@keystrokehq/cli 0.1.139 → 0.1.140

package/dist/{program-DMhbEvwF.mjs → program-CYtD52e1.mjs}

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
+import { A as isExpectedCliError, C as getPlatformUrl, D as resolvePlatformUrlForWebUrl, O as parseCredentialStorage, S as getEffectiveApiTarget, T as DEFAULT_PLATFORM_URL, _ as resolveCliRoot, a as formatReleaseAgeBlockMessage, b as getConfigDir, c as detectManagerFromLockfile, d as installDependencies$1, f as installPlaygroundDependencies, g as readCliVersion, h as isNewerVersion, i as fetchLatestCliRelease, k as ExpectedCliError, l as buildPlaygroundWorkspace, m as resolvePackageManager, n as computeReleaseAgeRetryAfter, o as isReleaseAgeBlock, p as resolveGithubPackagesToken, r as readPnpmMinimumReleaseAgeMinutes, s as detectCliInstall, t as runPackageManagerUpdate, u as detectPackageManager, v as createCliConfig, w as getWebUrl, x as getCredentialStorage, y as getCliConfigDir } from "./run-package-manager-update-DS5Xr8oA.mjs";
 import { $ as CredentialInstanceListResponseSchema, $n as UpdateOrganizationMemberRequestSchema, $t as OrganizationSidebarBrandingSchema, A as ConnectAuthorizeUrlResponseSchema, An as SkillSummaryListResponseSchema, Ar as WorkspaceTriggerRunListResponseSchema, At as ListAgentMemoryFilesResponseSchema, B as CreateCustomAppRequestSchema, Bn as SubmitTeamRequestRequestSchema, Br as parseAppSlug, Bt as ListOrganizationMembersPageResponseSchema, C as ChannelAccountListResponseSchema, Cn as PublishedFormListResponseSchema, Cr as WorkflowRunResponseSchema, Ct as HistoryRunListQuerySchema, D as CompleteProjectArtifactResponseSchema, Dr as WorkspaceTriggerFileSchema, Dt as InviteProjectMembersRequestSchema, E as ChannelDirectoryListResponseSchema, En as QueuedRunResponseSchema, Er as WorkspaceTriggerDetailSchema, Et as InviteOrganizationMembersResponseSchema, F as CreateBillingPortalRequestSchema, Fn as StartMcpOAuthConnectionResultSchema, Fr as detectProjectPackageManagerFromSnapshot, Ft as ListCredentialsPageQuerySchema, G as CreateProjectRequestSchema, Gn as TriggerListResponseSchema, Gr as resolveDocsMcpUrl, Gt as ListProjectMetricsResponseSchema, H as CreateOrganizationRequestSchema, Hn as TriggerDetailResponseSchema, Ht as ListProjectDeploymentsResponseSchema, I as CreateCredentialInstanceBodySchema, In as StartOAuthConnectionInputSchema, Ir as isAcceptableInstallExit, It as ListCredentialsPageResponseSchema, J as CredentialAssignmentListQuerySchema, Jn as UpdateAutoTopupRequestSchema, Jt as ManagedServiceCredentialSchema, K as CreateProjectResponseSchema, Kn as TriggerRunDetailResponseSchema, Kr as resolvePublicPlatformOrigin, Kt as ListProjectsResponseSchema, L as CreateCredentialsRequestSchema, Ln as StartOAuthConnectionResultSchema, Lr as listenPortFromPublicUrl, Lt as ListManagedServiceCredentialsResponseSchema, M as ConnectProvidersResponseSchema, Mn as StartKeystrokeConnectionInputSchema, Mr as buildConnectDeeplink, Mt as ListApiKeysResponseSchema, N as CreateApiKeyRequestSchema, Nn as StartKeystrokeConnectionResultSchema, Nt as ListAppsResponseSchema, O as ConfirmCheckoutRequestSchema, On as RecentResourceListResponseSchema, Or as WorkspaceTriggerListResponseSchema, Ot as InviteProjectMembersResponseSchema, P as CreateApiKeyResponseSchema, Pn as StartMcpOAuthConnectionInputSchema, Pr as deriveCustomAppDisplay, Pt as ListChannelPlatformsResponseSchema, Q as CredentialConsumerListResponseSchema, Qn as UpdateManagedServiceCredentialRequestSchema, Qt as OrganizationSidebarBrandingPatchSchema, R as CreateCredentialsResponseSchema, Rn as SubmitAgentFeedbackRequestSchema, Rt as ListOrganizationInvitationsResponseSchema, S as CatalogAppsPageResponseSchema, Sr as WorkflowRunListResponseSchema, St as HistoryRunDetailResponseSchema, T as ChannelConnectionSchema, Tn as QueuedAgentPromptResponseSchema, Tr as WorkflowSummaryListResponseSchema, Tt as InviteOrganizationMembersRequestSchema, U as CreateOrganizationResponseSchema, Un as TriggerInvokeInputsSchema, Ut as ListProjectFilesResponseSchema, V as CreateCustomAppResponseSchema, Vn as TemplateFilesResponseSchema, Vr as parseErrorResponse, Vt as ListOrganizationsResponseSchema, W as CreateProjectArtifactResponseSchema, Wn as TriggerInvokeResponseSchema, Wr as resolveConnectAppSlug, Wt as ListProjectMembersResponseSchema, X as CredentialAssignmentRecordSchema, Xn as UpdateCredentialInstanceBodySchema, Xt as McpDiscoverResponseSchema, Y as CredentialAssignmentListResponseSchema, Yn as UpdateChannelBindingBodySchema, Yt as ManagedServiceKindSchema, Z as CredentialConsumerListQuerySchema, Zn as UpdateCredentialRequestSchema, Zt as OpenApiDiscoverResponseSchema, _ as BindChannelBodySchema, _n as PromptInputSchema, _r as WorkflowFormUpsertBodySchema, _t as GetCustomAppResponseSchema, a as AgentSessionListResponseSchema, an as PresignCustomAppLogoResponseSchema, ar as UpdateProjectSettingsRequestSchema, at as DownloadActiveProjectArtifactResponseSchema, b as CatalogActionsPageResponseSchema, bn as PublicFormSubmitBodySchema, br as WorkflowRunInputsPutBodySchema, bt as HealthResponseSchema, c as AgentTriggerSummaryListResponseSchema, cn as PresignProjectSourceRequestSchema, cr as UpsertGatewayAttachmentBodySchema, ct as DuplicateCredentialsResponseSchema, d as AutoTopupSummarySchema, dn as PresignUserAvatarResponseSchema, dr as UserPreferencesPatchSchema, dt as FinalizeCustomAppLogoRequestSchema, en as PROJECT_PULL_STATE_RELATIVE_PATH, er as UpdateOrganizationMemberResponseSchema, et as CredentialInstanceRecordSchema, f as BillingActivityResponseSchema, fn as ProjectPullStateSchema, fr as UserPreferencesSchema, ft as FinalizeCustomAppLogoResponseSchema, g as BillingUsageResponseSchema, gn as ProjectSlugAvailabilityResponseSchema, gr as WorkflowFormResponseSchema, gt as GetCredentialResponseSchema, h as BillingSummaryResponseSchema, hn as ProjectSettingsResponseSchema, hr as WorkflowCanvasSchema, ht as GetAppCatalogEntryResponseSchema, i as AgentSessionDetailResponseSchema, in as PresignCustomAppLogoRequestSchema, ir as UpdateProjectRequestSchema, it as DeclineOrganizationInvitationResponseSchema, j as ConnectManagedServiceCredentialRequestSchema, jn as SlugAvailabilityResponseSchema, jr as WorkspaceWorkflowOverviewSchema, jt as ListAgentWorkspaceFilesResponseSchema, k as ConfirmCheckoutResponseSchema, kn as SkillSummaryDetailResponseSchema, kr as WorkspaceTriggerOverviewSchema, l as AppSlugAvailabilityResponseSchema, ln as PresignProjectSourceResponseSchema, lr as UserAvatarPatchSchema, lt as ExecuteKeystrokeToolRequestSchema, m as BillingRedirectResponseSchema, mn as ProjectResponseSchema, mr as WorkflowCanvasRunSchema, mt as GatewayAttachmentRecordSchema, n as AcceptOrganizationInvitationResponseSchema, nn as PresignChatAttachmentRequestSchema, nr as UpdateProjectMemberRequestSchema, nt as DOCS_QUERY_TOOL, o as AgentSummaryDetailResponseSchema, on as PresignOrgLogoRequestSchema, or as UploadProjectSourceManifestRequestSchema, ot as DownloadActiveProjectSourceResponseSchema, p as BillingInvoiceUrlResponseSchema, pn as ProjectReachabilityResponseSchema, pr as WorkflowCanvasCredentialBindingsSchema, pt as FormFieldConfigSchema, q as CreateSubscriptionCheckoutRequestSchema, qn as TriggerRunListResponseSchema, qr as slugifyAppName, qt as ListTemplatesResponseSchema, r as ActiveOrganizationResponseSchema, rn as PresignChatAttachmentResponseSchema, rr as UpdateProjectMemberResponseSchema, rt as DOCS_SEARCH_TOOL, s as AgentSummaryListResponseSchema, sn as PresignOrgLogoResponseSchema, sr as UploadProjectSourceResponseSchema, st as DuplicateCredentialRequestSchema, t as ACTIVE_ORG_HEADER, tn as PROJECT_REACHABILITY_REQUEST_TIMEOUT_MS, tr as UpdateOrganizationRequestSchema, u as AssignCredentialBodySchema, un as PresignUserAvatarRequestSchema, ur as UserAvatarSchema, v as CLIENT_CHANNEL_HEADER, vn as PromptResponseSchema, vr as WorkflowRunDetailResponseSchema, vt as GetTemplateResponseSchema, w as ChannelConnectionListResponseSchema, wn as PublishedFormSchema, wr as WorkflowSummaryDetailResponseSchema, wt as HistoryRunListResponseSchema, x as CatalogAppDetailResponseSchema, xn as PublicFormSubmitResponseSchema, xr as WorkflowRunInputsSchema, xt as HistoryRunCancelResponseSchema, y as CatalogActionDetailResponseSchema, yn as PublicFormMetadataSchema, yr as WorkflowRunHooksResponseSchema, yt as GraphqlDiscoverResponseSchema, z as CreateCreditsCheckoutRequestSchema, zn as SubmitMarketingContactRequestSchema, zt as ListOrganizationMembersPageQuerySchema } from "./dist-BcY5XTlp.mjs";
-import { C as getWebUrl, E as resolvePlatformUrlForWebUrl, S as getPlatformUrl, _ as resolveCliRoot, a as formatReleaseAgeBlockMessage, b as getConfigDir, c as detectManagerFromLockfile, d as installDependencies$1, f as installPlaygroundDependencies, g as readCliVersion, h as isNewerVersion, i as fetchLatestCliRelease, l as buildPlaygroundWorkspace, m as resolvePackageManager, n as computeReleaseAgeRetryAfter, o as isReleaseAgeBlock, p as resolveGithubPackagesToken, r as readPnpmMinimumReleaseAgeMinutes, s as detectCliInstall, t as runPackageManagerUpdate, u as detectPackageManager, v as createCliConfig, w as DEFAULT_PLATFORM_URL, x as getEffectiveApiTarget, y as getCliConfigDir } from "./run-package-manager-update-CQT2HD0m.mjs";
-import { a as alias, c as event, i as packProjectArtifact, l as flushTelemetry, n as withMcpReadClient, o as captureException, r as mergeFilteredArtifact, s as configureTelemetry, t as mapInParallelBatches, u as shutdownTelemetry } from "./dist-BkXtCIR2.mjs";
+import { a as alias, c as event, i as packProjectArtifact, l as flushTelemetry, n as withMcpReadClient, o as captureException, r as mergeFilteredArtifact, s as configureTelemetry, t as mapInParallelBatches, u as shutdownTelemetry } from "./dist-DaDxDpeX.mjs";
 import { createRequire } from "node:module";
 import { Command } from "commander";
 import { platform, release } from "node:os";
 import { basename, dirname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
+import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { spawn, spawnSync } from "node:child_process";
 import { Entry } from "@napi-rs/keyring";
-import { existsSync, lstatSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { PostHog } from "posthog-node";
 import { pathToFileURL } from "node:url";
 import { access, lstat, mkdir, readFile, readdir, rm, stat, symlink, writeFile } from "node:fs/promises";
-import { spawn, spawnSync } from "node:child_process";
 import { confirm, input } from "@inquirer/prompts";
 //#region ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/errors/KyError.js
 /**
@@ -1640,32 +1640,107 @@ function createKeystrokeClient(options) {
 	};
 }
 //#endregion
-//#region src/errors/expected-cli-error.ts
-/**
-* User/project failures that are expected CLI exits (lint, typecheck, validation, etc.).
-* These should not become Error Tracking issues.
-*/
-var ExpectedCliError = class extends Error {
-	constructor(message, options) {
-		super(message, options);
-		this.name = "ExpectedCliError";
+//#region src/auth/credentials-file.ts
+const CREDENTIALS_FILE_NAME = "credentials.json";
+function accountForUrl$2(url) {
+	return new URL(url).hostname;
+}
+function credentialsFilePath(configDir = getCliConfigDir()) {
+	return join(configDir, CREDENTIALS_FILE_NAME);
+}
+function assertSafeCredentialsPath(path) {
+	if (!existsSync(path)) return;
+	const stats = lstatSync(path);
+	if (stats.isSymbolicLink() || !stats.isFile()) throw new ExpectedCliError(`Refusing to use credentials path that is not a regular file: ${path}`);
+}
+function ensureCredentialsDir(path) {
+	const dir = dirname(path);
+	mkdirSync(dir, {
+		recursive: true,
+		mode: 448
+	});
+	try {
+		chmodSync(dir, 448);
+	} catch {}
+}
+function emptyCredentials() {
+	return { tokens: {} };
+}
+function readCredentialsFile(path) {
+	assertSafeCredentialsPath(path);
+	if (!existsSync(path)) return emptyCredentials();
+	let parsed;
+	try {
+		parsed = JSON.parse(readFileSync(path, "utf8"));
+	} catch {
+		throw new ExpectedCliError(`Credentials file is not valid JSON: ${path}`);
+	}
+	if (typeof parsed !== "object" || parsed === null || !("tokens" in parsed) || typeof parsed.tokens !== "object" || parsed.tokens === null || Array.isArray(parsed.tokens)) throw new ExpectedCliError(`Credentials file has an invalid shape: ${path}`);
+	const tokens = {};
+	for (const [key, value] of Object.entries(parsed.tokens)) if (typeof value === "string" && value.length > 0) tokens[key] = value;
+	return { tokens };
+}
+function writeCredentialsFile(path, data) {
+	ensureCredentialsDir(path);
+	assertSafeCredentialsPath(path);
+	const tempPath = `${path}.${process.pid}.${Date.now()}.tmp`;
+	const payload = `${JSON.stringify(data, null, 2)}\n`;
+	try {
+		writeFileSync(tempPath, payload, {
+			encoding: "utf8",
+			mode: 384,
+			flag: "wx"
+		});
+		try {
+			chmodSync(tempPath, 384);
+		} catch {}
+		renameSync(tempPath, path);
+		try {
+			chmodSync(path, 384);
+		} catch {}
+	} catch (error) {
+		try {
+			unlinkSync(tempPath);
+		} catch {}
+		throw error;
 	}
-};
-function isExpectedCliError(error) {
-	return error instanceof ExpectedCliError;
 }
-//#endregion
-//#region src/auth/credentials.ts
-const SERVICE = "keystroke";
-const KEYCHAIN_UNAVAILABLE_MESSAGE = "OS keychain is unavailable or locked. For headless environments, set KEYSTROKE_API_KEY instead of using `keystroke auth login`.";
-function accountForWebUrl(webUrl) {
-	return new URL(webUrl).hostname;
+function getFileToken(url, configDir = getCliConfigDir()) {
+	return readCredentialsFile(credentialsFilePath(configDir)).tokens[accountForUrl$2(url)];
+}
+function setFileToken(url, token, configDir = getCliConfigDir()) {
+	const path = credentialsFilePath(configDir);
+	const data = readCredentialsFile(path);
+	data.tokens[accountForUrl$2(url)] = token;
+	writeCredentialsFile(path, data);
+}
+function clearFileToken(url, configDir = getCliConfigDir()) {
+	const path = credentialsFilePath(configDir);
+	if (!existsSync(path)) return;
+	const account = accountForUrl$2(url);
+	const data = readCredentialsFile(path);
+	if (!(account in data.tokens)) return;
+	delete data.tokens[account];
+	if (Object.keys(data.tokens).length === 0) {
+		assertSafeCredentialsPath(path);
+		unlinkSync(path);
+		return;
+	}
+	writeCredentialsFile(path, data);
 }
+//#endregion
+//#region src/auth/credentials-keychain.ts
+/** Stable service for the Apple `/usr/bin/security` backend (not Node-bound). */
+const KEYCHAIN_SERVICE = "keystroke-cli";
+/** Legacy `@napi-rs/keyring` service — migrated once into KEYCHAIN_SERVICE on macOS. */
+const LEGACY_KEYCHAIN_SERVICE = "keystroke";
+const SECURITY_BIN = "/usr/bin/security";
+const KEYCHAIN_UNAVAILABLE_MESSAGE = "OS keychain is unavailable or locked. For headless environments, set KEYSTROKE_API_KEY instead of using `keystroke auth login`, or run `keystroke auth login --credential-storage file`.";
 /** Match storage-specific keychain/keyring failures only — avoid generic OS permission phrases. */
 function isKeychainFailure(error) {
 	if (!(error instanceof Error)) return false;
 	const message = error.message.toLowerCase();
-	return message.includes("keychain") || message.includes("keyring") || message.includes("secret service") || message.includes("libsecret") || message.includes("password store") || message.includes("no password store") || message.includes("dbus") || message.includes("no such interface") || message.includes("platform secure storage");
+	return message.includes("keychain") || message.includes("keyring") || message.includes("secret service") || message.includes("libsecret") || message.includes("password store") || message.includes("no password store") || message.includes("dbus") || message.includes("no such interface") || message.includes("platform secure storage") || message.includes("user interaction is not allowed") || message.includes("errsec") || message.includes("keychain access failed via security") || /security.*(denied|locked|unable|failed)/i.test(message);
 }
 function withKeychain(fn) {
 	try {
@@ -1675,23 +1750,224 @@ function withKeychain(fn) {
 		throw error;
 	}
 }
-function getAccessToken(webUrl) {
+function accountForUrl$1(url) {
+	return new URL(url).hostname;
+}
+function runSecurity(args, input) {
+	const result = spawnSync(SECURITY_BIN, args, {
+		encoding: "utf8",
+		input,
+		stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		]
+	});
+	if (result.error) throw result.error;
+	return {
+		status: result.status,
+		stdout: result.stdout ?? "",
+		stderr: result.stderr ?? ""
+	};
+}
+function securityErrorMessage(result) {
+	const detail = (result.stderr || result.stdout).trim();
+	return detail.length > 0 ? `Keychain access failed via security: ${detail}` : `Keychain access failed via security (exit ${result.status ?? "unknown"})`;
+}
+/** errSecItemNotFound — item does not exist. */
+function isSecurityNotFound(result) {
+	if (result.status === 44) return true;
+	const text = `${result.stderr}\n${result.stdout}`.toLowerCase();
+	return text.includes("could not be found") || text.includes("item not found");
+}
+function getViaSecurity(account, service) {
+	const result = runSecurity([
+		"find-generic-password",
+		"-s",
+		service,
+		"-a",
+		account,
+		"-w"
+	]);
+	if (isSecurityNotFound(result)) return;
+	if (result.status !== 0) throw new Error(securityErrorMessage(result));
+	const password = result.stdout.replace(/\n$/, "");
+	return password.length > 0 ? password : void 0;
+}
+function setViaSecurity(account, service, token) {
+	if (token.length === 0) throw new Error("Refusing to store an empty keychain token");
+	const result = runSecurity([
+		"add-generic-password",
+		"-U",
+		"-s",
+		service,
+		"-a",
+		account,
+		"-w",
+		token
+	]);
+	if (result.status !== 0) throw new Error(securityErrorMessage(result));
+}
+function deleteViaSecurity(account, service) {
+	const result = runSecurity([
+		"delete-generic-password",
+		"-s",
+		service,
+		"-a",
+		account
+	]);
+	if (isSecurityNotFound(result)) return;
+	if (result.status !== 0) throw new Error(securityErrorMessage(result));
+}
+function getLegacyNapi(account) {
+	const password = new Entry(LEGACY_KEYCHAIN_SERVICE, account).getPassword();
+	return password === null ? void 0 : password;
+}
+function clearLegacyNapi(account) {
+	const entry = new Entry(LEGACY_KEYCHAIN_SERVICE, account);
+	try {
+		entry.deletePassword();
+	} catch {}
+}
+function getNapi(account, service = KEYCHAIN_SERVICE) {
+	const password = new Entry(service, account).getPassword();
+	return password === null ? void 0 : password;
+}
+function setNapi(account, token, service = KEYCHAIN_SERVICE) {
+	new Entry(service, account).setPassword(token);
+}
+function deleteNapi(account, service = KEYCHAIN_SERVICE) {
+	new Entry(service, account).deletePassword();
+}
+function migrateLegacyMacToken(account) {
+	let legacy;
+	try {
+		legacy = getLegacyNapi(account);
+	} catch (error) {
+		if (isKeychainFailure(error)) throw error;
+		return;
+	}
+	if (!legacy) return;
+	setViaSecurity(account, KEYCHAIN_SERVICE, legacy);
+	if (getViaSecurity(account, "keystroke-cli") !== legacy) throw new Error("Keychain migration failed: wrote legacy token via security but could not read it back");
+	clearLegacyNapi(account);
+	return legacy;
+}
+function getKeychainToken(url) {
 	return withKeychain(() => {
-		const password = new Entry(SERVICE, accountForWebUrl(webUrl)).getPassword();
-		return password === null ? void 0 : password;
+		const account = accountForUrl$1(url);
+		if (process.platform === "darwin") {
+			const current = getViaSecurity(account, KEYCHAIN_SERVICE);
+			if (current !== void 0) return current;
+			return migrateLegacyMacToken(account);
+		}
+		return getNapi(account);
 	});
 }
-function setAccessToken(webUrl, token) {
+function setKeychainToken(url, token) {
 	withKeychain(() => {
-		new Entry(SERVICE, accountForWebUrl(webUrl)).setPassword(token);
+		const account = accountForUrl$1(url);
+		if (process.platform === "darwin") {
+			setViaSecurity(account, KEYCHAIN_SERVICE, token);
+			clearLegacyNapi(account);
+			return;
+		}
+		setNapi(account, token);
 	});
 }
-function clearAccessToken(webUrl) {
+function clearKeychainToken(url) {
 	withKeychain(() => {
-		new Entry(SERVICE, accountForWebUrl(webUrl)).deletePassword();
+		const account = accountForUrl$1(url);
+		if (process.platform === "darwin") {
+			deleteViaSecurity(account, KEYCHAIN_SERVICE);
+			clearLegacyNapi(account);
+			return;
+		}
+		try {
+			deleteNapi(account);
+		} catch (error) {
+			if (error instanceof Error && /no.?entry|not found|password not found/i.test(error.message)) return;
+			throw error;
+		}
 	});
 }
 //#endregion
+//#region src/auth/credentials.ts
+const MISSING = Symbol("missing");
+const tokenCache = /* @__PURE__ */ new Map();
+function accountForUrl(url) {
+	return new URL(url).hostname;
+}
+function resolveStorage(storage) {
+	return storage ?? "keychain";
+}
+function cacheKey$1(url, storage) {
+	return `${storage}:${accountForUrl(url)}`;
+}
+function readFromBackend(url, storage, configDir) {
+	if (storage === "file") return getFileToken(url, configDir);
+	return getKeychainToken(url);
+}
+function writeToBackend(url, token, storage, configDir) {
+	if (storage === "file") {
+		setFileToken(url, token, configDir);
+		return;
+	}
+	setKeychainToken(url, token);
+}
+function deleteFromBackend(url, storage, configDir) {
+	if (storage === "file") {
+		clearFileToken(url, configDir);
+		return;
+	}
+	clearKeychainToken(url);
+}
+/** Clear the in-process credential cache (tests / logout). */
+function clearAccessTokenCache() {
+	tokenCache.clear();
+}
+function getAccessToken(url, options = {}) {
+	const storage = resolveStorage(options.storage);
+	const key = cacheKey$1(url, storage);
+	const cached = tokenCache.get(key);
+	if (cached !== void 0) return cached === MISSING ? void 0 : cached;
+	const token = readFromBackend(url, storage, options.configDir);
+	tokenCache.set(key, token === void 0 ? MISSING : token);
+	return token;
+}
+function setAccessToken(url, token, options = {}) {
+	const storage = resolveStorage(options.storage);
+	writeToBackend(url, token, storage, options.configDir);
+	tokenCache.set(cacheKey$1(url, storage), token);
+}
+function clearAccessToken(url, options = {}) {
+	const storage = resolveStorage(options.storage);
+	deleteFromBackend(url, storage, options.configDir);
+	tokenCache.set(cacheKey$1(url, storage), MISSING);
+}
+/**
+* Persist a token to `storage`, then best-effort clear the other backend when switching.
+* Does not discard the newly stored credential if cleanup fails.
+*/
+function setAccessTokenSwitchingStorage(url, token, options) {
+	setAccessToken(url, token, {
+		storage: options.storage,
+		configDir: options.configDir
+	});
+	const previous = options.previousStorage;
+	if (!previous || previous === options.storage) return {};
+	try {
+		clearAccessToken(url, {
+			storage: previous,
+			configDir: options.configDir
+		});
+		return {};
+	} catch (error) {
+		const detail = error instanceof Error ? error.message : String(error);
+		return { cleanupWarning: `Stored credentials in ${options.storage}, but failed to clear ${previous} storage: ${detail}` };
+	}
+}
+//#endregion
 //#region ../../packages/auth/dist/jwt-BVJ7dVm9.mjs
 /** OAuth device-flow client id for `keystroke auth login`. */
 const CLI_CLIENT_ID = "keystroke-cli";
@@ -3526,18 +3802,25 @@ async function getJwtWithBearer(baseURL, sessionToken) {
 //#endregion
 //#region src/auth/jwt-cache.ts
 const caches = /* @__PURE__ */ new Map();
-async function getCliJwt(platformUrl, force = false) {
-	if (!getAccessToken(platformUrl)) {
-		caches.delete(platformUrl);
+function cacheKey(platformUrl, storage) {
+	return `${storage}:${platformUrl}`;
+}
+function clearCliJwtCache() {
+	caches.clear();
+}
+async function getCliJwt(platformUrl, force = false, storage = "keychain") {
+	if (!getAccessToken(platformUrl, { storage })) {
+		caches.delete(cacheKey(platformUrl, storage));
 		return;
 	}
-	let cache = caches.get(platformUrl);
+	const key = cacheKey(platformUrl, storage);
+	let cache = caches.get(key);
 	if (!cache) {
 		cache = createJwtTokenCache(async () => {
-			const sessionToken = getAccessToken(platformUrl);
+			const sessionToken = getAccessToken(platformUrl, { storage });
 			return sessionToken ? getJwtWithBearer(platformUrl, sessionToken) : null;
 		});
-		caches.set(platformUrl, cache);
+		caches.set(key, cache);
 	}
 	return cache.get(force);
 }
@@ -3551,10 +3834,11 @@ function resolveCliAuth(config) {
 		getKey: () => apiKey
 	};
 	const platformUrl = getPlatformUrl(config);
-	if (!getAccessToken(platformUrl)) return { type: "none" };
+	const storage = getCredentialStorage(config);
+	if (!getAccessToken(platformUrl, { storage })) return { type: "none" };
 	return {
 		type: "bearer",
-		getToken: () => getCliJwt(platformUrl)
+		getToken: () => getCliJwt(platformUrl, false, storage)
 	};
 }
 //#endregion
@@ -5297,10 +5581,11 @@ function toPlatformAuth(auth) {
 }
 function createCliPlatformClient(config, options = {}) {
 	const platformUrl = getPlatformUrl(config);
+	const storage = getCredentialStorage(config);
 	return createPlatformClient({
 		baseUrl: platformUrl,
 		auth: toPlatformAuth(resolveCliAuth(config)),
-		refreshBearerToken: () => getCliJwt(platformUrl, true),
+		refreshBearerToken: () => getCliJwt(platformUrl, true, storage),
 		getActiveOrganizationId: () => options.organizationId === void 0 ? getResolvedOrganizationId() ?? null : options.organizationId,
 		getExtraHeaders: () => ({ [CLIENT_CHANNEL_HEADER]: "cli" })
 	});
@@ -5714,14 +5999,9 @@ function unreachableTarget(context) {
 function unreachableServerMessage(targetUrl) {
 	return `Could not reach ${targetUrl ?? "the keystroke server"}.`;
 }
-function authApiOrigin(context) {
-	if (context?.platformUrl) return context.platformUrl;
-	if (context?.webUrl) return resolvePlatformUrlForWebUrl(context.webUrl, {});
-}
 function formatHttpClientError(error, context) {
 	if (error.status === 401) {
-		const origin = authApiOrigin(context);
-		if (origin && !getAccessToken(origin)) return "Not logged in. Run `keystroke auth login` first.";
+		if (context?.hasCredentials === false) return "Not logged in. Run `keystroke auth login` first.";
 		return "Authentication failed. Run `keystroke auth login` again.";
 	}
 	if (error.status === 403) {
@@ -7597,9 +7877,11 @@ function resolveAuthLoginTargets(options, config) {
 //#endregion
 //#region src/commands/auth/login.ts
 function registerAuthLoginCommand(auth) {
-	auth.command("login").description("Authenticate via browser device flow").option("--web-url <url>", "Web dashboard origin (omit to use production defaults; local dev: http://localhost:3000)").option("--platform-url <url>", "Platform API origin (derived from web URL when omitted)").action(async (options) => {
+	auth.command("login").description("Authenticate via browser device flow").option("--web-url <url>", "Web dashboard origin (omit to use production defaults; local dev: http://localhost:3000)").option("--platform-url <url>", "Platform API origin (derived from web URL when omitted)").option("--credential-storage <keychain|file>", "Where to store the session token (default: keychain; file is owner-only under ~/.keystroke)").action(async (options) => {
 		const config = createCliConfig();
 		const { webUrl, platformUrl } = resolveAuthLoginTargets(options, config);
+		const previousStorage = getCredentialStorage(config);
+		const storage = options.credentialStorage ? parseCredentialStorage(options.credentialStorage) : previousStorage;
 		config.set("webUrl", webUrl);
 		config.set("platformUrl", platformUrl);
 		try {
@@ -7608,7 +7890,13 @@ function registerAuthLoginCommand(auth) {
 				clientId: CLI_CLIENT_ID,
 				openUrl
 			});
-			setAccessToken(platformUrl, result.accessToken);
+			const { cleanupWarning } = setAccessTokenSwitchingStorage(platformUrl, result.accessToken, {
+				storage,
+				previousStorage
+			});
+			config.set("credentialStorage", storage);
+			clearCliJwtCache();
+			if (cleanupWarning) process.stderr.write(`${cleanupWarning}\n`);
 			const user = await getSessionWithBearer(platformUrl, result.accessToken);
 			if (user) {
 				await aliasCliTelemetryUser(user.id);
@@ -7638,12 +7926,16 @@ function registerAuthLogoutCommand(auth) {
 		const config = createCliConfig();
 		const webUrl = options.webUrl ?? getWebUrl(config);
 		const platformUrl = getPlatformUrl(config);
-		clearAccessToken(platformUrl);
+		const storage = getCredentialStorage(config);
+		clearAccessToken(platformUrl, { storage });
+		clearAccessTokenCache();
+		clearCliJwtCache();
 		clearCliTelemetryUserId();
 		process.stdout.write(`${JSON.stringify({
 			authenticated: false,
 			webUrl,
-			platformUrl
+			platformUrl,
+			credentialStorage: storage
 		})}\n`);
 	});
 }
@@ -7654,12 +7946,14 @@ function registerAuthStatusCommand(auth) {
 		const config = createCliConfig();
 		const webUrl = options.webUrl ?? getWebUrl(config);
 		const platformUrl = getPlatformUrl(config);
-		const token = getAccessToken(platformUrl);
+		const credentialStorage = getCredentialStorage(config);
+		const token = getAccessToken(platformUrl, { storage: credentialStorage });
 		if (!token) {
 			process.stdout.write(`${JSON.stringify({
 				authenticated: false,
 				webUrl,
-				platformUrl
+				platformUrl,
+				credentialStorage
 			})}\n`);
 			return;
 		}
@@ -7669,6 +7963,8 @@ function registerAuthStatusCommand(auth) {
 			process.stdout.write(`${JSON.stringify({
 				authenticated: user !== null,
 				webUrl,
+				platformUrl,
+				credentialStorage,
 				user,
 				organizations: organizations.map((entry) => ({
 					slug: entry.organization.slug,
@@ -7791,7 +8087,7 @@ function registerBuildCommand(program) {
 		try {
 			const root = resolveProjectRoot(options.dir);
 			await ensureSdkCurrent(root);
-			const { buildApp } = await import("./dist-Bo7OJs1C.mjs");
+			const { buildApp } = await import("./dist-Cp7XrP0x.mjs");
 			await buildApp({ root });
 			process.stdout.write(`Built ${root}\n`);
 		} catch (error) {
@@ -7926,7 +8222,7 @@ async function sleep(ms) {
 }
 async function buildDeployArchive(client, root, projectId, filter) {
 	if (filter?.length) {
-		const { buildFilteredApp } = await import("./dist-Bo7OJs1C.mjs");
+		const { buildFilteredApp } = await import("./dist-Cp7XrP0x.mjs");
 		const filtered = await buildFilteredApp({
 			root,
 			filter,
@@ -7948,7 +8244,7 @@ async function buildDeployArchive(client, root, projectId, filter) {
 			sourceFiles: filtered.sourceFiles
 		};
 	}
-	const { buildApp } = await import("./dist-Bo7OJs1C.mjs");
+	const { buildApp } = await import("./dist-Cp7XrP0x.mjs");
 	const { sourceFiles } = await buildApp({
 		root,
 		collectSources: true,
@@ -8079,7 +8375,7 @@ function runtimeChildEnv(parentEnv, overrides) {
 //#region src/project/bootstrap-run.ts
 /** Node args + env for `@keystrokehq/build` bootstrap (shared by start + dev). */
 async function resolveBootstrapRun(options) {
-	const { resolveRuntimeBuildArtifact } = await import("./dist-Bo7OJs1C.mjs");
+	const { resolveRuntimeBuildArtifact } = await import("./dist-Cp7XrP0x.mjs");
 	const loader = pathToFileURL(resolveRuntimeBuildArtifact(options.runtimeNodeModules, "dist/runtime-loader.mjs")).href;
 	const bootstrap = resolveRuntimeBuildArtifact(options.runtimeNodeModules, "dist/standalone-bootstrap.mjs");
 	const args = [`--import=${loader}`];
@@ -8229,7 +8525,7 @@ async function runDev(options) {
 	process.on("SIGINT", shutdown);
 	process.on("SIGTERM", shutdown);
 	try {
-		const { watchApp } = await import("./dist-Bo7OJs1C.mjs");
+		const { watchApp } = await import("./dist-Cp7XrP0x.mjs");
 		await watchApp({
 			root,
 			clean: false,
@@ -8880,7 +9176,7 @@ async function runOrganizationMembersRemove(config, userId) {
 }
 async function runOrganizationLeave(config) {
 	const platformUrl = getPlatformUrl(config);
-	const token = getAccessToken(platformUrl);
+	const token = getAccessToken(platformUrl, { storage: getCredentialStorage(config) });
 	if (!token) throw new Error("Not authenticated. Run `keystroke auth login` first.");
 	const user = await getSessionWithBearer(platformUrl, token);
 	if (!user) throw new Error("Session expired. Run `keystroke auth login` again.");
@@ -9339,7 +9635,7 @@ async function runStart(options) {
 	const apiPort = Number(new URL(serverUrl).port || 80);
 	const runtimeNodeModules = resolveCliRuntimeNodeModules(resolveCliRoot(import.meta.url));
 	ensureNativeDeps(runtimeNodeModules);
-	const { buildApp } = await import("./dist-Bo7OJs1C.mjs");
+	const { buildApp } = await import("./dist-Cp7XrP0x.mjs");
 	await buildApp({
 		root,
 		clean: false
@@ -10231,7 +10527,7 @@ function createProgram() {
 async function runCli(argv) {
 	initCliTelemetry();
 	try {
-		const { maybeAutoUpdate } = await import("./maybe-auto-update-C99Obm7k.mjs");
+		const { maybeAutoUpdate } = await import("./maybe-auto-update-D8VbU88T.mjs");
 		await maybeAutoUpdate(argv);
 		await createProgram().parseAsync(argv);
 	} finally {
@@ -10241,4 +10537,4 @@ async function runCli(argv) {
 //#endregion
 export { runCli };
 
-//# sourceMappingURL=program-DMhbEvwF.mjs.map
+//# sourceMappingURL=program-CYtD52e1.mjs.map