@keystrokehq/cli 0.1.113 → 0.1.115

package/dist/index.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as CredentialInstanceListResponseSchema, $n as WorkflowCanvasRunSchema, $t as PresignOrgLogoResponseSchema, A as ConnectAuthorizeUrlResponseSchema, An as TriggerListResponseSchema, Ar as slugifyAppName, At as ListCredentialsPageQuerySchema, B as CreateCustomAppRequestSchema, Bn as UpdateOrganizationRequestSchema, Bt as ListProjectMetricsResponseSchema, C as ChannelAccountListResponseSchema, Cn as StartOAuthConnectionInputSchema, Cr as parseAppSlug, Ct as InviteProjectMembersResponseSchema, D as CompleteProjectArtifactResponseSchema, Dn as TriggerDetailResponseSchema, Dr as resolveConnectAppSlug, Dt as ListApiKeysResponseSchema, E as ChannelDirectoryListResponseSchema, En as SubmitTeamRequestRequestSchema, Et as ListAgentWorkspaceFilesResponseSchema, F as CreateBillingPortalRequestSchema, Fn as UpdateCredentialInstanceBodySchema, Ft as ListOrganizationMembersPageResponseSchema, G as CreateProjectRequestSchema, Gn as UploadProjectSourceManifestRequestSchema, Gt as OpenApiDiscoverResponseSchema, H as CreateOrganizationRequestSchema, Hn as UpdateProjectMemberResponseSchema, Ht as ManagedServiceCredentialSchema, I as CreateCredentialInstanceBodySchema, In as UpdateCredentialRequestSchema, It as ListOrganizationsResponseSchema, J as CredentialAssignmentListQuerySchema, Jn as UserAvatarPatchSchema, Jt as PROJECT_PULL_STATE_RELATIVE_PATH, K as CreateProjectResponseSchema, Kn as UploadProjectSourceResponseSchema, Kt as OrganizationSidebarBrandingPatchSchema, L as CreateCredentialsRequestSchema, Ln as UpdateManagedServiceCredentialRequestSchema, Lt as ListProjectDeploymentsResponseSchema, M as ConnectProvidersResponseSchema, Mn as TriggerRunListResponseSchema, Mt as ListManagedServiceCredentialsResponseSchema, N as CreateApiKeyRequestSchema, Nn as UpdateAutoTopupRequestSchema, Nt as ListOrganizationInvitationsResponseSchema, O as ConfirmCheckoutRequestSchema, On as TriggerInvokeInputsSchema, Or as resolveDocsMcpUrl, Ot as ListAppsResponseSchema, P as CreateApiKeyResponseSchema, Pn as UpdateChannelBindingBodySchema, Pt as ListOrganizationMembersPageQuerySchema, Q as CredentialConsumerListResponseSchema, Qn as WorkflowCanvasCredentialBindingsSchema, Qt as PresignOrgLogoRequestSchema, R as CreateCredentialsResponseSchema, Rn as UpdateOrganizationMemberRequestSchema, Rt as ListProjectFilesResponseSchema, S as CatalogAppsPageResponseSchema, Sn as StartMcpOAuthConnectionResultSchema, St as InviteProjectMembersRequestSchema, T as ChannelConnectionSchema, Tn as SubmitMarketingContactRequestSchema, Tt as ListAgentMemoryFilesResponseSchema, U as CreateOrganizationResponseSchema, Un as UpdateProjectRequestSchema, Ut as ManagedServiceKindSchema, V as CreateCustomAppResponseSchema, Vn as UpdateProjectMemberRequestSchema, Vt as ListProjectsResponseSchema, W as CreateProjectArtifactResponseSchema, Wn as UpdateProjectSettingsRequestSchema, Wt as McpDiscoverResponseSchema, X as CredentialAssignmentRecordSchema, Xn as UserPreferencesPatchSchema, Xt as PresignChatAttachmentRequestSchema, Y as CredentialAssignmentListResponseSchema, Yn as UserAvatarSchema, Yt as PROJECT_REACHABILITY_REQUEST_TIMEOUT_MS, Z as CredentialConsumerListQuerySchema, Zn as UserPreferencesSchema, Zt as PresignChatAttachmentResponseSchema, _ as BindChannelBodySchema, _n as SkillSummaryListResponseSchema, _r as deriveCustomAppDisplay, _t as HistoryRunDetailResponseSchema, a as AgentSessionListResponseSchema, an as ProjectReachabilityResponseSchema, ar as WorkflowRunListResponseSchema, at as DownloadActiveProjectArtifactResponseSchema, b as CatalogActionsPageResponseSchema, bn as StartKeystrokeConnectionResultSchema, br as listenPortFromPublicUrl, bt as InviteOrganizationMembersRequestSchema, c as AgentTriggerSummaryListResponseSchema, cn as ProjectSlugAvailabilityResponseSchema, cr as WorkflowSummaryListResponseSchema, ct as ExecuteKeystrokeToolRequestSchema, d as AutoTopupSummarySchema, dr as WorkspaceTriggerListResponseSchema, dt as GetAppCatalogEntryResponseSchema, en as PresignProjectSourceRequestSchema, er as WorkflowCanvasSchema, et as CredentialInstanceRecordSchema, f as BillingActivityResponseSchema, fn as QueuedAgentPromptResponseSchema, fr as WorkspaceTriggerOverviewSchema, ft as GetCredentialResponseSchema, g as BillingUsageResponseSchema, gn as SkillSummaryDetailResponseSchema, gt as HistoryRunCancelResponseSchema, h as BillingSummaryResponseSchema, hn as RecentResourceListResponseSchema, hr as buildConnectDeeplink, ht as HealthResponseSchema, i as AgentSessionDetailResponseSchema, in as ProjectPullStateSchema, ir as WorkflowRunInputsSchema, it as DeclineOrganizationInvitationResponseSchema, j as ConnectManagedServiceCredentialRequestSchema, jn as TriggerRunDetailResponseSchema, jt as ListCredentialsPageResponseSchema, k as ConfirmCheckoutResponseSchema, kn as TriggerInvokeResponseSchema, kr as resolvePublicPlatformOrigin, kt as ListChannelPlatformsResponseSchema, l as AppSlugAvailabilityResponseSchema, ln as PromptInputSchema, lr as WorkspaceTriggerDetailSchema, m as BillingRedirectResponseSchema, mr as WorkspaceWorkflowOverviewSchema, mt as GraphqlDiscoverResponseSchema, n as AcceptOrganizationInvitationResponseSchema, nn as PresignUserAvatarRequestSchema, nr as WorkflowRunHooksResponseSchema, nt as DOCS_QUERY_TOOL, o as AgentSummaryDetailResponseSchema, on as ProjectResponseSchema, or as WorkflowRunResponseSchema, ot as DownloadActiveProjectSourceResponseSchema, p as BillingInvoiceUrlResponseSchema, pn as QueuedRunResponseSchema, pr as WorkspaceTriggerRunListResponseSchema, pt as GetCustomAppResponseSchema, q as CreateSubscriptionCheckoutRequestSchema, qn as UpsertGatewayAttachmentBodySchema, qt as OrganizationSidebarBrandingSchema, r as ActiveOrganizationResponseSchema, rn as PresignUserAvatarResponseSchema, rr as WorkflowRunInputsPutBodySchema, rt as DOCS_SEARCH_TOOL, s as AgentSummaryListResponseSchema, sn as ProjectSettingsResponseSchema, sr as WorkflowSummaryDetailResponseSchema, st as ErrorResponseSchema, t as ACTIVE_ORG_HEADER, tn as PresignProjectSourceResponseSchema, tr as WorkflowRunDetailResponseSchema, u as AssignCredentialBodySchema, un as PromptResponseSchema, ur as WorkspaceTriggerFileSchema, ut as GatewayAttachmentRecordSchema, v as CLIENT_CHANNEL_HEADER, vn as SlugAvailabilityResponseSchema, vr as detectProjectPackageManagerFromSnapshot, vt as HistoryRunListQuerySchema, w as ChannelConnectionListResponseSchema, wn as StartOAuthConnectionResultSchema, wr as parseErrorResponse, x as CatalogAppDetailResponseSchema, xn as StartMcpOAuthConnectionInputSchema, xt as InviteOrganizationMembersResponseSchema, y as CatalogActionDetailResponseSchema, yn as StartKeystrokeConnectionInputSchema, yr as isAcceptableInstallExit, yt as HistoryRunListResponseSchema, z as CreateCreditsCheckoutRequestSchema, zn as UpdateOrganizationMemberResponseSchema, zt as ListProjectMembersResponseSchema } from "./dist-BoZPZ9Sz.mjs";
-import { a as alias, c as event, i as packProjectArtifact, l as flushTelemetry, n as withMcpReadClient, o as captureException, r as mergeFilteredArtifact, s as configureTelemetry, t as mapInParallelBatches, u as shutdownTelemetry } from "./dist-De18Uq1U.mjs";
-import { C as getWebUrl, E as resolvePlatformUrlForWebUrl, S as getPlatformUrl, _ as resolveCliRoot, a as formatReleaseAgeBlockMessage, b as getConfigDir, c as detectManagerFromLockfile, d as installDependencies$1, f as installPlaygroundDependencies, g as readCliVersion, h as isNewerVersion, i as fetchLatestCliRelease, l as buildPlaygroundWorkspace, m as resolvePackageManager, n as computeReleaseAgeRetryAfter, o as isReleaseAgeBlock, p as resolveGithubPackagesToken, r as readPnpmMinimumReleaseAgeMinutes, s as detectCliInstall, t as runPackageManagerUpdate, u as detectPackageManager, v as createCliConfig, w as DEFAULT_PLATFORM_URL, x as getEffectiveApiTarget, y as getCliConfigDir } from "./run-package-manager-update-D_jU5wZe.mjs";
+import { $ as CredentialInstanceListResponseSchema, $n as UserPreferencesSchema, $t as PresignChatAttachmentResponseSchema, A as ConnectAuthorizeUrlResponseSchema, An as TriggerInvokeInputsSchema, Ar as resolveDocsMcpUrl, At as ListAppsResponseSchema, B as CreateCustomAppRequestSchema, Bn as UpdateOrganizationMemberRequestSchema, Bt as ListProjectFilesResponseSchema, C as ChannelAccountListResponseSchema, Cn as StartMcpOAuthConnectionInputSchema, Ct as InviteOrganizationMembersResponseSchema, D as CompleteProjectArtifactResponseSchema, Dn as SubmitMarketingContactRequestSchema, Dt as ListAgentMemoryFilesResponseSchema, E as ChannelDirectoryListResponseSchema, En as StartOAuthConnectionResultSchema, Er as parseErrorResponse, F as CreateBillingPortalRequestSchema, Fn as UpdateAutoTopupRequestSchema, Ft as ListOrganizationInvitationsResponseSchema, G as CreateProjectRequestSchema, Gn as UpdateProjectRequestSchema, Gt as ManagedServiceKindSchema, H as CreateOrganizationRequestSchema, Hn as UpdateOrganizationRequestSchema, Ht as ListProjectMetricsResponseSchema, I as CreateCredentialInstanceBodySchema, In as UpdateChannelBindingBodySchema, It as ListOrganizationMembersPageQuerySchema, J as CredentialAssignmentListQuerySchema, Jn as UploadProjectSourceResponseSchema, Jt as OrganizationSidebarBrandingPatchSchema, K as CreateProjectResponseSchema, Kn as UpdateProjectSettingsRequestSchema, Kt as McpDiscoverResponseSchema, L as CreateCredentialsRequestSchema, Ln as UpdateCredentialInstanceBodySchema, Lt as ListOrganizationMembersPageResponseSchema, M as ConnectProvidersResponseSchema, Mn as TriggerListResponseSchema, Mr as slugifyAppName, Mt as ListCredentialsPageQuerySchema, N as CreateApiKeyRequestSchema, Nn as TriggerRunDetailResponseSchema, Nt as ListCredentialsPageResponseSchema, O as ConfirmCheckoutRequestSchema, On as SubmitTeamRequestRequestSchema, Ot as ListAgentWorkspaceFilesResponseSchema, P as CreateApiKeyResponseSchema, Pn as TriggerRunListResponseSchema, Pt as ListManagedServiceCredentialsResponseSchema, Q as CredentialConsumerListResponseSchema, Qn as UserPreferencesPatchSchema, Qt as PresignChatAttachmentRequestSchema, R as CreateCredentialsResponseSchema, Rn as UpdateCredentialRequestSchema, Rt as ListOrganizationsResponseSchema, S as CatalogAppsPageResponseSchema, Sn as StartKeystrokeConnectionResultSchema, Sr as listenPortFromPublicUrl, St as InviteOrganizationMembersRequestSchema, T as ChannelConnectionSchema, Tn as StartOAuthConnectionInputSchema, Tr as parseAppSlug, Tt as InviteProjectMembersResponseSchema, U as CreateOrganizationResponseSchema, Un as UpdateProjectMemberRequestSchema, Ut as ListProjectsResponseSchema, V as CreateCustomAppResponseSchema, Vn as UpdateOrganizationMemberResponseSchema, Vt as ListProjectMembersResponseSchema, W as CreateProjectArtifactResponseSchema, Wn as UpdateProjectMemberResponseSchema, Wt as ManagedServiceCredentialSchema, X as CredentialAssignmentRecordSchema, Xn as UserAvatarPatchSchema, Xt as PROJECT_PULL_STATE_RELATIVE_PATH, Y as CredentialAssignmentListResponseSchema, Yn as UpsertGatewayAttachmentBodySchema, Yt as OrganizationSidebarBrandingSchema, Z as CredentialConsumerListQuerySchema, Zn as UserAvatarSchema, Zt as PROJECT_REACHABILITY_REQUEST_TIMEOUT_MS, _ as BindChannelBodySchema, _n as RecentResourceListResponseSchema, _r as buildConnectDeeplink, _t as HealthResponseSchema, a as AgentSessionListResponseSchema, an as PresignUserAvatarResponseSchema, ar as WorkflowRunInputsPutBodySchema, at as DownloadActiveProjectArtifactResponseSchema, b as CatalogActionsPageResponseSchema, bn as SlugAvailabilityResponseSchema, br as detectProjectPackageManagerFromSnapshot, bt as HistoryRunListQuerySchema, c as AgentTriggerSummaryListResponseSchema, cn as ProjectResponseSchema, cr as WorkflowRunResponseSchema, ct as DuplicateCredentialsResponseSchema, d as AutoTopupSummarySchema, dn as PromptInputSchema, dr as WorkspaceTriggerDetailSchema, en as PresignOrgLogoRequestSchema, er as WorkflowCanvasCredentialBindingsSchema, et as CredentialInstanceRecordSchema, f as BillingActivityResponseSchema, fn as PromptResponseSchema, fr as WorkspaceTriggerFileSchema, ft as GatewayAttachmentRecordSchema, g as BillingUsageResponseSchema, gr as WorkspaceWorkflowOverviewSchema, gt as GraphqlDiscoverResponseSchema, h as BillingSummaryResponseSchema, hn as QueuedRunResponseSchema, hr as WorkspaceTriggerRunListResponseSchema, ht as GetCustomAppResponseSchema, i as AgentSessionDetailResponseSchema, in as PresignUserAvatarRequestSchema, ir as WorkflowRunHooksResponseSchema, it as DeclineOrganizationInvitationResponseSchema, j as ConnectManagedServiceCredentialRequestSchema, jn as TriggerInvokeResponseSchema, jr as resolvePublicPlatformOrigin, jt as ListChannelPlatformsResponseSchema, k as ConfirmCheckoutResponseSchema, kn as TriggerDetailResponseSchema, kr as resolveConnectAppSlug, kt as ListApiKeysResponseSchema, l as AppSlugAvailabilityResponseSchema, ln as ProjectSettingsResponseSchema, lr as WorkflowSummaryDetailResponseSchema, lt as ErrorResponseSchema, m as BillingRedirectResponseSchema, mn as QueuedAgentPromptResponseSchema, mr as WorkspaceTriggerOverviewSchema, mt as GetCredentialResponseSchema, n as AcceptOrganizationInvitationResponseSchema, nn as PresignProjectSourceRequestSchema, nr as WorkflowCanvasSchema, nt as DOCS_QUERY_TOOL, o as AgentSummaryDetailResponseSchema, on as ProjectPullStateSchema, or as WorkflowRunInputsSchema, ot as DownloadActiveProjectSourceResponseSchema, p as BillingInvoiceUrlResponseSchema, pr as WorkspaceTriggerListResponseSchema, pt as GetAppCatalogEntryResponseSchema, q as CreateSubscriptionCheckoutRequestSchema, qn as UploadProjectSourceManifestRequestSchema, qt as OpenApiDiscoverResponseSchema, r as ActiveOrganizationResponseSchema, rn as PresignProjectSourceResponseSchema, rr as WorkflowRunDetailResponseSchema, rt as DOCS_SEARCH_TOOL, s as AgentSummaryListResponseSchema, sn as ProjectReachabilityResponseSchema, sr as WorkflowRunListResponseSchema, st as DuplicateCredentialRequestSchema, t as ACTIVE_ORG_HEADER, tn as PresignOrgLogoResponseSchema, tr as WorkflowCanvasRunSchema, u as AssignCredentialBodySchema, un as ProjectSlugAvailabilityResponseSchema, ur as WorkflowSummaryListResponseSchema, ut as ExecuteKeystrokeToolRequestSchema, v as CLIENT_CHANNEL_HEADER, vn as SkillSummaryDetailResponseSchema, vt as HistoryRunCancelResponseSchema, w as ChannelConnectionListResponseSchema, wn as StartMcpOAuthConnectionResultSchema, wt as InviteProjectMembersRequestSchema, x as CatalogAppDetailResponseSchema, xn as StartKeystrokeConnectionInputSchema, xr as isAcceptableInstallExit, xt as HistoryRunListResponseSchema, y as CatalogActionDetailResponseSchema, yn as SkillSummaryListResponseSchema, yr as deriveCustomAppDisplay, yt as HistoryRunDetailResponseSchema, z as CreateCreditsCheckoutRequestSchema, zn as UpdateManagedServiceCredentialRequestSchema, zt as ListProjectDeploymentsResponseSchema } from "./dist-D9wyqCGM.mjs";
+import { a as alias, c as event, i as packProjectArtifact, l as flushTelemetry, n as withMcpReadClient, o as captureException, r as mergeFilteredArtifact, s as configureTelemetry, t as mapInParallelBatches, u as shutdownTelemetry } from "./dist-gIiA66FZ.mjs";
+import { C as getWebUrl, E as resolvePlatformUrlForWebUrl, S as getPlatformUrl, _ as resolveCliRoot, a as formatReleaseAgeBlockMessage, b as getConfigDir, c as detectManagerFromLockfile, d as installDependencies$1, f as installPlaygroundDependencies, g as readCliVersion, h as isNewerVersion, i as fetchLatestCliRelease, l as buildPlaygroundWorkspace, m as resolvePackageManager, n as computeReleaseAgeRetryAfter, o as isReleaseAgeBlock, p as resolveGithubPackagesToken, r as readPnpmMinimumReleaseAgeMinutes, s as detectCliInstall, t as runPackageManagerUpdate, u as detectPackageManager, v as createCliConfig, w as DEFAULT_PLATFORM_URL, x as getEffectiveApiTarget, y as getCliConfigDir } from "./run-package-manager-update-BvOJBqBB.mjs";
 import { createRequire } from "node:module";
 import { Command } from "commander";
 import { platform, release } from "node:os";
@@ -4334,6 +4334,15 @@ function createCredentialsResource(http) {
 				throw await toPlatformError(error);
 			}
 		},
+		async duplicate(credentialId, input) {
+			const body = DuplicateCredentialRequestSchema.parse(input);
+			try {
+				const data = await http.post(`/api/credentials/${encodeURIComponent(credentialId)}/duplicate`, { json: body }).json();
+				return DuplicateCredentialsResponseSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
 		async delete(credentialId) {
 			try {
 				await http.delete(`/api/credentials/${encodeURIComponent(credentialId)}`);
@@ -6406,7 +6415,7 @@ function parseCustomAppFields(flags) {
 	if (!Object.values(fields).some((field) => field.optional !== true)) throw new Error("At least one --field must be required (omit :optional)");
 	return fields;
 }
-function collectValues$1(value, previous) {
+function collectValues$3(value, previous) {
 	return [...previous, value];
 }
 //#endregion
@@ -6492,7 +6501,7 @@ function parseFieldOverrides(flags) {
 	return parseCustomAppFields(flags);
 }
 function registerAppCreateCommand(app) {
-	app.command("create").description("Create a custom org app").option("--name <name>", "App display name").option("--slug <slug>", "App slug segment (defaults from name)").option("--description <description>", "App description (defaults to --name)").option("--field <field>", "Credential field as key, key:secret, key:optional, or key:secret:optional (repeatable)", collectValues$1, []).option("--mcp <url>", "Create from an MCP server URL (auto-detect auth)").option("--openapi <url>", "Create from an OpenAPI spec URL (auto-detect auth)").option("--graphql <url>", "Create from a GraphQL endpoint URL (auto-detect auth)").option("--auth <kind>", "Override detected auth: oauth or api_key (MCP only)").option("--preview", "Show the request that would be created without creating").action((options) => runCliCommand("Create app failed", async () => {
+	app.command("create").description("Create a custom org app").option("--name <name>", "App display name").option("--slug <slug>", "App slug segment (defaults from name)").option("--description <description>", "App description (defaults to --name)").option("--field <field>", "Credential field as key, key:secret, key:optional, or key:secret:optional (repeatable)", collectValues$3, []).option("--mcp <url>", "Create from an MCP server URL (auto-detect auth)").option("--openapi <url>", "Create from an OpenAPI spec URL (auto-detect auth)").option("--graphql <url>", "Create from a GraphQL endpoint URL (auto-detect auth)").option("--auth <kind>", "Override detected auth: oauth or api_key (MCP only)").option("--preview", "Show the request that would be created without creating").action((options) => runCliCommand("Create app failed", async () => {
 		const config = createCliConfig();
 		const client = createCliPlatformClient(config);
 		await resolveActiveOrganization(config);
@@ -6899,7 +6908,9 @@ function buildPlatformUpdatePatch(args) {
 	return {
 		...args.label !== void 0 ? { label: args.label } : {},
 		...args.isDefault !== void 0 ? { isDefault: args.isDefault } : {},
-		...args.value ? { value: args.value } : {}
+		...args.value ? { value: args.value } : {},
+		...args.scope !== void 0 ? { scope: args.scope } : {},
+		...args.projectSlug !== void 0 ? { projectSlug: args.projectSlug } : {}
 	};
 }
 //#endregion
@@ -6915,6 +6926,47 @@ function registerCredentialsDeleteCommand(credentials) {
 	}));
 }
 //#endregion
+//#region src/commands/connect/parse-connect-scopes.ts
+function parseConnectScopes(scopes, projectSlugs) {
+	const normalized = scopes.length > 0 ? scopes : ["org"];
+	for (const scope of normalized) if (scope !== "org" && scope !== "user" && scope !== "project") throw new Error(`Unknown scope "${scope}". Expected org, user, or project.`);
+	const createOrganizationCredential = normalized.includes("org");
+	const createUserProvidedCredential = normalized.includes("user");
+	const includesProject = normalized.includes("project");
+	const selectedProjects = includesProject ? projectSlugs : [];
+	if (includesProject && selectedProjects.length === 0) throw new Error("--project-slug is required when scope includes project");
+	if (!createOrganizationCredential && !createUserProvidedCredential && selectedProjects.length === 0) throw new Error("At least one scope is required via --scope and/or --project-slug");
+	return {
+		createOrganizationCredential,
+		createUserProvidedCredential,
+		projects: selectedProjects
+	};
+}
+//#endregion
+//#region src/commands/credentials/parse-set-scopes.ts
+function parseCredentialSetScopes(scopes, projectSlugs) {
+	return parseConnectScopes(scopes, projectSlugs);
+}
+//#endregion
+//#region src/commands/credentials/duplicate.ts
+function registerCredentialsDuplicateCommand(credentials) {
+	credentials.command("duplicate").description("Duplicate a credential into one or more scopes").argument("<ref>", "Credential slug or id").option("--name <name>", "Display name for the copy").option("--label <label>", "Alias for --name").option("--scope <scope>", "org, user, or project (repeatable)", collectValues$2, []).option("--project-slug <slug>", "Project slug when scope includes project (repeatable)", collectValues$2, []).action((ref, options) => runCredentialsCommand("Duplicate credential failed", async ({ platform, local }) => {
+		if (local) throw new Error("Duplicate is only supported for platform credentials");
+		const targets = parseCredentialSetScopes(options.scope, options.projectSlug);
+		const displayName = options.name ?? options.label;
+		const credentials = await platform.credentials.duplicate(ref, {
+			projects: targets.projects,
+			createOrganizationCredential: targets.createOrganizationCredential,
+			createUserProvidedCredential: targets.createUserProvidedCredential,
+			...displayName !== void 0 ? { label: displayName } : {}
+		});
+		process.stdout.write(`${JSON.stringify({ credentials }, null, 2)}\n`);
+	}));
+}
+function collectValues$2(value, previous) {
+	return previous.concat([value]);
+}
+//#endregion
 //#region src/commands/credentials/get.ts
 function registerCredentialsGetCommand(credentials) {
 	credentials.command("get").description("Get a credential instance by id").argument("<id>", "Credential instance id").action((id) => runCredentialsCommand("Get credential failed", async ({ platform, local }) => {
@@ -7043,31 +7095,9 @@ async function assertNoSetConflict(client, args) {
 	}));
 }
 //#endregion
-//#region src/commands/connect/parse-connect-scopes.ts
-function parseConnectScopes(scopes, projectSlugs) {
-	const normalized = scopes.length > 0 ? scopes : ["org"];
-	for (const scope of normalized) if (scope !== "org" && scope !== "user" && scope !== "project") throw new Error(`Unknown scope "${scope}". Expected org, user, or project.`);
-	const createOrganizationCredential = normalized.includes("org");
-	const createUserProvidedCredential = normalized.includes("user");
-	const includesProject = normalized.includes("project");
-	const selectedProjects = includesProject ? projectSlugs : [];
-	if (includesProject && selectedProjects.length === 0) throw new Error("--project-slug is required when scope includes project");
-	if (!createOrganizationCredential && !createUserProvidedCredential && selectedProjects.length === 0) throw new Error("At least one scope is required via --scope and/or --project-slug");
-	return {
-		createOrganizationCredential,
-		createUserProvidedCredential,
-		projects: selectedProjects
-	};
-}
-//#endregion
-//#region src/commands/credentials/parse-set-scopes.ts
-function parseCredentialSetScopes(scopes, projectSlugs) {
-	return parseConnectScopes(scopes, projectSlugs);
-}
-//#endregion
 //#region src/commands/credentials/set.ts
 function registerCredentialsCreateCommand(credentials) {
-	credentials.command("create").description("Create a new api_key credential instance").argument("<key>", "Credential key or app id, e.g. exa").option("--scope <scope>", "org, user, or project (repeatable)", collectValues, []).option("--project-slug <slug>", "Project slug when scope includes project (repeatable)", collectValues, []).option("--slug <slug>", "Friendly credential slug within the scope").option("--name <name>", "Display name (used to derive slug when --slug is omitted)").option("--label <label>", "Alias for --name").option("--default", "Mark as default for this scope").option("--set <field>", "Credential field as key=value or key=@env:VAR (falls back to project .env when unset in shell)", collectSetValues$1, []).action((key, options) => runCredentialsCommand("Set credential failed", async ({ platform, local }) => {
+	credentials.command("create").description("Create a new api_key credential instance").argument("<key>", "Credential key or app id, e.g. exa").option("--scope <scope>", "org, user, or project (repeatable)", collectValues$1, []).option("--project-slug <slug>", "Project slug when scope includes project (repeatable)", collectValues$1, []).option("--slug <slug>", "Friendly credential slug within the scope").option("--name <name>", "Display name (used to derive slug when --slug is omitted)").option("--label <label>", "Alias for --name").option("--default", "Mark as default for this scope").option("--set <field>", "Credential field as key=value or key=@env:VAR (falls back to project .env when unset in shell)", collectSetValues$1, []).action((key, options) => runCredentialsCommand("Set credential failed", async ({ platform, local }) => {
 		const value = parseCredentialValueFields(options.set);
 		const parsedScopes = parseCredentialSetScopes(options.scope, options.projectSlug);
 		if (local) {
@@ -7119,7 +7149,7 @@ function registerCredentialsCreateCommand(credentials) {
 		process.stdout.write(`${JSON.stringify({ credentials: created }, null, 2)}\n`);
 	})).alias("set");
 }
-function collectValues(value, previous) {
+function collectValues$1(value, previous) {
 	return previous.concat([value]);
 }
 function collectSetValues$1(value, previous) {
@@ -7143,12 +7173,32 @@ function expandLocalCredentialTargets(targets) {
 	return expanded;
 }
 //#endregion
+//#region src/commands/credentials/parse-update-scope.ts
+/** Parse a single destination scope for `credentials update --scope`. */
+function parseCredentialUpdateScope(scopes, projectSlugs) {
+	if (scopes.length === 0) return;
+	if (scopes.length > 1) throw new Error("Scope swap accepts a single --scope value (org, user, or project)");
+	const scope = scopes[0];
+	if (scope !== "org" && scope !== "user" && scope !== "project") throw new Error(`Unknown scope "${scope}". Expected org, user, or project.`);
+	if (scope === "project") {
+		if (projectSlugs.length !== 1) throw new Error("--project-slug is required exactly once when scope is project");
+		return {
+			scope: "project",
+			projectSlug: projectSlugs[0]
+		};
+	}
+	if (projectSlugs.length > 0) throw new Error("--project-slug is only valid when scope is project");
+	return { scope: scope === "org" ? "organization" : "user" };
+}
+//#endregion
 //#region src/commands/credentials/update.ts
 function registerCredentialsUpdateCommand(credentials) {
-	credentials.command("update").description("Update a credential instance").argument("<ref>", "Credential slug or id").option("--slug <slug>", "Update friendly slug").option("--name <name>", "Update display name").option("--label <label>", "Alias for --name").option("--default", "Mark as default for this scope").option("--set <field>", "Credential field as key=value or key=@env:VAR", collectSetValues, []).action((ref, options) => runCredentialsCommand("Update credential failed", async ({ platform, local }) => {
+	credentials.command("update").description("Update a credential instance").argument("<ref>", "Credential slug or id").option("--slug <slug>", "Update friendly slug").option("--name <name>", "Update display name").option("--label <label>", "Alias for --name").option("--default", "Mark as default for this scope").option("--scope <scope>", "Move to org, user, or project scope", collectValues, []).option("--project-slug <slug>", "Project slug when --scope is project", collectValues, []).option("--set <field>", "Credential field as key=value or key=@env:VAR", collectSetValues, []).action((ref, options) => runCredentialsCommand("Update credential failed", async ({ platform, local }) => {
 		const value = options.set.length > 0 ? parseCredentialValueFields(options.set) : void 0;
 		const displayName = options.name ?? options.label;
+		const scopeTarget = parseCredentialUpdateScope(options.scope, options.projectSlug);
 		if (local) {
+			if (scopeTarget) throw new Error("Scope swap is only supported for platform credentials");
 			const { client } = await createLocalCredentialsClient();
 			const result = await client.credentials.updateInstance(ref, {
 				...options.slug !== void 0 ? { slug: options.slug } : {},
@@ -7162,7 +7212,11 @@ function registerCredentialsUpdateCommand(credentials) {
 		const patch = buildPlatformUpdatePatch({
 			...displayName !== void 0 ? { label: displayName } : {},
 			...options.default !== void 0 ? { isDefault: options.default } : {},
-			...value ? { value } : {}
+			...value ? { value } : {},
+			...scopeTarget ? {
+				scope: scopeTarget.scope,
+				...scopeTarget.projectSlug !== void 0 ? { projectSlug: scopeTarget.projectSlug } : {}
+			} : {}
 		});
 		const credential = await platform.credentials.update(ref, patch);
 		process.stdout.write(`${JSON.stringify({ credential }, null, 2)}\n`);
@@ -7171,6 +7225,9 @@ function registerCredentialsUpdateCommand(credentials) {
 function collectSetValues(value, previous) {
 	return previous.concat([value]);
 }
+function collectValues(value, previous) {
+	return previous.concat([value]);
+}
 //#endregion
 //#region src/commands/credentials/index.ts
 function registerCredentialsCommand(program) {
@@ -7179,6 +7236,7 @@ function registerCredentialsCommand(program) {
 	registerCredentialsGetCommand(credentials);
 	registerCredentialsCreateCommand(credentials);
 	registerCredentialsUpdateCommand(credentials);
+	registerCredentialsDuplicateCommand(credentials);
 	registerCredentialsRotateCommand(credentials);
 	registerCredentialsDeleteCommand(credentials);
 	registerCredentialsAssignmentsCommands(credentials);
@@ -7393,7 +7451,7 @@ function registerBuildCommand(program) {
 		try {
 			const root = resolveProjectRoot(options.dir);
 			await ensureSdkCurrent(root);
-			const { buildApp } = await import("./dist-yDNd8kGO.mjs");
+			const { buildApp } = await import("./dist-GJJ5OG1V.mjs");
 			await buildApp({ root });
 			process.stdout.write(`Built ${root}\n`);
 		} catch (error) {
@@ -7518,7 +7576,7 @@ async function sleep(ms) {
 }
 async function buildDeployArchive(client, root, projectId, filter) {
 	if (filter?.length) {
-		const { buildFilteredApp } = await import("./dist-yDNd8kGO.mjs");
+		const { buildFilteredApp } = await import("./dist-GJJ5OG1V.mjs");
 		const filtered = await buildFilteredApp({
 			root,
 			filter,
@@ -7540,7 +7598,7 @@ async function buildDeployArchive(client, root, projectId, filter) {
 			sourceFiles: filtered.sourceFiles
 		};
 	}
-	const { buildApp } = await import("./dist-yDNd8kGO.mjs");
+	const { buildApp } = await import("./dist-GJJ5OG1V.mjs");
 	const { sourceFiles } = await buildApp({
 		root,
 		collectSources: true,
@@ -7667,7 +7725,7 @@ function runtimeChildEnv(parentEnv, overrides) {
 //#region src/project/bootstrap-run.ts
 /** Node args + env for `@keystrokehq/build` bootstrap (shared by start + dev). */
 async function resolveBootstrapRun(options) {
-	const { resolveRuntimeBuildArtifact } = await import("./dist-yDNd8kGO.mjs");
+	const { resolveRuntimeBuildArtifact } = await import("./dist-GJJ5OG1V.mjs");
 	const loader = pathToFileURL(resolveRuntimeBuildArtifact(options.runtimeNodeModules, "dist/runtime-loader.mjs")).href;
 	const bootstrap = resolveRuntimeBuildArtifact(options.runtimeNodeModules, "dist/standalone-bootstrap.mjs");
 	const args = [`--import=${loader}`];
@@ -7817,7 +7875,7 @@ async function runDev(options) {
 	process.on("SIGINT", shutdown);
 	process.on("SIGTERM", shutdown);
 	try {
-		const { watchApp } = await import("./dist-yDNd8kGO.mjs");
+		const { watchApp } = await import("./dist-GJJ5OG1V.mjs");
 		await watchApp({
 			root,
 			clean: false,
@@ -8879,7 +8937,7 @@ async function runStart(options) {
 	const apiPort = Number(new URL(serverUrl).port || 80);
 	const runtimeNodeModules = resolveCliRuntimeNodeModules(resolveCliRoot(import.meta.url));
 	ensureNativeDeps(runtimeNodeModules);
-	const { buildApp } = await import("./dist-yDNd8kGO.mjs");
+	const { buildApp } = await import("./dist-GJJ5OG1V.mjs");
 	await buildApp({
 		root,
 		clean: false
@@ -9711,7 +9769,7 @@ function createProgram() {
 async function runCli(argv) {
 	initCliTelemetry();
 	try {
-		const { maybeAutoUpdate } = await import("./maybe-auto-update-C-HUlgKp.mjs");
+		const { maybeAutoUpdate } = await import("./maybe-auto-update-DHXEHwKF.mjs");
 		await maybeAutoUpdate(argv);
 		await createProgram().parseAsync(argv);
 	} finally {