@keystrokehq/cli 0.0.31 → 0.0.37

package/dist/{build.handler-zHimoO7c.mjs → build.handler-CpAsAsBc.mjs}

@@ -1,23 +1,26 @@
 #!/usr/bin/env node
 
-import { D as CliExitError } from "./keystroke.mjs";
-import { i as projects } from "./dist-Dw7gCE7y.mjs";
-import { t as requireWorkflowsDir } from "./resolve-project-E9mrh_el.mjs";
-import { a as runWorkflowBuild, i as renderBuildSummary, n as renderBuildFailure, r as renderBuildHeader } from "./workflow-build-Begvjfq8.mjs";
-import { t as createBuildProgress } from "./build-progress-DLM1Bt4T.mjs";
-import { t as withErrorBoundary } from "./error-boundary-0veZ_RDS.mjs";
+import { k as CliExitError, z as setDebug } from "./keystroke.mjs";
+import { i as projects } from "./dist-B5jy238v.mjs";
+import { t as requireWorkflowsDir } from "./resolve-project-DLKlAy0z.mjs";
+import { a as runWorkflowBuild, i as renderBuildSummary, n as renderBuildFailure, r as renderBuildHeader } from "./workflow-build-Bm8JoVv4.mjs";
+import { t as createBuildProgress } from "./build-progress-CM-b6Bby.mjs";
+import { t as withErrorBoundary } from "./error-boundary-BRxUsPi7.mjs";
+import { n as assertAuthoredWorkflowId, t as WORKFLOW_ID_COMMANDS } from "./authored-workflow-ref-fkHEEVnd.mjs";
 //#region src/commands/workflows/build.handler.ts
 async function handleWorkflowsBuild(options, _ctx) {
 	return withErrorBoundary("Build", async () => {
+		if (options.verbose) setDebug(true);
 		const workflowsDir = await requireWorkflowsDir(options.path);
 		projects.track(workflowsDir);
-		renderBuildHeader(options.name);
-		const progress = createBuildProgress(options.name ?? "workflow");
+		if (options.id) await assertAuthoredWorkflowId(options.id, workflowsDir, WORKFLOW_ID_COMMANDS.build);
+		renderBuildHeader(options.id);
+		const progress = createBuildProgress(options.id ?? "workflow");
 		try {
 			const { result, outDir } = await runWorkflowBuild({
 				workflowsDir,
 				verbose: options.verbose,
-				name: options.name,
+				workflowRef: options.id,
 				force: options.force,
 				targetFiles: options.target,
 				...options.disableSourcemaps ? { sourceMaps: false } : {},

package/dist/{clear-cache.handler-BP0K1-uN.mjs → clear-cache.handler-gJpwslkK.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
-import { a as ui } from "./keystroke.mjs";
-import { i as projects } from "./dist-Dw7gCE7y.mjs";
+import { p as ui } from "./keystroke.mjs";
+import { i as projects } from "./dist-B5jy238v.mjs";
 //#region src/commands/projects/clear-cache.handler.ts
 async function handleProjectsClearCache(_options, _ctx) {
 	if (await projects.clear()) ui.success("Projects cache cleared.");

package/dist/{clear.handler-T27GpgSu.mjs → clear.handler-CDyG6-dk.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { M as clearLog, N as closeLogger } from "./keystroke.mjs";
+import { F as closeLogger, P as clearLog } from "./keystroke.mjs";
 import { log } from "@clack/prompts";
 //#region src/commands/logs/clear.handler.ts
 async function handleLogsClear(_options, _ctx) {

package/dist/{clear.handler-PsA5QKHx.mjs → clear.handler-_sR33Hp8.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
-import { P as logger, a as ui, p as AUTH_HINT, y as toErrorMessage } from "./keystroke.mjs";
-import { n as credentials } from "./dist-Dw7gCE7y.mjs";
+import { I as logger, h as AUTH_HINT, p as ui, x as toErrorMessage } from "./keystroke.mjs";
+import { n as credentials } from "./dist-B5jy238v.mjs";
 import { createClient } from "./src-DI-ybNjR.mjs";
 //#region src/commands/auth/clear.handler.ts
 async function tryRevokeKey(apiKey, apiKeyId, baseUrl, organizationId) {

package/dist/{commander-BlrSdFcu.mjs → commander-C6SSTQJ2.mjs}

@@ -1,9 +1,25 @@
 #!/usr/bin/env node
 
-import { D as CliExitError, L as setDebug, O as InputValidationError, _ as isAuthError, a as ui, f as captureCliTelemetryResolvedContext, o as createHiddenGlobalOptions, p as AUTH_HINT, y as toErrorMessage } from "./keystroke.mjs";
-import { a as writeJsonError, r as isJsonMode } from "./output-BWcVRt-T.mjs";
+import { A as InputValidationError, f as applyCommanderOutput, h as AUTH_HINT, k as CliExitError, m as captureCliTelemetryResolvedContext, o as createHiddenGlobalOptions, p as ui, x as toErrorMessage, y as isAuthError, z as setDebug } from "./keystroke.mjs";
+import { a as writeJsonError, r as isJsonMode } from "./output-DnIFEmi5.mjs";
 import { Command } from "commander";
 //#region src/lib/commander.ts
+function mergeParentCommandPath(rawOptions, command, schema) {
+	if (!("path" in schema.shape)) return rawOptions;
+	const options = rawOptions && typeof rawOptions === "object" ? { ...rawOptions } : {};
+	const currentPath = options.path;
+	if (typeof currentPath === "string" && currentPath.length > 0) return options;
+	let current = command.parent;
+	while (current) {
+		const parentPath = current.opts().path;
+		if (typeof parentPath === "string" && parentPath.length > 0) {
+			options.path = parentPath;
+			break;
+		}
+		current = current.parent;
+	}
+	return options;
+}
 /**
 * Applies typed options to a Commander command from a schema and configuration
 * Type-safe: ensures all schema keys have corresponding option configurations
@@ -46,6 +62,8 @@ function applyTypedOptionsToCommand(command, schema, optionsConfig, skipKeys) {
 function createTypedCommand(params) {
 	const { name, description, schema, optionsConfig, resolve, subcommands } = params;
 	const command = new Command(name).description(description).enablePositionalOptions();
+	applyCommanderOutput(command);
+	command.exitOverride();
 	for (const opt of createHiddenGlobalOptions()) command.addOption(opt);
 	const positionalArguments = params.arguments ?? (params.argument ? [params.argument] : []);
 	for (const arg of positionalArguments) {
@@ -66,6 +84,7 @@ function createTypedCommand(params) {
 				rawOptions = args[0];
 				cmd = args[1];
 			}
+			rawOptions = mergeParentCommandPath(rawOptions, cmd, schema);
 			const parseResult = schema.safeParse(rawOptions);
 			if (!parseResult.success) {
 				ui.error("Invalid options provided:");
@@ -78,7 +97,7 @@ function createTypedCommand(params) {
 			const globalOpts = cmd.optsWithGlobals();
 			if (globalOpts.debug) setDebug(true);
 			const contextMode = params.contextMode ?? "full";
-			const contextModule = await import("./context-sgKhRc5v.mjs").then((n) => n.n);
+			const contextModule = await import("./context-ebZssGCY.mjs").then((n) => n.n);
 			const contextOptions = {
 				apiKey: globalOpts.apiKey,
 				serverUrl: globalOpts.serverUrl,

package/dist/{connect-BbLJhlIA.mjs → connect-27EgnljZ.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
-import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-BWcVRt-T.mjs";
-import { t as createTypedCommand } from "./commander-BlrSdFcu.mjs";
+import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-DnIFEmi5.mjs";
+import { t as createTypedCommand } from "./commander-C6SSTQJ2.mjs";
 import { z } from "zod";
 //#region src/commands/connect/connect.command.ts
 const ConnectOptionsSchema = JsonOptionSchema.extend({
@@ -61,7 +61,7 @@ function createConnectCommand() {
 		description: "Connect an official integration via OAuth (e.g., keystroke connect slack)",
 		schema: ConnectOptionsSchema,
 		optionsConfig: CONNECT_OPTIONS_CONFIG,
-		loadHandler: async () => (await import("./connect.handler-BthE-7Wg.mjs")).handleConnect,
+		loadHandler: async () => (await import("./connect.handler-COM1LnNg.mjs")).handleConnect,
 		argument: {
 			name: "integrationId",
 			description: "Integration to connect (e.g., slack, linear)",

package/dist/{connect.handler-BthE-7Wg.mjs → connect.handler-COM1LnNg.mjs}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 
-import { a as ui, j as throwReportedCliExit, p as AUTH_HINT, v as isNetworkError, y as toErrorMessage } from "./keystroke.mjs";
+import { N as throwReportedCliExit, b as isNetworkError, h as AUTH_HINT, p as ui, x as toErrorMessage } from "./keystroke.mjs";
 import { t as assertWorkflowProjectRoot } from "./project-config-DudGRFPO.mjs";
-import { i as writeJson } from "./output-BWcVRt-T.mjs";
-import { n as resolveWorkflowsDir } from "./resolve-project-E9mrh_el.mjs";
+import { i as writeJson } from "./output-DnIFEmi5.mjs";
+import { n as resolveWorkflowsDir } from "./resolve-project-DLKlAy0z.mjs";
 import { t as openBrowser } from "./browser-Dvv5OQrt.mjs";
-import { i as InitiateConnectionResponseSchema, n as ConnectionStatusResponseSchema, r as InitiateConnectionRequestSchema } from "./api-BK3EhPvs.mjs";
-import { t as getIntegrationCatalog } from "./integration-catalog-CiZ62hb_.mjs";
+import { i as InitiateConnectionResponseSchema, n as ConnectionStatusResponseSchema, r as InitiateConnectionRequestSchema } from "./api-sWkB_Wta.mjs";
+import { t as getIntegrationCatalog } from "./integration-catalog-pSmWHFLQ.mjs";
 //#region src/commands/connect/connect.handler.ts
 function formatIntegrationLabel(catalog, integrationId) {
 	return catalog.lookupByPublicId(integrationId)?.name ?? integrationId;

package/dist/{context-sgKhRc5v.mjs → context-ebZssGCY.mjs}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 
 import { n as __exportAll } from "./chunk-CH6r78ws.mjs";
-import { D as CliExitError, E as AuthenticationError, P as logger, _ as isAuthError, a as ui, c as getProcessEnv, m as REAUTH_HINT, p as AUTH_HINT, s as getEnv, y as toErrorMessage } from "./keystroke.mjs";
-import { n as credentials } from "./dist-Dw7gCE7y.mjs";
-import { t as resolveCliCredentials } from "./resolve-cli-credentials-CAOSVMJP.mjs";
-import { a as writeJsonError } from "./output-BWcVRt-T.mjs";
+import { I as logger, O as AuthenticationError, c as getProcessEnv, g as REAUTH_HINT, h as AUTH_HINT, k as CliExitError, p as ui, s as getEnv, x as toErrorMessage, y as isAuthError } from "./keystroke.mjs";
+import { n as credentials } from "./dist-B5jy238v.mjs";
+import { t as resolveCliCredentials } from "./resolve-cli-credentials-GVOOedoQ.mjs";
+import { a as writeJsonError } from "./output-DnIFEmi5.mjs";
 //#region src/lib/context.ts
 var context_exports = /* @__PURE__ */ __exportAll({
 	assertProjectConfigMatchesAuthenticatedOrg: () => assertProjectConfigMatchesAuthenticatedOrg,

package/dist/{create.handler-BovbO_g0.mjs → create.handler-CAWJAGzQ.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
-import { a as ui, j as throwReportedCliExit, y as toErrorMessage } from "./keystroke.mjs";
-import { i as writeJson } from "./output-BWcVRt-T.mjs";
-import { i as requireClient } from "./context-sgKhRc5v.mjs";
+import { N as throwReportedCliExit, p as ui, x as toErrorMessage } from "./keystroke.mjs";
+import { i as writeJson } from "./output-DnIFEmi5.mjs";
+import { i as requireClient } from "./context-ebZssGCY.mjs";
 //#region src/commands/api-keys/create.handler.ts
 async function handleApiKeysCreate(options, ctx) {
 	const client = requireClient(ctx);

package/dist/{credential-env-map-CRs0llf0.mjs → credential-env-map-5a41jLwM.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { r as getKeystrokeProjectPath } from "./paths-DpHfoaXN-CdPimpky.mjs";
-import "./dist-Dw7gCE7y.mjs";
+import "./dist-B5jy238v.mjs";
 import * as fs from "node:fs/promises";
 import { z } from "zod";
 //#region src/lib/credential-env-map.ts

package/dist/{credential-requirements-D0mavK8j-CFMf0Xwu.mjs → credential-requirements-B5Alhu1v-DanlSKnT.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { z } from "zod";
-//#region ../../packages/core/dist/chunks/schema-DsHGh6YT.mjs
+//#region ../../packages/core/dist/chunks/schema-DuaOhhRR.mjs
 const MAX_JSON_DEPTH = 20;
 function buildJsonValueSchema(depth) {
 	const primitives = z.union([
@@ -51,7 +51,7 @@ function optionalDescriptionString(fieldName) {
 	return descriptionString(fieldName).optional();
 }
 //#endregion
-//#region ../../packages/core/dist/chunks/schemas-BhQu9ko9.mjs
+//#region ../../packages/core/dist/chunks/schemas-BvH7lOGL.mjs
 /**
 * Shared constants for the credential/connection system.
 * Defined in core (bottom of dependency chain) so all packages can import them.
@@ -280,7 +280,7 @@ z.object({
 	return data.constant !== void 0 !== (data.exponential !== void 0);
 }, { error: "Retry config must specify exactly one of constant or exponential strategy" });
 //#endregion
-//#region ../../packages/core/dist/chunks/credential-requirements-D0mavK8j.mjs
+//#region ../../packages/core/dist/chunks/credential-requirements-B5Alhu1v.mjs
 const SourceLocationSchema = z.object({
 	filePath: z.string().min(1),
 	absoluteFilePath: z.string().min(1).optional(),

package/dist/{credential-schema-mismatch-ClQgEVtO.mjs → credential-schema-mismatch-c17ktoNU.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { i as writeJson } from "./output-BWcVRt-T.mjs";
+import { i as writeJson } from "./output-DnIFEmi5.mjs";
 //#region src/lib/credential-schema-mismatch.ts
 /**
 * Structured detection and rendering for `CredentialSchemaMismatchError`

package/dist/{credentials-CsncZ52a.mjs → credentials-C0ssbMlp.mjs}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
-import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-BWcVRt-T.mjs";
-import { t as createTypedCommand } from "./commander-BlrSdFcu.mjs";
+import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-DnIFEmi5.mjs";
+import { t as createTypedCommand } from "./commander-C6SSTQJ2.mjs";
 import { i as CredentialScopeValues, n as CredentialConnectionIdSchema, r as CredentialScopeSchema } from "./schema-DFJiNWyd.mjs";
-import { t as ConnectionKindValues } from "./api-BK3EhPvs.mjs";
+import { t as ConnectionKindValues } from "./api-sWkB_Wta.mjs";
 import { z } from "zod";
 //#region ../../packages/shared-types/src/credentials/models/definition-records.ts
 const JsonRecordSchema = z.record(z.string(), z.unknown());
@@ -265,13 +265,13 @@ function createCredentialsDefinitionsCommand() {
 		description: "Browse and inspect credential definitions (catalog metadata; not per-org credential sets)",
 		schema: CredentialDefinitionsListOptionsSchema,
 		optionsConfig: DEFINITIONS_LIST_OPTIONS_CONFIG,
-		loadHandler: async () => (await import("./list.handler-DIMWZx78.mjs")).handleCredentialDefinitionsList,
+		loadHandler: async () => (await import("./list.handler-KcCaG3PZ.mjs")).handleCredentialDefinitionsList,
 		subcommands: [createTypedCommand({
 			name: "list",
 			description: "List credential definitions",
 			schema: CredentialDefinitionsListOptionsSchema,
 			optionsConfig: DEFINITIONS_LIST_OPTIONS_CONFIG,
-			loadHandler: async () => (await import("./list.handler-DIMWZx78.mjs")).handleCredentialDefinitionsList
+			loadHandler: async () => (await import("./list.handler-KcCaG3PZ.mjs")).handleCredentialDefinitionsList
 		}), createTypedCommand({
 			name: "show",
 			description: "Show one credential definition including auth schema",
@@ -282,7 +282,7 @@ function createCredentialsDefinitionsCommand() {
 				description: "Credential definition id, e.g. keystroke:aws-s3",
 				key: "id"
 			},
-			loadHandler: async () => (await import("./show.handler-CsidInW8.mjs")).handleCredentialDefinitionShow
+			loadHandler: async () => (await import("./show.handler-Cqe_hCqU.mjs")).handleCredentialDefinitionShow
 		})]
 	});
 }
@@ -329,7 +329,7 @@ function createCredentialsListCommand() {
 		description: "List credential sets on the server",
 		schema: ListOptionsSchema,
 		optionsConfig: LIST_OPTIONS_CONFIG,
-		loadHandler: async () => (await import("./list.handler-DVnFrlis.mjs")).handleCredentialsList
+		loadHandler: async () => (await import("./list.handler-DYE48apa.mjs")).handleCredentialsList
 	});
 }
 //#endregion
@@ -348,7 +348,7 @@ function createCredentialsRequirementsCommand() {
 		description: "Show what credentials built workflows need (keys, KEYSTROKE_* env names, workflows) — from dist manifests, no API call",
 		schema: RequirementsOptionsSchema,
 		optionsConfig: REQUIREMENTS_OPTIONS_CONFIG,
-		loadHandler: async () => (await import("./requirements.handler-B5rqCjMu.mjs")).handleCredentialsRequirements
+		loadHandler: async () => (await import("./requirements.handler-Bab4kBtw.mjs")).handleCredentialsRequirements
 	});
 }
 //#endregion
@@ -409,7 +409,7 @@ function createCredentialsUploadCommand() {
 		description: "Upload credentials from env vars to the server. Default: reads requirements from built workflow manifests. Use --integration for an official integration or --credential-set + --keys for a custom explicit upload.",
 		schema: UploadOptionsSchema,
 		optionsConfig: UPLOAD_OPTIONS_CONFIG,
-		loadHandler: async () => (await import("./upload.handler-B7xle1oX.mjs")).handleCredentialsUpload
+		loadHandler: async () => (await import("./upload.handler-CS-vLpzC.mjs")).handleCredentialsUpload
 	});
 }
 //#endregion
@@ -440,7 +440,7 @@ function createCredentialsCommand() {
 			}
 		},
 		handler: async (opts, ctx) => {
-			const { handleCredentialsList } = await import("./list.handler-DVnFrlis.mjs");
+			const { handleCredentialsList } = await import("./list.handler-DYE48apa.mjs");
 			await handleCredentialsList({
 				...opts,
 				scope: void 0,

package/dist/{credentials-DKrSaaLw.mjs → credentials-DtwLbee6.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { f as collectCredentialRequirementEntries } from "./credential-requirements-D0mavK8j-CFMf0Xwu.mjs";
+import { f as collectCredentialRequirementEntries } from "./credential-requirements-B5Alhu1v-DanlSKnT.mjs";
 //#region ../../packages/workflow-deploy/dist/credentials/index.mjs
 /**
 * Resolves credential values from environment using KEYSTROKE_<KEY> convention.

package/dist/current-deployment-workflow-C6x65imE.mjs

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+
+import { _ as getApiErrorCode, v as getHttpStatus } from "./keystroke.mjs";
+//#region src/commands/workflows/_shared/current-deployment-workflow.ts
+async function lookupCurrentDeploymentWorkflow(client, params) {
+	try {
+		return {
+			status: "found",
+			workflow: (await client.projects.getCurrentDeploymentWorkflow(params.projectId, params.authoredWorkflowId)).workflow
+		};
+	} catch (error) {
+		if (getHttpStatus(error) !== 404) throw error;
+		const errorCode = await getApiErrorCode(error);
+		if (errorCode === "no_current_deployment") return { status: "missingCurrentDeployment" };
+		if (errorCode === "workflow_not_in_deployment") return { status: "missingWorkflow" };
+		throw error;
+	}
+}
+//#endregion
+export { lookupCurrentDeploymentWorkflow as t };

package/dist/current.handler-DP1L_hm3.mjs

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+
+import { p as ui } from "./keystroke.mjs";
+import { i as requireClient } from "./context-ebZssGCY.mjs";
+import { c as resolveEffectiveOrganization, o as requireEffectiveOrganization } from "./org-context-BI9OSpbb.mjs";
+import { n as renderOrgCurrentJson, t as renderOrgCurrentHuman } from "./org-output-DffU7DKn.mjs";
+//#region src/commands/org/current.handler.ts
+async function handleOrgCurrent(_options, ctx) {
+	const { user } = await requireClient(ctx).users.getMe();
+	const effective = requireEffectiveOrganization(await resolveEffectiveOrganization(ctx, user.organizations ?? []), ctx);
+	if (ctx.jsonMode) {
+		renderOrgCurrentJson(effective);
+		return;
+	}
+	renderOrgCurrentHuman(effective);
+	if (ctx.storedOrgs.length > 1) ui.hint(`${ctx.storedOrgs.length} organizations with stored credentials. Use \`keystroke org switch\` to change.`);
+}
+//#endregion
+export { handleOrgCurrent };

package/dist/{delete.handler-DkAK396w.mjs → delete.handler-C-5XFkgN.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
-import { a as ui, j as throwReportedCliExit, y as toErrorMessage } from "./keystroke.mjs";
-import { i as requireClient } from "./context-sgKhRc5v.mjs";
+import { N as throwReportedCliExit, p as ui, x as toErrorMessage } from "./keystroke.mjs";
+import { i as requireClient } from "./context-ebZssGCY.mjs";
 //#region src/commands/api-keys/delete.handler.ts
 async function handleApiKeysDelete(options, ctx) {
 	const client = requireClient(ctx);

package/dist/{deploy-DvPfR9fC.mjs → deploy-BcVQJza8.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { t as createTypedCommand } from "./commander-BlrSdFcu.mjs";
+import { t as createTypedCommand } from "./commander-C6SSTQJ2.mjs";
 import { z } from "zod";
 //#region src/commands/deploy/deploy.command.ts
 /**
@@ -64,7 +64,7 @@ function createDeployCommand() {
 		schema: DeployOptionsSchema,
 		optionsConfig: DEPLOY_OPTIONS_CONFIG,
 		contextMode: "auth",
-		loadHandler: async () => (await import("./deploy.handler-BW3f2N2G.mjs")).handleDeploy
+		loadHandler: async () => (await import("./deploy.handler-GPS9lxGk.mjs")).handleDeploy
 	});
 	cmd.enablePositionalOptions();
 	cmd.passThroughOptions();

package/dist/{deploy-progress-BsUH7fGE.mjs → deploy-progress-Bt86Yc1r.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
-import { a as ui } from "./keystroke.mjs";
-import { t as createSpinnerProgress } from "./spinner-progress-lrKDs4YF.mjs";
+import { p as ui } from "./keystroke.mjs";
+import { t as createSpinnerProgress } from "./spinner-progress-BYxlr3lY.mjs";
 //#region src/lib/deploy-progress.ts
 function renderItemFailure(event, kind, spinner) {
 	if (event.result === "failure") spinner.fail(`${kind} failed (${event.name})`, void 0, event.error);

package/dist/{deploy.handler-BW3f2N2G.mjs → deploy.handler-GPS9lxGk.mjs}

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
 
-import { D as CliExitError, P as logger, a as ui, l as isLocalMode, n as style, t as ANSI } from "./keystroke.mjs";
-import { i as projects } from "./dist-Dw7gCE7y.mjs";
+import { I as logger, k as CliExitError, l as isLocalMode, n as style, p as ui, t as ANSI } from "./keystroke.mjs";
+import { i as projects } from "./dist-B5jy238v.mjs";
 import { t as assertWorkflowProjectRoot } from "./project-config-DudGRFPO.mjs";
-import { r as requireAuthOptions, t as assertProjectConfigMatchesAuthenticatedOrg } from "./context-sgKhRc5v.mjs";
-import { i as readAgentManifestsFromOutDir, o as readWorkflowsFromDisk } from "./dist-CTEtWDW4.mjs";
-import { t as requireWorkflowsDir } from "./resolve-project-E9mrh_el.mjs";
-import { n as renderBuildFailure, r as renderBuildHeader } from "./workflow-build-Begvjfq8.mjs";
-import { t as createBuildProgress } from "./build-progress-DLM1Bt4T.mjs";
-import { t as createDeployProgress } from "./deploy-progress-BsUH7fGE.mjs";
-import { t as withErrorBoundary } from "./error-boundary-0veZ_RDS.mjs";
-import { t as lookupCurrentDeploymentWorkflow } from "./current-deployment-workflow-B1VQCYC-.mjs";
-import { t as computeWorkflowDiff } from "./diff-utils-Bs--xmoV.mjs";
+import { r as requireAuthOptions, t as assertProjectConfigMatchesAuthenticatedOrg } from "./context-ebZssGCY.mjs";
+import { i as readAgentManifestsFromOutDir, o as readWorkflowsFromDisk } from "./dist-BmbFJq8U.mjs";
+import { t as requireWorkflowsDir } from "./resolve-project-DLKlAy0z.mjs";
+import { n as renderBuildFailure, r as renderBuildHeader } from "./workflow-build-Bm8JoVv4.mjs";
+import { t as createBuildProgress } from "./build-progress-CM-b6Bby.mjs";
+import { t as createDeployProgress } from "./deploy-progress-Bt86Yc1r.mjs";
+import { t as withErrorBoundary } from "./error-boundary-BRxUsPi7.mjs";
+import { t as lookupCurrentDeploymentWorkflow } from "./current-deployment-workflow-C6x65imE.mjs";
+import { t as computeWorkflowDiff } from "./diff-utils-YEUYtSRs.mjs";
 import path from "node:path";
 import { access } from "node:fs/promises";
 //#region src/commands/deploy/deploy-diff.ts
@@ -198,7 +198,7 @@ async function handleDeploy(options, ctx) {
 		let outDir;
 		let artifactFilter;
 		try {
-			const { runWorkflowBuild } = await import("./workflow-build-Begvjfq8.mjs").then((n) => n.o);
+			const { runWorkflowBuild } = await import("./workflow-build-Bm8JoVv4.mjs").then((n) => n.o);
 			const buildOutcome = await runWorkflowBuild({
 				workflowsDir,
 				verbose: options.verbose,
@@ -233,7 +233,7 @@ async function handleDeploy(options, ctx) {
 		const progress = createDeployProgress();
 		let result;
 		try {
-			result = await (deployHandlerDependencies.deployFromDir ?? (await import("./dist-CTEtWDW4.mjs").then((n) => n.r)).deployFromDir)({
+			result = await (deployHandlerDependencies.deployFromDir ?? (await import("./dist-BmbFJq8U.mjs").then((n) => n.r)).deployFromDir)({
 				outDir,
 				workflowsDir,
 				client,
@@ -271,7 +271,7 @@ function emitNewWebhookCredentials(result) {
 }
 async function handleTaskTargetDeploy(options) {
 	renderBuildHeader(void 0);
-	const buildResult = await (deployHandlerDependencies.buildTaskTargets ?? (await import("./task-target-build-QllcCfoN.mjs")).buildTaskTargets)({
+	const buildResult = await (deployHandlerDependencies.buildTaskTargets ?? (await import("./task-target-build-CtvRyVjH.mjs")).buildTaskTargets)({
 		projectRoot: options.workflowsDir,
 		targetFiles: options.targetFiles,
 		disableSourcemaps: options.options.disableSourcemaps
@@ -289,7 +289,7 @@ async function handleTaskTargetDeploy(options) {
 	const progress = createDeployProgress();
 	let result;
 	try {
-		result = await (deployHandlerDependencies.deployTaskTargets ?? (await import("./task-target-deploy-B_3HPSo2.mjs")).deployTaskTargets)({
+		result = await (deployHandlerDependencies.deployTaskTargets ?? (await import("./task-target-deploy-m9LfE488.mjs")).deployTaskTargets)({
 			preparedTasks: buildResult.preparedTasks,
 			client,
 			organizationId: options.projectConfig.organizationId,
@@ -327,7 +327,7 @@ async function createFullDeployClient(ctx) {
 }
 async function createTaskDeployClient(ctx) {
 	const authOptions = requireAuthOptions(ctx);
-	return (deployHandlerDependencies.createDeployClient ?? (await import("./deploy-DhCbYFc7.mjs")).createDeployClient)(authOptions);
+	return (deployHandlerDependencies.createDeployClient ?? (await import("./deploy-BiKBH25R.mjs")).createDeployClient)(authOptions);
 }
 function renderSuccessSummary(result) {
 	const tasks = result.tasks || [];

package/dist/{diff-utils-Bs--xmoV.mjs → diff-utils-YEUYtSRs.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { a as ui, n as style, t as ANSI } from "./keystroke.mjs";
+import { n as style, p as ui, t as ANSI } from "./keystroke.mjs";
 //#region src/commands/workflows/diff/diff-utils.ts
 function computeWorkflowDiff(local, deployed, meta) {
 	if (!deployed) return {

package/dist/{diff.handler-BwhsoAg0.mjs → diff.handler-DkM5dhaN.mjs}

@@ -1,14 +1,20 @@
 #!/usr/bin/env node
 
-import { D as CliExitError, a as ui, j as throwReportedCliExit, y as toErrorMessage } from "./keystroke.mjs";
-import { i as projects } from "./dist-Dw7gCE7y.mjs";
-import { i as writeJson } from "./output-BWcVRt-T.mjs";
-import { i as requireClient, t as assertProjectConfigMatchesAuthenticatedOrg } from "./context-sgKhRc5v.mjs";
-import { n as resolveLocalWorkflowManifest, t as lookupCurrentDeploymentWorkflow } from "./current-deployment-workflow-B1VQCYC-.mjs";
-import { n as renderDiff, t as computeWorkflowDiff } from "./diff-utils-Bs--xmoV.mjs";
+import { N as throwReportedCliExit, k as CliExitError, p as ui, x as toErrorMessage } from "./keystroke.mjs";
+import { i as projects } from "./dist-B5jy238v.mjs";
+import { i as writeJson } from "./output-DnIFEmi5.mjs";
+import { i as requireClient, t as assertProjectConfigMatchesAuthenticatedOrg } from "./context-ebZssGCY.mjs";
+import { t as lookupCurrentDeploymentWorkflow } from "./current-deployment-workflow-C6x65imE.mjs";
+import { n as renderDiff, t as computeWorkflowDiff } from "./diff-utils-YEUYtSRs.mjs";
+import { r as requireLocalWorkflowManifest, t as WORKFLOW_ID_COMMANDS } from "./authored-workflow-ref-fkHEEVnd.mjs";
 //#region src/commands/workflows/diff/diff.handler.ts
 async function handleWorkflowsDiff(options, ctx) {
-	const resolved = await resolveLocalWorkflowManifest(options.workflow, options.path, { jsonMode: ctx.jsonMode });
+	const resolved = await requireLocalWorkflowManifest({
+		authoredWorkflowId: options.workflow,
+		path: options.path,
+		command: WORKFLOW_ID_COMMANDS.diff,
+		jsonMode: ctx.jsonMode
+	});
 	projects.track(resolved.workflowsDir);
 	const client = requireClient(ctx);
 	await assertProjectConfigMatchesAuthenticatedOrg(client, { organizationId: resolved.organizationId });
@@ -28,9 +34,9 @@ async function handleWorkflowsDiff(options, ctx) {
 		throwReportedCliExit("This project has no current deployment.");
 	}
 	if (deploymentLookup.status === "missingWorkflow") {
-		ui.error(`Workflow "${options.workflow}" is not part of the current deployment.`);
+		ui.error(`Workflow "${resolved.authoredWorkflowId}" is not part of the current deployment.`);
 		ui.hint("Run `keystroke deploy` to include it in the current deployment, then try again.");
-		throwReportedCliExit(`Workflow "${options.workflow}" is not part of the current deployment.`);
+		throwReportedCliExit(`Workflow "${resolved.authoredWorkflowId}" is not part of the current deployment.`);
 	}
 	const diff = computeWorkflowDiff(resolved.manifest, deploymentLookup.workflow.manifest, {
 		workflowName: resolved.manifest.name,

package/dist/{dist-Dw7gCE7y.mjs → dist-B5jy238v.mjs}

@@ -4,6 +4,7 @@ import { n as getKeystrokeBaseDir, t as KEYSTROKE_DIR } from "./paths-DpHfoaXN-C
 import * as path$1 from "node:path";
 import * as os from "node:os";
 import * as fs from "node:fs/promises";
+import { realpath } from "node:fs/promises";
 import { z } from "zod";
 //#region ../../packages/local-memory/dist/index.mjs
 /**
@@ -518,6 +519,29 @@ const PROJECTS_DEFAULTS = {
 	version: PROJECTS_VERSION,
 	projects: {}
 };
+/** Resolve symlinks (e.g. macOS `/tmp` → `/private/tmp`) so aliases share one cache key. */
+async function normalizeProjectPath(projectPath) {
+	const resolved = path$1.resolve(projectPath);
+	try {
+		return await realpath(resolved);
+	} catch {
+		return resolved;
+	}
+}
+async function resolveProjectPaths(projectPath) {
+	return {
+		resolvedInput: path$1.resolve(projectPath),
+		canonicalPath: await normalizeProjectPath(projectPath)
+	};
+}
+function findStoredProjectKey(storedProjects, paths) {
+	if (paths.canonicalPath in storedProjects) return paths.canonicalPath;
+	if (paths.resolvedInput !== paths.canonicalPath && paths.resolvedInput in storedProjects) return paths.resolvedInput;
+}
+function readStoredProjectEntry(storedProjects, paths) {
+	const key = findStoredProjectKey(storedProjects, paths);
+	return key ? storedProjects[key] : void 0;
+}
 /**
 * Domain controller for tracked Keystroke projects.
 *
@@ -549,21 +573,21 @@ var Projects = class {
 	* up to a CLI command and degrade UX.
 	*/
 	async track(projectPath, options) {
-		const absolutePath = path$1.resolve(projectPath);
+		const paths = await resolveProjectPaths(projectPath);
 		try {
 			await this.store.update((data) => {
-				const previous = data.projects[absolutePath];
+				const previous = readStoredProjectEntry(data.projects, paths);
 				const entry = {
 					lastAccessed: (/* @__PURE__ */ new Date()).toISOString(),
 					...options?.name ? { name: options.name } : previous?.name ? { name: previous.name } : {}
 				};
+				const nextProjects = { ...data.projects };
+				if (paths.resolvedInput !== paths.canonicalPath && paths.resolvedInput in nextProjects) delete nextProjects[paths.resolvedInput];
+				nextProjects[paths.canonicalPath] = entry;
 				return {
 					...data,
-					projects: {
-						...data.projects,
-						[absolutePath]: entry
-					},
-					lastProject: absolutePath
+					projects: nextProjects,
+					lastProject: paths.canonicalPath
 				};
 			});
 		} catch {}
@@ -574,11 +598,13 @@ var Projects = class {
 	* explicit user action; the caller should know if it failed).
 	*/
 	async untrack(projectPath) {
-		const absolutePath = path$1.resolve(projectPath);
+		const paths = await resolveProjectPaths(projectPath);
 		const existing = await this.store.read();
-		if (!existing || !(absolutePath in existing.projects)) return false;
-		const { [absolutePath]: _removed, ...remaining } = existing.projects;
-		const newLastProject = existing.lastProject === absolutePath ? void 0 : existing.lastProject;
+		if (!existing) return false;
+		const trackedKey = findStoredProjectKey(existing.projects, paths);
+		if (!trackedKey) return false;
+		const { [trackedKey]: _removed, ...remaining } = existing.projects;
+		const newLastProject = existing.lastProject === trackedKey || existing.lastProject === paths.resolvedInput ? void 0 : existing.lastProject;
 		await this.store.write({
 			...existing,
 			projects: remaining,