdminOrgsGet
 			})
 		]
 	});
@@ -157,14 +157,14 @@ function createAdminUsersCommand() {
 		description: "Manage platform users",
 		schema: AdminUsersListOptionsSchema,
 		optionsConfig: { ...JSON_OPTION_CONFIG },
-		loadHandler: async () => (await import("./users.list.handler-DZSPvpGF.mjs")).handleAdminUsersList,
+		loadHandler: async () => (await import("./users.list.handler-CRk2J8mi.mjs")).handleAdminUsersList,
 		subcommands: [
 			createTypedCommand({
 				name: "list",
 				description: "List platform users",
 				schema: AdminUsersListOptionsSchema,
 				optionsConfig: { ...JSON_OPTION_CONFIG },
-				loadHandler: async () => (await import("./users.list.handler-DZSPvpGF.mjs")).handleAdminUsersList
+				loadHandler: async () => (await import("./users.list.handler-CRk2J8mi.mjs")).handleAdminUsersList
 			}),
 			createTypedCommand({
 				name: "get",
@@ -176,7 +176,7 @@ function createAdminUsersCommand() {
 					description: "User ID",
 					key: "userId"
 				},
-				loadHandler: async () => (await import("./users.get.handler-DqD2ELK2.mjs")).handleAdminUsersGet
+				loadHandler: async () => (await import("./users.get.handler-DoajzImx.mjs")).handleAdminUsersGet
 			}),
 			createTypedCommand({
 				name: "set-role",
@@ -188,7 +188,7 @@ function createAdminUsersCommand() {
 					description: "User ID",
 					key: "userId"
 				},
-				loadHandler: async () => (await import("./users.set-role.handler-73smNUVF.mjs")).handleAdminUsersSetRole
+				loadHandler: async () => (await import("./users.set-role.handler-CHYjbx5M.mjs")).handleAdminUsersSetRole
 			})
 		]
 	});

package/dist/{agents-Bn0g5o0o.mjs → agents-Ccw0IZCx.mjs}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 
 import { a as ui, j as throwReportedCliExit, n as style, t as ANSI, y as toErrorMessage } from "./keystroke.mjs";
-import { i as projects } from "./dist-DuJjDZIf.mjs";
+import { i as projects } from "./dist-D_KgdxW5.mjs";
 import { i as writeJson, n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-BWcVRt-T.mjs";
-import { t as createTypedCommand } from "./commander-9Kro0Dl3.mjs";
+import { t as createTypedCommand } from "./commander-BTMzBiLq.mjs";
 import { i as readAgentManifestsFromOutDir } from "./dist-Br4m3sFZ.mjs";
-import { t as requireWorkflowsDir } from "./resolve-project-Cj3MFnU0.mjs";
+import { t as requireWorkflowsDir } from "./resolve-project-DJJZIOmu.mjs";
 import { t as createSpinnerProgress } from "./spinner-progress-BtEIJRX4.mjs";
-import { a as runWorkflowBuild, n as renderBuildFailure } from "./workflow-build-Bi1Aacc5.mjs";
+import { a as runWorkflowBuild, n as renderBuildFailure } from "./workflow-build-CVG4DSCw.mjs";
 import { i as resolveTypeHint } from "./schema-display-XrRCdFL0.mjs";
 import { z } from "zod";
 //#region src/commands/agents/inspect-display.ts

package/dist/{api-keys-BixCnZJW.mjs → api-keys-tle_m3kk.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-BWcVRt-T.mjs";
-import { t as createTypedCommand } from "./commander-9Kro0Dl3.mjs";
+import { t as createTypedCommand } from "./commander-BTMzBiLq.mjs";
 import { z } from "zod";
 //#region src/commands/api-keys/api-keys.command.ts
 const ApiKeysCreateOptionsSchema = JsonOptionSchema.extend({ name: z.string().optional() });
@@ -23,21 +23,21 @@ function createApiKeysCommand() {
 		description: "Manage API keys for your organization",
 		schema: JsonOptionSchema,
 		optionsConfig: { ...JSON_OPTION_CONFIG },
-		loadHandler: async () => (await import("./list.handler-Do2tVOnu.mjs")).handleApiKeysList,
+		loadHandler: async () => (await import("./list.handler-DrY5bgm1.mjs")).handleApiKeysList,
 		subcommands: [
 			createTypedCommand({
 				name: "list",
 				description: "List all API keys for your organization",
 				schema: JsonOptionSchema,
 				optionsConfig: { ...JSON_OPTION_CONFIG },
-				loadHandler: async () => (await import("./list.handler-Do2tVOnu.mjs")).handleApiKeysList
+				loadHandler: async () => (await import("./list.handler-DrY5bgm1.mjs")).handleApiKeysList
 			}),
 			createTypedCommand({
 				name: "create",
 				description: "Create a new API key (raw key shown once)",
 				schema: ApiKeysCreateOptionsSchema,
 				optionsConfig: CREATE_OPTIONS_CONFIG,
-				loadHandler: async () => (await import("./create.handler-v9B0Z9Yf.mjs")).handleApiKeysCreate
+				loadHandler: async () => (await import("./create.handler-BuxP18uj.mjs")).handleApiKeysCreate
 			}),
 			createTypedCommand({
 				name: "delete",
@@ -49,7 +49,7 @@ function createApiKeysCommand() {
 					description: "API key ID to delete",
 					key: "apiKeyId"
 				},
-				loadHandler: async () => (await import("./delete.handler-DtP_zUaq.mjs")).handleApiKeysDelete
+				loadHandler: async () => (await import("./delete.handler-CpYOMtsv.mjs")).handleApiKeysDelete
 			})
 		]
 	});

package/dist/{auth-yCNMT8sJ.mjs → auth-DLaY5yCZ.mjs}

@@ -2,24 +2,19 @@
 
 import { n as DEFAULT_CLI_WEB_URL } from "./default-urls-BoSm4s9C.mjs";
 import { b as AUTH_TIMEOUT_SECONDS } from "./keystroke.mjs";
-import { t as createTypedCommand } from "./commander-9Kro0Dl3.mjs";
+import { t as createTypedCommand } from "./commander-BTMzBiLq.mjs";
 import { z } from "zod";
 //#region src/commands/auth/auth.command.ts
 const AuthOptionsSchema = z.object({
 	webUrl: z.url().optional().describe("Keystroke web URL"),
-	insecureStorage: z.boolean().default(false).describe("Store API keys in plaintext file storage instead of the OS credential store"),
 	timeout: z.coerce.number().int().min(AUTH_TIMEOUT_SECONDS.min).max(AUTH_TIMEOUT_SECONDS.max).default(AUTH_TIMEOUT_SECONDS.default).describe("Timeout in seconds")
 });
-const AuthClearOptionsSchema = z.object({ localOnly: z.boolean().default(false).describe("Remove local credentials without reading the OS credential store for server revocation") });
+const AuthClearOptionsSchema = z.object({ localOnly: z.boolean().default(false).describe("Remove local credentials without reading the saved API key for server revocation") });
 const AUTH_OPTIONS_CONFIG = {
 	webUrl: {
 		flag: "--web-url <url>",
 		description: `Keystroke web URL (default: saved credentials, WEB_URL env, or ${DEFAULT_CLI_WEB_URL})`
 	},
-	insecureStorage: {
-		flag: "--insecure-storage",
-		description: "Store the API key in plaintext file storage instead of the OS credential store"
-	},
 	timeout: {
 		flag: "--timeout <seconds>",
 		description: `Authentication timeout in seconds (default: ${AUTH_TIMEOUT_SECONDS.default})`
@@ -36,7 +31,7 @@ function createAuthCommand() {
 		schema: AuthOptionsSchema,
 		optionsConfig: AUTH_OPTIONS_CONFIG,
 		contextMode: "auth-metadata",
-		loadHandler: async () => (await import("./auth.handler-BedGpKh1.mjs")).handleAuth,
+		loadHandler: async () => (await import("./auth.handler-Dq2fXO3S.mjs")).handleAuth,
 		subcommands: [
 			createTypedCommand({
 				name: "clear",
@@ -44,21 +39,21 @@ function createAuthCommand() {
 				schema: AuthClearOptionsSchema,
 				optionsConfig: AUTH_CLEAR_OPTIONS_CONFIG,
 				contextMode: "auth-metadata",
-				loadHandler: async () => (await import("./clear.handler-Cvb9chs4.mjs")).handleAuthClear
+				loadHandler: async () => (await import("./clear.handler-FzohTmpU.mjs")).handleAuthClear
 			}),
 			createTypedCommand({
 				name: "test",
 				description: "Verify that the saved API key is valid",
 				schema: z.object({}),
 				optionsConfig: {},
-				loadHandler: async () => (await import("./test.handler-CAsVgOpT.mjs")).handleAuthTest
+				loadHandler: async () => (await import("./test.handler-CLqnDqY6.mjs")).handleAuthTest
 			}),
 			createTypedCommand({
 				name: "status",
 				description: "Show the current signed-in identity and organization context",
 				schema: z.object({}),
 				optionsConfig: {},
-				loadHandler: async () => (await import("./status.handler-CW-EFhy3.mjs")).handleAuthStatus
+				loadHandler: async () => (await import("./status.handler-Ch_DtyBp.mjs")).handleAuthStatus
 			})
 		]
 	});

package/dist/{auth.handler-BedGpKh1.mjs → auth.handler-Dq2fXO3S.mjs}

@@ -2,7 +2,7 @@
 
 import { n as DEFAULT_CLI_WEB_URL, t as DEFAULT_CLI_SERVER_URL } from "./default-urls-BoSm4s9C.mjs";
 import { C as CALLBACK_LOOPBACK_ORIGIN, D as CliExitError, P as logger, S as CALLBACK_LOOPBACK_HOST, T as CLI_AUTH_COMMAND, a as ui, d as resolveCliWebUrl, u as resolveCliServerUrl, w as CALLBACK_PATH, x as AUTH_URL_PATH, y as toErrorMessage } from "./keystroke.mjs";
-import { n as credentials } from "./dist-DuJjDZIf.mjs";
+import { n as credentials } from "./dist-D_KgdxW5.mjs";
 import { t as openBrowser } from "./browser-Dvv5OQrt.mjs";
 import { hostname } from "node:os";
 import { z } from "zod";
@@ -283,7 +283,7 @@ function printResolvedHosts(hosts) {
 async function confirmLoopbackHostsOrExit(hosts) {
 	ui.br();
 	ui.warn("About to authenticate against a local development environment");
-	if (hosts.webMatchesSaved || hosts.serverMatchesSaved) ui.hint(`Saved at: ${credentials.metadataFilePath} (from a previous keystroke auth run)`);
+	if (hosts.webMatchesSaved || hosts.serverMatchesSaved) ui.hint(`Saved at: ${credentials.credentialsFilePath} (from a previous keystroke auth run)`);
 	else ui.hint("Resolved from your environment (WEB_URL / SERVER_URL).");
 	ui.hint(`CLI default is ${DEFAULT_CLI_WEB_URL} / ${DEFAULT_CLI_SERVER_URL}.`);
 	ui.hint("To switch hosts:");
@@ -326,26 +326,7 @@ function printAuthSuccess(params) {
 	ui.success("Authentication successful.");
 	if (params.email) ui.hint(`Connected as: ${params.email}`);
 	if (params.organizationName) ui.hint(`Organization: ${params.organizationName}`);
-	ui.hint(`Credentials metadata saved to ${credentials.metadataFilePath}`);
-	if (params.insecureStorage) {
-		ui.warn(`API key saved to plaintext file storage at ${credentials.secretsFilePath}`);
-		return;
-	}
-	ui.hint("Secret saved to OS credential store.");
-}
-function isCredentialStoreError(message) {
-	const normalized = message.toLowerCase();
-	return normalized.includes("credential store") || normalized.includes("keychain");
-}
-function exitCredentialStoreSaveFailed(error) {
-	const message = toErrorMessage(error);
-	ui.error("Could not save the API key to the OS credential store.");
-	ui.hint("Unlock your keychain or credential store, then rerun `keystroke auth`.");
-	ui.hint("For intentional plaintext file storage, rerun `keystroke auth --insecure-storage`.");
-	throw new CliExitError(message, {
-		cause: error,
-		reported: true
-	});
+	ui.hint(`Credentials saved to ${credentials.credentialsFilePath}`);
 }
 function warnIfSavedCredentialsExist(ctx) {
 	if (ctx.storedOrgs.length === 0) return;
@@ -361,10 +342,6 @@ async function handleAuth(options, ctx, overrides) {
 	warnIfSavedCredentialsExist(ctx);
 	const hosts = resolveAuthHosts(options, ctx);
 	printResolvedHosts(hosts);
-	if (options.insecureStorage) {
-		ui.warn("Using insecure plaintext file storage for this API key.");
-		ui.hint("For CI/headless usage, prefer KEYSTROKE_API_KEY.");
-	}
 	if (shouldConfirmLoopback(hosts)) await confirmLoopbackHostsOrExit(hosts);
 	const { webUrl, serverUrl } = hosts;
 	const timeoutMs = options.timeout * 1e3;
@@ -402,33 +379,25 @@ async function handleAuth(options, ctx, overrides) {
 			email: callbackPayload.userEmail,
 			name: callbackPayload.userName
 		} : void 0;
-		if (callbackPayload.organizationId) try {
-			await credentials.upsertOrg({
-				org: {
-					organizationId: callbackPayload.organizationId,
-					organizationName: callbackPayload.organizationName ?? "Unknown",
-					apiKeyId: callbackPayload.apiKeyId,
-					createdAt: (/* @__PURE__ */ new Date()).toISOString()
-				},
-				apiKey: callbackPayload.apiKey,
-				serverUrl: callbackPayload.serverUrl,
-				webUrl,
-				user,
-				secretStorage: options.insecureStorage ? "file" : "keychain"
-			});
-		} catch (error) {
-			const message = toErrorMessage(error);
-			if (!options.insecureStorage && isCredentialStoreError(message)) exitCredentialStoreSaveFailed(error);
-			throw error;
-		}
+		if (callbackPayload.organizationId) await credentials.upsertOrg({
+			org: {
+				organizationId: callbackPayload.organizationId,
+				organizationName: callbackPayload.organizationName ?? "Unknown",
+				apiKeyId: callbackPayload.apiKeyId,
+				createdAt: (/* @__PURE__ */ new Date()).toISOString()
+			},
+			apiKey: callbackPayload.apiKey,
+			serverUrl: callbackPayload.serverUrl,
+			webUrl,
+			user
+		});
 		logger.info("Auth successful", {
 			email: callbackPayload.userEmail,
 			organizationId: callbackPayload.organizationId
 		});
 		printAuthSuccess({
 			email: callbackPayload.userEmail,
-			organizationName: callbackPayload.organizationName,
-			insecureStorage: options.insecureStorage
+			organizationName: callbackPayload.organizationName
 		});
 	} catch (error) {
 		if (toErrorMessage(error).includes("Timed out waiting for device authentication")) ui.error(`Authentication timed out after ${options.timeout}s. Re-run ${CLI_AUTH_COMMAND} and complete the browser prompt before timeout.`);

package/dist/{build.handler-CyDc8jiZ.mjs → build.handler-ChqSwsT_.mjs}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
 import { D as CliExitError } from "./keystroke.mjs";
-import { i as projects } from "./dist-DuJjDZIf.mjs";
-import { t as requireWorkflowsDir } from "./resolve-project-Cj3MFnU0.mjs";
-import { a as runWorkflowBuild, i as renderBuildSummary, n as renderBuildFailure, r as renderBuildHeader } from "./workflow-build-Bi1Aacc5.mjs";
+import { i as projects } from "./dist-D_KgdxW5.mjs";
+import { t as requireWorkflowsDir } from "./resolve-project-DJJZIOmu.mjs";
+import { a as runWorkflowBuild, i as renderBuildSummary, n as renderBuildFailure, r as renderBuildHeader } from "./workflow-build-CVG4DSCw.mjs";
 import { t as createBuildProgress } from "./build-progress-nYa14iBP.mjs";
 import { t as withErrorBoundary } from "./error-boundary-DVZipk-A.mjs";
 //#region src/commands/workflows/build.handler.ts

package/dist/{clear-cache.handler-FmJPHdWG.mjs → clear-cache.handler-DpP1VlbR.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { a as ui } from "./keystroke.mjs";
-import { i as projects } from "./dist-DuJjDZIf.mjs";
+import { i as projects } from "./dist-D_KgdxW5.mjs";
 //#region src/commands/projects/clear-cache.handler.ts
 async function handleProjectsClearCache(_options, _ctx) {
 	if (await projects.clear()) ui.success("Projects cache cleared.");

package/dist/{clear.handler-Cvb9chs4.mjs → clear.handler-FzohTmpU.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { P as logger, a as ui, p as AUTH_HINT, y as toErrorMessage } from "./keystroke.mjs";
-import { n as credentials } from "./dist-DuJjDZIf.mjs";
+import { n as credentials } from "./dist-D_KgdxW5.mjs";
 import { createClient } from "./src-DNhUmpSl.mjs";
 //#region src/commands/auth/clear.handler.ts
 async function tryRevokeKey(apiKey, apiKeyId, baseUrl, organizationId) {
@@ -45,10 +45,7 @@ async function handleAuthClear(options, ctx) {
 			return;
 		}
 		let apiKey = null;
-		if (!options.localOnly && serverUrl) {
-			ui.hint("Your OS credential store may ask for permission to read the saved API key.");
-			apiKey = await readApiKeyForRevocation(ctx.organizationId);
-		}
+		if (!options.localOnly && serverUrl) apiKey = await readApiKeyForRevocation(ctx.organizationId);
 		const removed = await credentials.removeOrg(ctx.organizationId);
 		if (!removed) {
 			ui.warn(`No stored credentials for organization ${ctx.organizationId}.`);
@@ -63,7 +60,6 @@ async function handleAuthClear(options, ctx) {
 	if (options.localOnly) ui.hint("Skipped server revocation because --local-only was provided.");
 	else {
 		const revocableOrgs = storedOrgs.filter((org) => org.apiKeyId && serverUrl);
-		if (revocableOrgs.length > 0) ui.hint("Your OS credential store may ask for permission to read saved API keys.");
 		for (const org of revocableOrgs) if (org.apiKeyId && serverUrl) {
 			const apiKey = await readApiKeyForRevocation(org.organizationId);
 			if (apiKey) revokeInputs.push({

package/dist/{commander-9Kro0Dl3.mjs → commander-BTMzBiLq.mjs}

@@ -78,7 +78,7 @@ function createTypedCommand(params) {
 			const globalOpts = cmd.optsWithGlobals();
 			if (globalOpts.debug) setDebug(true);
 			const contextMode = params.contextMode ?? "full";
-			const contextModule = await import("./context-B2cQ-Nt3.mjs").then((n) => n.n);
+			const contextModule = await import("./context-DHOTSgPb.mjs").then((n) => n.n);
 			const contextOptions = {
 				apiKey: globalOpts.apiKey,
 				serverUrl: globalOpts.serverUrl,

package/dist/{connect-_l7Lkfxi.mjs → connect-BUu2ojK7.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-BWcVRt-T.mjs";
-import { t as createTypedCommand } from "./commander-9Kro0Dl3.mjs";
+import { t as createTypedCommand } from "./commander-BTMzBiLq.mjs";
 import { z } from "zod";
 //#region src/commands/connect/connect.command.ts
 const ConnectOptionsSchema = JsonOptionSchema.extend({
@@ -61,7 +61,7 @@ function createConnectCommand() {
 		description: "Connect an official integration via OAuth (e.g., keystroke connect slack)",
 		schema: ConnectOptionsSchema,
 		optionsConfig: CONNECT_OPTIONS_CONFIG,
-		loadHandler: async () => (await import("./connect.handler-tqk-DOv8.mjs")).handleConnect,
+		loadHandler: async () => (await import("./connect.handler-D7oO_5WS.mjs")).handleConnect,
 		argument: {
 			name: "integrationId",
 			description: "Integration to connect (e.g., slack, linear)",

package/dist/{connect.handler-tqk-DOv8.mjs → connect.handler-D7oO_5WS.mjs}

@@ -3,10 +3,10 @@
 import { a as ui, j as throwReportedCliExit, p as AUTH_HINT, v as isNetworkError, y as toErrorMessage } from "./keystroke.mjs";
 import { t as assertWorkflowProjectRoot } from "./project-config-DudGRFPO.mjs";
 import { i as writeJson } from "./output-BWcVRt-T.mjs";
-import { n as resolveWorkflowsDir } from "./resolve-project-Cj3MFnU0.mjs";
+import { n as resolveWorkflowsDir } from "./resolve-project-DJJZIOmu.mjs";
 import { t as openBrowser } from "./browser-Dvv5OQrt.mjs";
 import { i as InitiateConnectionResponseSchema, n as ConnectionStatusResponseSchema, r as InitiateConnectionRequestSchema } from "./api-O5tdGdzc.mjs";
-import { t as getIntegrationCatalog } from "./integration-catalog-cYlTmOSb.mjs";
+import { t as getIntegrationCatalog } from "./integration-catalog-Cub_7xCw.mjs";
 //#region src/commands/connect/connect.handler.ts
 function formatIntegrationLabel(catalog, integrationId) {
 	return catalog.lookupByPublicId(integrationId)?.name ?? integrationId;

package/dist/{context-B2cQ-Nt3.mjs → context-DHOTSgPb.mjs}

@@ -2,8 +2,8 @@
 
 import { n as __exportAll } from "./chunk-CH6r78ws.mjs";
 import { D as CliExitError, E as AuthenticationError, P as logger, _ as isAuthError, a as ui, c as getProcessEnv, m as REAUTH_HINT, p as AUTH_HINT, s as getEnv, y as toErrorMessage } from "./keystroke.mjs";
-import { n as credentials } from "./dist-DuJjDZIf.mjs";
-import { t as resolveCliCredentials } from "./resolve-cli-credentials-DaMDaamj.mjs";
+import { n as credentials } from "./dist-D_KgdxW5.mjs";
+import { t as resolveCliCredentials } from "./resolve-cli-credentials-B4crOe_y.mjs";
 import { a as writeJsonError } from "./output-BWcVRt-T.mjs";
 //#region src/lib/context.ts
 var context_exports = /* @__PURE__ */ __exportAll({
@@ -110,7 +110,7 @@ async function resolveAuthContext(overrides = {}) {
 		storedServerUrls,
 		credentialStorageInfo,
 		credentialReadError: auth.readErrorMessage,
-		metadataFilePath: auth.metadataFilePath
+		credentialsFilePath: auth.credentialsFilePath
 	};
 }
 async function resolveAuthMetadataContext(overrides = {}) {
@@ -135,19 +135,14 @@ async function resolveAuthMetadataContext(overrides = {}) {
 		storedServerUrls,
 		credentialStorageInfo,
 		credentialReadError: void 0,
-		metadataFilePath: credentials.metadataFilePath
+		credentialsFilePath: credentials.credentialsFilePath
 	};
 }
 async function resolveCredentialStorageInfo() {
 	try {
 		return await credentials.getStorageInfo();
 	} catch {
-		return {
-			metadataFilePath: credentials.metadataFilePath,
-			legacySecretsFilePath: credentials.secretsFilePath,
-			secretStorageKind: "file",
-			insecureFileStorage: true
-		};
+		return { credentialsFilePath: credentials.credentialsFilePath };
 	}
 }
 /**

package/dist/{create.handler-v9B0Z9Yf.mjs → create.handler-BuxP18uj.mjs}

@@ -2,7 +2,7 @@
 
 import { a as ui, j as throwReportedCliExit, y as toErrorMessage } from "./keystroke.mjs";
 import { i as writeJson } from "./output-BWcVRt-T.mjs";
-import { i as requireClient } from "./context-B2cQ-Nt3.mjs";
+import { i as requireClient } from "./context-DHOTSgPb.mjs";
 //#region src/commands/api-keys/create.handler.ts
 async function handleApiKeysCreate(options, ctx) {
 	const client = requireClient(ctx);

package/dist/{credential-env-map-Dvp00a4M.mjs → credential-env-map-CtmzNkwU.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { r as getKeystrokeProjectPath } from "./paths-JzzFkXQA-CEipIeVl.mjs";
-import "./dist-DuJjDZIf.mjs";
+import "./dist-D_KgdxW5.mjs";
 import * as fs from "node:fs/promises";
 import { z } from "zod";
 //#region src/lib/credential-env-map.ts

package/dist/{credentials-Dr5lD7Hm.mjs → credentials-CELZ0QHu.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-BWcVRt-T.mjs";
-import { t as createTypedCommand } from "./commander-9Kro0Dl3.mjs";
+import { t as createTypedCommand } from "./commander-BTMzBiLq.mjs";
 import { i as CredentialScopeValues, r as CredentialScopeSchema } from "./schema-DFJiNWyd.mjs";
 import { z } from "zod";
 //#region src/commands/credentials/list/list.command.ts
@@ -46,7 +46,7 @@ function createCredentialsListCommand() {
 		description: "List credential sets on the server",
 		schema: ListOptionsSchema,
 		optionsConfig: LIST_OPTIONS_CONFIG,
-		loadHandler: async () => (await import("./list.handler-CLGQDuo5.mjs")).handleCredentialsList
+		loadHandler: async () => (await import("./list.handler-cK8Y-daR.mjs")).handleCredentialsList
 	});
 }
 //#endregion
@@ -65,7 +65,7 @@ function createCredentialsRequirementsCommand() {
 		description: "Show what credentials built workflows need (keys, KEYSTROKE_* env names, workflows) — from dist manifests, no API call",
 		schema: RequirementsOptionsSchema,
 		optionsConfig: REQUIREMENTS_OPTIONS_CONFIG,
-		loadHandler: async () => (await import("./requirements.handler-BKFocUof.mjs")).handleCredentialsRequirements
+		loadHandler: async () => (await import("./requirements.handler-ZZfHV6f0.mjs")).handleCredentialsRequirements
 	});
 }
 //#endregion
@@ -126,7 +126,7 @@ function createCredentialsUploadCommand() {
 		description: "Upload credentials from env vars to the server. Default: reads requirements from built workflow manifests. Use --integration for an official integration or --credential-set + --keys for a custom explicit upload.",
 		schema: UploadOptionsSchema,
 		optionsConfig: UPLOAD_OPTIONS_CONFIG,
-		loadHandler: async () => (await import("./upload.handler-DXVx2u3A.mjs")).handleCredentialsUpload
+		loadHandler: async () => (await import("./upload.handler-81mbKHTY.mjs")).handleCredentialsUpload
 	});
 }
 //#endregion
@@ -157,7 +157,7 @@ function createCredentialsCommand() {
 			}
 		},
 		handler: async (opts, ctx) => {
-			const { handleCredentialsList } = await import("./list.handler-CLGQDuo5.mjs");
+			const { handleCredentialsList } = await import("./list.handler-cK8Y-daR.mjs");
 			await handleCredentialsList({
 				...opts,
 				scope: void 0,

package/dist/{current-deployment-workflow-qMfOrRIu.mjs → current-deployment-workflow-CnzlDCBv.mjs}

@@ -3,9 +3,9 @@
 import { A as WorkflowResolutionError, a as ui, g as getHttpStatus, h as getApiErrorCode } from "./keystroke.mjs";
 import { t as assertWorkflowProjectRoot } from "./project-config-DudGRFPO.mjs";
 import { a as readManifestsFromOutDir } from "./dist-Br4m3sFZ.mjs";
-import { t as requireWorkflowsDir } from "./resolve-project-Cj3MFnU0.mjs";
+import { t as requireWorkflowsDir } from "./resolve-project-DJJZIOmu.mjs";
 import { t as createSpinnerProgress } from "./spinner-progress-BtEIJRX4.mjs";
-import { a as runWorkflowBuild, n as renderBuildFailure } from "./workflow-build-Bi1Aacc5.mjs";
+import { a as runWorkflowBuild, n as renderBuildFailure } from "./workflow-build-CVG4DSCw.mjs";
 //#region src/commands/workflows/_shared/current-deployment-workflow.ts
 /**
 * Lightweight resolution: gets projectId from keystroke.config.ts and authoredWorkflowId

package/dist/{current.handler-Cm_-JLyZ.mjs → current.handler-BXec-Bhy.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { a as ui } from "./keystroke.mjs";
-import { i as requireClient } from "./context-B2cQ-Nt3.mjs";
+import { i as requireClient } from "./context-DHOTSgPb.mjs";
 //#region src/commands/org/current.handler.ts
 async function handleOrgCurrent(_options, ctx) {
 	if (!ctx.organizationId) {

package/dist/{delete.handler-DtP_zUaq.mjs → delete.handler-CpYOMtsv.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { a as ui, j as throwReportedCliExit, y as toErrorMessage } from "./keystroke.mjs";
-import { i as requireClient } from "./context-B2cQ-Nt3.mjs";
+import { i as requireClient } from "./context-DHOTSgPb.mjs";
 //#region src/commands/api-keys/delete.handler.ts
 async function handleApiKeysDelete(options, ctx) {
 	const client = requireClient(ctx);

package/dist/{deploy-CB6pfCuB.mjs → deploy-Cn3jN7Rl.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { t as createTypedCommand } from "./commander-9Kro0Dl3.mjs";
+import { t as createTypedCommand } from "./commander-BTMzBiLq.mjs";
 import { z } from "zod";
 //#region src/commands/deploy/deploy.command.ts
 /**
@@ -64,7 +64,7 @@ function createDeployCommand() {
 		schema: DeployOptionsSchema,
 		optionsConfig: DEPLOY_OPTIONS_CONFIG,
 		contextMode: "auth",
-		loadHandler: async () => (await import("./deploy.handler-Bg0dpSTj.mjs")).handleDeploy
+		loadHandler: async () => (await import("./deploy.handler-BikVS9ER.mjs")).handleDeploy
 	});
 	cmd.enablePositionalOptions();
 	cmd.passThroughOptions();

package/dist/{deploy.handler-Bg0dpSTj.mjs → deploy.handler-BikVS9ER.mjs}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 
 import { D as CliExitError, P as logger, a as ui, l as isLocalMode, n as style, t as ANSI } from "./keystroke.mjs";
-import { i as projects } from "./dist-DuJjDZIf.mjs";
+import { i as projects } from "./dist-D_KgdxW5.mjs";
 import { t as assertWorkflowProjectRoot } from "./project-config-DudGRFPO.mjs";
-import { r as requireAuthOptions, t as assertProjectConfigMatchesAuthenticatedOrg } from "./context-B2cQ-Nt3.mjs";
+import { r as requireAuthOptions, t as assertProjectConfigMatchesAuthenticatedOrg } from "./context-DHOTSgPb.mjs";
 import { i as readAgentManifestsFromOutDir, o as readWorkflowsFromDisk } from "./dist-Br4m3sFZ.mjs";
-import { t as requireWorkflowsDir } from "./resolve-project-Cj3MFnU0.mjs";
-import { n as renderBuildFailure, r as renderBuildHeader } from "./workflow-build-Bi1Aacc5.mjs";
+import { t as requireWorkflowsDir } from "./resolve-project-DJJZIOmu.mjs";
+import { n as renderBuildFailure, r as renderBuildHeader } from "./workflow-build-CVG4DSCw.mjs";
 import { t as createBuildProgress } from "./build-progress-nYa14iBP.mjs";
 import { t as createDeployProgress } from "./deploy-progress-Dlp9aBDW.mjs";
 import { t as withErrorBoundary } from "./error-boundary-DVZipk-A.mjs";
-import { t as lookupCurrentDeploymentWorkflow } from "./current-deployment-workflow-qMfOrRIu.mjs";
+import { t as lookupCurrentDeploymentWorkflow } from "./current-deployment-workflow-CnzlDCBv.mjs";
 import { t as computeWorkflowDiff } from "./diff-utils-CXKNQUXO.mjs";
 import path from "node:path";
 import { access } from "node:fs/promises";
@@ -198,7 +198,7 @@ async function handleDeploy(options, ctx) {
 		let outDir;
 		let artifactFilter;
 		try {
-			const { runWorkflowBuild } = await import("./workflow-build-Bi1Aacc5.mjs").then((n) => n.o);
+			const { runWorkflowBuild } = await import("./workflow-build-CVG4DSCw.mjs").then((n) => n.o);
 			const buildOutcome = await runWorkflowBuild({
 				workflowsDir,
 				verbose: options.verbose,
@@ -271,7 +271,7 @@ function emitNewWebhookCredentials(result) {
 }
 async function handleTaskTargetDeploy(options) {
 	renderBuildHeader(void 0);
-	const buildResult = await (deployHandlerDependencies.buildTaskTargets ?? (await import("./task-target-build-CTgl4L42.mjs")).buildTaskTargets)({
+	const buildResult = await (deployHandlerDependencies.buildTaskTargets ?? (await import("./task-target-build-CrPLSXnu.mjs")).buildTaskTargets)({
 		projectRoot: options.workflowsDir,
 		targetFiles: options.targetFiles,
 		disableSourcemaps: options.options.disableSourcemaps

package/dist/{diff.handler-CJPrszL1.mjs → diff.handler-C3EWVBOj.mjs}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 
 import { D as CliExitError, a as ui, j as throwReportedCliExit, y as toErrorMessage } from "./keystroke.mjs";
-import { i as projects } from "./dist-DuJjDZIf.mjs";
+import { i as projects } from "./dist-D_KgdxW5.mjs";
 import { i as writeJson } from "./output-BWcVRt-T.mjs";
-import { i as requireClient, t as assertProjectConfigMatchesAuthenticatedOrg } from "./context-B2cQ-Nt3.mjs";
-import { n as resolveLocalWorkflowManifest, t as lookupCurrentDeploymentWorkflow } from "./current-deployment-workflow-qMfOrRIu.mjs";
+import { i as requireClient, t as assertProjectConfigMatchesAuthenticatedOrg } from "./context-DHOTSgPb.mjs";
+import { n as resolveLocalWorkflowManifest, t as lookupCurrentDeploymentWorkflow } from "./current-deployment-workflow-CnzlDCBv.mjs";
 import { n as renderDiff, t as computeWorkflowDiff } from "./diff-utils-CXKNQUXO.mjs";
 //#region src/commands/workflows/diff/diff.handler.ts
 async function handleWorkflowsDiff(options, ctx) {