@keystrokehq/cli 0.1.147 → 0.1.149

package/dist/dist-DJQnugPi.mjs

@@ -0,0 +1,1829 @@
+#!/usr/bin/env node
+import { an as PROJECT_MANIFEST_REL_PATH, cn as PROJECT_SOURCE_IGNORED_DIRS, dn as PROJECT_SOURCE_MAX_TOTAL_BYTES, fi as isIgnoredProjectSourceFileName, ln as PROJECT_SOURCE_MAX_FILES, mi as isProbablyBinaryProjectSource, un as PROJECT_SOURCE_MAX_FILE_BYTES } from "./dist-C6adeAws.mjs";
+import { at as classifyCall, ct as locateWorkflow, dt as entryIdFromFile, ft as readKeystrokeIgnoreDirective, it as packDirFromDisk, ot as computeCallSiteIds, pt as shouldSkipKeystrokeModuleFile, st as diagnoseWorkflowSource } from "./dist-DSkS8uEB.mjs";
+import { createRequire, isBuiltin } from "node:module";
+import "node:os";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { createHash } from "node:crypto";
+import { build, mergeConfig } from "tsdown";
+import ts from "typescript";
+//#region ../../packages/build/dist/walk-project-CLy8GqGX.mjs
+function toPosix$1(path) {
+	return path.split(sep).join("/");
+}
+function projectRelativePath(root, filePath) {
+	return toPosix$1(relative(root, normalizeBuildFilePath(filePath)));
+}
+/** Normalize paths so /var and /private/var compare equal on macOS. */
+function normalizeBuildFilePath(filePath) {
+	const absolute = resolve(filePath);
+	try {
+		return realpathSync.native(absolute);
+	} catch {
+		return absolute;
+	}
+}
+function normalizeModuleId(id, root) {
+	if (id.startsWith("\0")) return null;
+	const normalized = normalizeBuildFilePath(id.startsWith("file://") ? fileURLToPath(id) : id);
+	if (!normalized.startsWith(normalizeBuildFilePath(root))) return null;
+	return normalized;
+}
+function formatImportGuardError(root, ignoredPath, importer) {
+	const ignored = projectRelativePath(root, ignoredPath);
+	if (importer) return `Cannot import "${ignored}" (@keystroke ignore) from "${projectRelativePath(root, importer)}". Remove the directive or stop importing it from a shipped module.`;
+	return `Cannot import "${ignored}" (@keystroke ignore). Remove the directive or stop importing it from a shipped module.`;
+}
+/** Throw when a built module imports a `@keystroke ignore` source file. */
+function keystrokeIgnoreGuardPlugin(options) {
+	const root = normalizeBuildFilePath(options.root);
+	const ignoredFiles = new Set(options.ignoredFiles.map((filePath) => normalizeBuildFilePath(filePath)));
+	function assertNotIgnored(filePath, importer) {
+		const normalized = normalizeBuildFilePath(filePath);
+		if (!ignoredFiles.has(normalized)) return;
+		throw new Error(formatImportGuardError(root, normalized, importer));
+	}
+	return {
+		name: "keystroke-ignore-guard",
+		async resolveId(source, importer, resolveOptions) {
+			if (resolveOptions?.isEntry || !importer) return null;
+			const resolved = await this.resolve(source, importer, {
+				...resolveOptions,
+				skipSelf: true
+			});
+			if (!resolved) return null;
+			assertNotIgnored(typeof resolved === "string" ? resolved : resolved.id, importer);
+			return null;
+		},
+		load(id) {
+			const normalized = normalizeModuleId(id, root);
+			if (!normalized) return null;
+			assertNotIgnored(normalized);
+			return null;
+		}
+	};
+}
+const MAX_FILE_BYTES = PROJECT_SOURCE_MAX_FILE_BYTES;
+const MAX_TOTAL_BYTES = PROJECT_SOURCE_MAX_TOTAL_BYTES;
+const MAX_FILES = PROJECT_SOURCE_MAX_FILES;
+function toPosix$6(path) {
+	return path.split(sep).join("/");
+}
+function classifyBuildEntry(root, srcRoot, filePath) {
+	const relativePath = toPosix$6(relative(root, filePath));
+	const agentsPrefix = `${toPosix$6(relative(root, join(srcRoot, "agents")))}/`;
+	const workflowsPrefix = `${toPosix$6(relative(root, join(srcRoot, "workflows")))}/`;
+	const triggersPrefix = `${toPosix$6(relative(root, join(srcRoot, "triggers")))}/`;
+	const actionsPrefix = `${toPosix$6(relative(root, join(srcRoot, "actions")))}/`;
+	if (relativePath.startsWith(agentsPrefix) && /\.(ts|mts)$/.test(relativePath) && !/\.(int\.)?test\.(ts|mts)$/.test(relativePath)) {
+		const id = entryIdFromFile(join(srcRoot, "agents"), filePath, { nestedEntry: "agent" });
+		return id ? {
+			entryKey: `agents/${id}`,
+			entryPath: filePath
+		} : null;
+	}
+	if (relativePath.startsWith(actionsPrefix) && /\.(ts|mts)$/.test(relativePath) && !/\.(int\.)?test\.(ts|mts)$/.test(relativePath)) {
+		const id = entryIdFromFile(join(srcRoot, "actions"), filePath, { nestedEntry: "action" });
+		return id ? {
+			entryKey: `actions/${id}`,
+			entryPath: filePath
+		} : null;
+	}
+	if (relativePath.startsWith(workflowsPrefix) && /\.(ts|mts)$/.test(relativePath) && !/\.(int\.)?test\.(ts|mts)$/.test(relativePath)) {
+		const id = entryIdFromFile(join(srcRoot, "workflows"), filePath, { nestedEntry: "workflow" });
+		return id ? {
+			entryKey: `workflows/${id}`,
+			entryPath: filePath
+		} : null;
+	}
+	if (relativePath.startsWith(triggersPrefix) && /\.(ts|mts)$/.test(relativePath) && !/\.(int\.)?test\.(ts|mts)$/.test(relativePath)) {
+		const id = entryIdFromFile(join(srcRoot, "triggers"), filePath, { nestedEntry: "trigger" });
+		return id ? {
+			entryKey: `triggers/${id}`,
+			entryPath: filePath
+		} : null;
+	}
+	return null;
+}
+function shouldSkipIgnoredModule(filePath, phase) {
+	return shouldSkipKeystrokeModuleFile(readKeystrokeIgnoreDirective(filePath), phase);
+}
+function isSrcTypeScriptFile(srcRoot, filePath) {
+	const relativePath = toPosix$6(relative(srcRoot, filePath));
+	if (relativePath.startsWith("..")) return false;
+	return /\.(ts|mts)$/.test(relativePath);
+}
+function walkTree(root, dir, srcRoot, phase, collectSources, sourceFiles, buildEntries, ignoredFiles, totals) {
+	for (const name of readdirSync(dir).sort()) {
+		if (collectSources && (sourceFiles.length >= MAX_FILES || totals.bytes >= MAX_TOTAL_BYTES)) return;
+		const absolute = join(dir, name);
+		const stats = statSync(absolute);
+		if (stats.isDirectory()) {
+			if (PROJECT_SOURCE_IGNORED_DIRS.has(name)) continue;
+			walkTree(root, absolute, srcRoot, phase, collectSources, sourceFiles, buildEntries, ignoredFiles, totals);
+			continue;
+		}
+		if (!stats.isFile()) continue;
+		const isUnderSrc = isSrcTypeScriptFile(srcRoot, absolute);
+		const skipIgnored = isUnderSrc ? shouldSkipIgnoredModule(absolute, phase) : false;
+		if (isUnderSrc && skipIgnored) ignoredFiles.push(normalizeBuildFilePath(absolute));
+		const buildEntry = classifyBuildEntry(root, srcRoot, absolute);
+		if (buildEntry && !skipIgnored) buildEntries[buildEntry.entryKey] = buildEntry.entryPath;
+		if (!collectSources) continue;
+		if (stats.size > MAX_FILE_BYTES || isIgnoredProjectSourceFileName(name)) continue;
+		const buffer = readFileSync(absolute);
+		if (isProbablyBinaryProjectSource(buffer)) continue;
+		totals.bytes += buffer.byteLength;
+		sourceFiles.push({
+			path: toPosix$6(relative(root, absolute)),
+			contents: buffer.toString("utf8"),
+			hash: createHash("sha256").update(buffer).digest("hex")
+		});
+	}
+}
+/**
+* One full-tree walk of the project: classifies tsdown entries and optionally
+* collects deploy source files (path + contents + hash) under snapshot limits.
+*/
+function walkProject(root, srcDirOrOptions = "src", maybeOptions) {
+	const srcDir = typeof srcDirOrOptions === "string" ? srcDirOrOptions : srcDirOrOptions.srcDir ?? "src";
+	const options = typeof srcDirOrOptions === "string" ? maybeOptions ?? {} : srcDirOrOptions;
+	const collectSources = options.collectSources ?? false;
+	const phase = options.phase ?? "build";
+	const sourceFiles = [];
+	const buildEntries = {};
+	const ignoredFiles = [];
+	walkTree(root, root, join(root, srcDir), phase, collectSources, sourceFiles, buildEntries, ignoredFiles, { bytes: 0 });
+	return {
+		sourceFiles,
+		buildEntries,
+		ignoredFiles
+	};
+}
+//#endregion
+//#region ../../packages/tsdown-config/deps.js
+/** Native addons kept external — resolved from the CLI runtime at app start. */
+const NATIVE_RUNTIME_DEPS = [
+	"pg",
+	"better-sqlite3",
+	"@parcel/watcher"
+];
+/**
+* Framework/runtime `@keystrokehq/*` shipped in the project-server image, so user-app builds
+* keep them external and resolve them from the runtime at boot. Everything else under the scope
+* (Composio catalog integrations like `@keystrokehq/posthog`, …) is bundled into the artifact.
+*
+* This set MUST equal the `@keystrokehq/*` dependency closure of `@keystrokehq/project-runtime`
+* (the deploy image) — `deps.test.ts` enforces it. To change what stays external, change what the
+* runtime image depends on; do not edit this list by hand. `exa` is the only integration
+* package the framework imports directly (web search); `gateway` ships Slack and other channel
+* adapters in the runtime image.
+*/
+const RUNTIME_KEYSTROKE_PACKAGES = new Set([
+	"access-control",
+	"action",
+	"agent",
+	"app",
+	"auth",
+	"build",
+	"config",
+	"credentials",
+	"database",
+	"exa",
+	"gateway",
+	"hosting",
+	"http",
+	"keystroke",
+	"manifest",
+	"mcp",
+	"memory",
+	"oauth",
+	"platform-database",
+	"project-runtime",
+	"projects",
+	"runtime",
+	"sandbox",
+	"scheduler",
+	"sdk",
+	"secrets",
+	"shared",
+	"storage",
+	"telemetry",
+	"tracing",
+	"trigger",
+	"tsdown-config",
+	"web-search",
+	"worker",
+	"workflow",
+	"workflow-canvas"
+]);
+/** Matches framework/runtime `@keystrokehq/*` kept external during user-app builds. */
+const FRAMEWORK_KEYSTROKE_EXTERNAL = new RegExp(`^@keystrokehq\\/(?:${[...RUNTIME_KEYSTROKE_PACKAGES].sort().join("|")})(?:\\/|$)`);
+function keystrokePackageName(name) {
+	if (!name.startsWith("@keystrokehq/")) return null;
+	return name.slice(13).split("/")[0] ?? null;
+}
+function isRuntimeKeystrokePackage(name) {
+	const pkg = keystrokePackageName(name);
+	return pkg !== null && RUNTIME_KEYSTROKE_PACKAGES.has(pkg);
+}
+/**
+* Kept external so .d.ts emission does not inline internal/inferred types.
+*
+* `typescript` is external because the TS compiler cannot be cleanly bundled into
+* ESM — it mixes `require()`/`__filename` with top-level await, which Node rejects
+* with `ERR_AMBIGUOUS_MODULE_SYNTAX` on load. Packages that use the compiler
+* (`workflow-canvas`, `manifest`, `build`) declare it as a dependency, so it
+* resolves from `node_modules` at runtime instead of being inlined.
+*/
+const LIBRARY_EXTERNAL_DEPS = [
+	"better-auth",
+	/^@better-auth\//,
+	/^better-auth\//,
+	"typescript"
+];
+/** Kept external when bundling published entry points (cli, keystroke, platform). */
+const BUNDLED_ENTRY_EXTERNAL_DEPS = [...[
+	...NATIVE_RUNTIME_DEPS,
+	"dockerode",
+	"ssh2",
+	"cpu-features",
+	"microsandbox",
+	/^@aws-sdk\//,
+	/^@napi-rs\//,
+	"hono",
+	/^@hono\//,
+	"undici"
+], ...LIBRARY_EXTERNAL_DEPS];
+/** Bundle into CLI — device login uses Better Auth client only. */
+const BETTER_AUTH_CLIENT_BUNDLE_PATTERNS = [/^better-auth\/client$/, /^better-auth\/client\//];
+function isNativeRuntimeDep(id) {
+	return NATIVE_RUNTIME_DEPS.some((dep) => id === dep || id.startsWith(`${dep}/`));
+}
+function packageName(id) {
+	if (id.startsWith("@")) {
+		const [scope, name] = id.split("/");
+		return name ? `${scope}/${name}` : id;
+	}
+	return id.split("/")[0] ?? id;
+}
+/** Zod ships in the project-runtime image; keep one copy out of user-app artifacts. */
+function isRuntimeSharedNpmDep(id) {
+	return packageName(id) === "zod";
+}
+function isRuntimeExternal(id) {
+	const name = packageName(id);
+	if (isNativeRuntimeDep(name)) return true;
+	if (isRuntimeSharedNpmDep(name)) return true;
+	if (name.startsWith("@keystrokehq/")) return isRuntimeKeystrokePackage(name);
+	if (name === "better-auth" || name.startsWith("@better-auth/")) return true;
+	return false;
+}
+/** Library packages resolve npm deps from node_modules at runtime. */
+function libraryBuildDepsConfig() {
+	return {
+		alwaysBundle: (_id) => null,
+		neverBundle: [
+			...NATIVE_RUNTIME_DEPS,
+			/^@keystrokehq\//,
+			...LIBRARY_EXTERNAL_DEPS
+		],
+		onlyBundle: false
+	};
+}
+/** Bundle npm deps into dist; resolve @keystrokehq/*, zod, and natives from the runtime. */
+function userAppBuildDepsConfig() {
+	return {
+		alwaysBundle: (id, _importer) => {
+			if (id.startsWith(".") || id.startsWith("/") || isBuiltin(id)) return null;
+			return isRuntimeExternal(id) ? null : true;
+		},
+		neverBundle: [
+			...NATIVE_RUNTIME_DEPS,
+			FRAMEWORK_KEYSTROKE_EXTERNAL,
+			/^zod(?:\/|$)/,
+			...LIBRARY_EXTERNAL_DEPS
+		],
+		onlyBundle: false
+	};
+}
+/**
+* Published entry packages (cli, keystroke, platform): declare bundled @keystrokehq/*
+* in dependencies (changesets release graph ignores devDependencies). Inlining is
+* driven by alwaysBundle below, not by dep kind. Runtime npm deps stay external.
+*
+* `@keystrokehq/keystroke` uses workspace:>=0.0.0 ranges so private primitive
+* patches do not cascade-publish the facade; CLI/platform keep workspace:*.
+*/
+function bundledEntryDepsConfig() {
+	return {
+		alwaysBundle: [/^@keystrokehq\//],
+		neverBundle: [...BUNDLED_ENTRY_EXTERNAL_DEPS],
+		onlyBundle: false
+	};
+}
+[...BETTER_AUTH_CLIENT_BUNDLE_PATTERNS];
+//#endregion
+//#region ../../packages/tsdown-config/index.js
+const baseTsdownConfig = {
+	format: ["esm", "cjs"],
+	dts: true,
+	clean: true,
+	sourcemap: true,
+	target: "node20",
+	deps: libraryBuildDepsConfig()
+};
+bundledEntryDepsConfig();
+//#endregion
+//#region ../../packages/build/dist/index.mjs
+/**
+* Build-time injection of the deterministic structural `callSiteId` into every
+* durable step call in a workflow source file, so the runtime emits
+* `step:<callSiteId>#<occurrence>` correlation ids (and `step:<callSiteId>`
+* credential consumer ids) that line up 1:1 with the canvas graph nodes the
+* deploy-time producer mints from the same source. There is no user-authored
+* step id — identity is entirely internal and injected here.
+*
+* Injection shape by kind (the `callSiteId` is the same id `computeCallSiteIds`
+* returns, which equals the producer's step-node id):
+* - action/sub-workflow `x.run(i)` → `x.run(i).__site("<id>")`       (builder method)
+* - agent   `a.prompt(i, opts?)`  → `__site` merged into the prompt options
+* - llm     `promptLlm(i, opts?)` → `__site` merged into the options
+* - hook    `ctx.hook(opts?)`     → `__site` merged into the options
+* - sleep   `ctx.sleep(d, opts?)` → `__site` merged into a second options arg
+*/
+function injectCallSiteIds(code, fileName) {
+	const sourceFile = ts.createSourceFile(fileName, code, ts.ScriptTarget.Latest, true, ts.ScriptKind.TS);
+	const located = locateWorkflow(sourceFile);
+	if (!located) return code;
+	const ids = computeCallSiteIds(sourceFile);
+	if (ids.size === 0) return code;
+	const edits = [];
+	for (const [node, id] of ids) {
+		const info = classifyCall(node, located.ctxParamName);
+		if (!info) continue;
+		if (info.callKind === "workflow-step") {
+			edits.push({
+				pos: node.getEnd(),
+				text: `.__site(${JSON.stringify(id)})`
+			});
+			continue;
+		}
+		if (info.callKind === "agent" || info.callKind === "llm") {
+			pushOptionsEdit(edits, node, id);
+			continue;
+		}
+		if (info.callKind === "hook") {
+			pushHookOptionsEdit(edits, node, id);
+			continue;
+		}
+		if (info.callKind === "wait") pushSleepOptionsEdit(edits, node, id);
+	}
+	if (edits.length === 0) return code;
+	edits.sort((a, b) => b.pos - a.pos);
+	let out = code;
+	for (const edit of edits) out = out.slice(0, edit.pos) + edit.text + out.slice(edit.pos);
+	return out;
+}
+/**
+* Merge `__site: "<id>"` into a call's options argument (agents / promptLlm).
+* - no 2nd arg            → append `, { __site: "id" }`
+* - 2nd arg object literal → insert `__site: "id", ` after its `{`
+* - 2nd arg anything else  → wrap as `{ ...orig, __site: "id" }`
+*/
+function pushOptionsEdit(edits, call, id) {
+	const literal = JSON.stringify(id);
+	const optionsArg = call.arguments[1];
+	if (!optionsArg) {
+		const firstArg = call.arguments[0];
+		const insertAt = firstArg ? firstArg.getEnd() : call.getEnd() - 1;
+		edits.push({
+			pos: insertAt,
+			text: `, { __site: ${literal} }`
+		});
+		return;
+	}
+	if (ts.isObjectLiteralExpression(optionsArg)) {
+		edits.push({
+			pos: optionsArg.getStart() + 1,
+			text: ` __site: ${literal},`
+		});
+		return;
+	}
+	edits.push({
+		pos: optionsArg.getStart(),
+		text: "{ ..."
+	});
+	edits.push({
+		pos: optionsArg.getEnd(),
+		text: `, __site: ${literal} }`
+	});
+}
+/** Merge `__site` into `ctx.hook(opts?)` — options are the first (only) argument. */
+function pushHookOptionsEdit(edits, call, id) {
+	const literal = JSON.stringify(id);
+	const optionsArg = call.arguments[0];
+	if (!optionsArg) {
+		edits.push({
+			pos: call.getEnd() - 1,
+			text: `{ __site: ${literal} }`
+		});
+		return;
+	}
+	if (ts.isObjectLiteralExpression(optionsArg)) {
+		edits.push({
+			pos: optionsArg.getStart() + 1,
+			text: ` __site: ${literal},`
+		});
+		return;
+	}
+	edits.push({
+		pos: optionsArg.getStart(),
+		text: "{ ..."
+	});
+	edits.push({
+		pos: optionsArg.getEnd(),
+		text: `, __site: ${literal} }`
+	});
+}
+/** Append `{ __site }` as the second arg to `ctx.sleep(duration)`. */
+function pushSleepOptionsEdit(edits, call, id) {
+	const literal = JSON.stringify(id);
+	const durationArg = call.arguments[0];
+	const insertAt = durationArg ? durationArg.getEnd() : call.getEnd() - 1;
+	edits.push({
+		pos: insertAt,
+		text: `, { __site: ${literal} }`
+	});
+}
+function toPosix$5(path) {
+	return path.split(sep).join("/");
+}
+/**
+* Rolldown plugin that runs {@link injectCallSiteIds} over workflow source files
+* (and their same-file helpers) before transpile. Scoped to `src/workflows/` so
+* non-workflow modules are untouched; cross-file helpers stay unkeyed by design.
+*/
+function callSiteIdInjectionPlugin(options) {
+	const srcDir = options.srcDir ?? "src";
+	const workflowsPrefix = toPosix$5(`${options.root}/${srcDir}/workflows/`);
+	return {
+		name: "keystroke-call-site-ids",
+		transform(code, id) {
+			const normalized = toPosix$5(id);
+			if (!normalized.startsWith(workflowsPrefix) || !normalized.endsWith(".ts")) return null;
+			const transformed = injectCallSiteIds(code, normalized);
+			return transformed === code ? null : {
+				code: transformed,
+				map: null
+			};
+		}
+	};
+}
+const TEST_FILE = /\.(test|int\.test|spec)\.ts$/;
+function toPosix$4(path) {
+	return path.split(sep).join("/");
+}
+function collectTsFiles(dir, out) {
+	let entries;
+	try {
+		entries = readdirSync(dir);
+	} catch {
+		return;
+	}
+	for (const entry of entries) {
+		if (entry === "node_modules" || entry.startsWith(".")) continue;
+		const full = join(dir, entry);
+		if (statSync(full).isDirectory()) {
+			collectTsFiles(full, out);
+			continue;
+		}
+		if (entry.endsWith(".ts") && !TEST_FILE.test(entry)) out.push(full);
+	}
+}
+/**
+* Run the workflow-canvas reliability checks over every `src/**` module. Errors
+* (steps outside a workflow, steps nested as call arguments) block the build;
+* warnings (opaque code-blocks, dropped spread inputs) explain each degraded
+* construct. Best-effort per-file: an unparseable file is skipped, never fatal.
+*/
+function collectWorkflowDiagnostics(root, srcDir = "src") {
+	const srcRoot = join(root, srcDir);
+	if (!existsSync(srcRoot)) return [];
+	const files = [];
+	collectTsFiles(srcRoot, files);
+	const diagnostics = [];
+	for (const file of files) {
+		const rel = toPosix$4(relative(root, file));
+		try {
+			const source = readFileSync(file, "utf8");
+			diagnostics.push(...diagnoseWorkflowSource(source, rel));
+		} catch {}
+	}
+	return diagnostics;
+}
+function formatDiagnostic(diagnostic) {
+	return `  ${diagnostic.line !== void 0 ? `${diagnostic.fileName}:${diagnostic.line}:${diagnostic.column ?? 1}` : diagnostic.fileName}\n    ${diagnostic.message}`;
+}
+/** Throw when any blocking (error-severity) diagnostic is found. */
+function assertWorkflowDiagnosticErrorsFrom(diagnostics) {
+	const errors = diagnostics.filter((d) => d.severity === "error");
+	if (errors.length > 0) throw new Error(`Workflow canvas: ${errors.length} unsupported construct(s) must be fixed before deploy:\n${errors.map(formatDiagnostic).join("\n")}\n`);
+}
+/** Print soft (warning-severity) diagnostics after a successful build. */
+function warnWorkflowDiagnosticsFrom(diagnostics) {
+	const warnings = diagnostics.filter((d) => d.severity === "warning");
+	if (warnings.length > 0) console.warn(`\n⚠ Workflow canvas: ${warnings.length} construct(s) will render as a degraded (opaque) canvas:\n${warnings.map(formatDiagnostic).join("\n")}\n`);
+}
+const CACHE_DIR = ".keystroke/cache";
+const CACHE_KEY_FILE = "route-manifest.key";
+const CACHE_MANIFEST_DIR = "manifest";
+function cachePaths(projectRoot) {
+	const dir = join(projectRoot, CACHE_DIR);
+	return {
+		keyPath: join(dir, CACHE_KEY_FILE),
+		manifestDir: join(dir, CACHE_MANIFEST_DIR)
+	};
+}
+/** Fingerprint of integration package versions resolved from the project. */
+function integrationPackagesFingerprint(projectRoot) {
+	const hash = createHash("sha256");
+	const packageJsonPath = join(projectRoot, "package.json");
+	if (!existsSync(packageJsonPath)) return hash.digest("hex");
+	const raw = readFileSync(packageJsonPath, "utf8");
+	hash.update(raw);
+	let dependencies = {};
+	try {
+		dependencies = JSON.parse(raw).dependencies ?? {};
+	} catch {
+		return hash.digest("hex");
+	}
+	const require = createRequire(packageJsonPath);
+	for (const name of Object.keys(dependencies).sort()) {
+		if (!name.startsWith("@keystrokehq/")) continue;
+		try {
+			const resolved = require.resolve(`${name}/package.json`);
+			hash.update(name);
+			hash.update("\0");
+			hash.update(readFileSync(resolved, "utf8"));
+			hash.update("\0");
+		} catch {
+			hash.update(name);
+			hash.update("\0missing\0");
+		}
+	}
+	return hash.digest("hex");
+}
+/**
+* Content-addressed key for the deploy route-manifest. Invalidates when project
+* sources, build entries, ignore set, phase, or integration package versions change.
+*/
+function computeRouteManifestCacheKey(input) {
+	const hash = createHash("sha256");
+	hash.update(input.phase);
+	hash.update("\0");
+	hash.update(input.integrationFingerprint);
+	hash.update("\0");
+	for (const key of [...input.buildEntryKeys].sort()) {
+		hash.update(key);
+		hash.update("\0");
+	}
+	for (const file of [...input.ignoredFiles].sort()) {
+		hash.update(file);
+		hash.update("\0");
+	}
+	for (const file of [...input.sourceFiles].sort((a, b) => a.path.localeCompare(b.path))) {
+		hash.update(file.path);
+		hash.update("\0");
+		hash.update(file.hash);
+		hash.update("\0");
+	}
+	return hash.digest("hex");
+}
+/** True when `.keystroke/cache/route-manifest.key` matches `cacheKey`. */
+function isRouteManifestCacheHit(projectRoot, cacheKey) {
+	const { keyPath, manifestDir } = cachePaths(projectRoot);
+	if (!existsSync(keyPath) || !existsSync(join(manifestDir, "manifest.json"))) return false;
+	return readFileSync(keyPath, "utf8").trim() === cacheKey;
+}
+/** Restore cached modular manifest into `dist/.keystroke/` when the key matches. */
+function tryRestoreCachedRouteManifest(projectRoot, cacheKey) {
+	if (!isRouteManifestCacheHit(projectRoot, cacheKey)) return false;
+	const { manifestDir } = cachePaths(projectRoot);
+	const dest = join(projectRoot, "dist", ".keystroke");
+	mkdirSync(dest, { recursive: true });
+	for (const name of [
+		"manifest.json",
+		"modules",
+		"catalogs",
+		"assets",
+		"build-index.json"
+	]) {
+		const from = join(manifestDir, name);
+		if (!existsSync(from)) continue;
+		cpSync(from, join(dest, name), { recursive: true });
+	}
+	const assetsModule = join(manifestDir, "assets.mjs");
+	if (existsSync(assetsModule)) cpSync(assetsModule, join(dest, "assets.mjs"));
+	return existsSync(join(projectRoot, PROJECT_MANIFEST_REL_PATH));
+}
+/** Persist the just-emitted modular manifest into the deploy cache. */
+function storeCachedRouteManifest(projectRoot, cacheKey) {
+	const sourceMeta = join(projectRoot, "dist", ".keystroke");
+	if (!existsSync(join(sourceMeta, "manifest.json"))) return;
+	const { keyPath, manifestDir } = cachePaths(projectRoot);
+	rmSync(manifestDir, {
+		recursive: true,
+		force: true
+	});
+	mkdirSync(manifestDir, { recursive: true });
+	for (const name of [
+		"manifest.json",
+		"modules",
+		"catalogs",
+		"assets",
+		"assets.mjs",
+		"build-index.json"
+	]) {
+		const from = join(sourceMeta, name);
+		if (!existsSync(from)) continue;
+		cpSync(from, join(manifestDir, name), { recursive: true });
+	}
+	mkdirSync(dirname(keyPath), { recursive: true });
+	writeFileSync(keyPath, `${cacheKey}\n`);
+}
+/**
+* True when a prior deploy `dist/` still has the compiled outputs for every
+* build entry (so we can skip tsdown when the content-hash cache hits).
+*/
+function distDeployOutputsPresent(projectRoot, buildEntries) {
+	const distRoot = join(projectRoot, "dist");
+	if (!existsSync(distRoot)) return false;
+	for (const entryKey of Object.keys(buildEntries)) if (!existsSync(join(distRoot, entryKey === "config" ? "config.mjs" : `${entryKey}.mjs`))) return false;
+	if (!existsSync(join(distRoot, ".keystroke", "assets.mjs"))) return false;
+	return true;
+}
+const SKIP_DIRS = new Set([".git", "node_modules"]);
+/** Content hash of every file under a skill/files pack directory. */
+function hashAssetPackDir(dirPath) {
+	const hash = createHash("sha256");
+	const walk = (current) => {
+		for (const name of readdirSync(current).sort()) {
+			if (SKIP_DIRS.has(name)) continue;
+			const abs = join(current, name);
+			const st = statSync(abs);
+			if (st.isDirectory()) {
+				walk(abs);
+				continue;
+			}
+			if (!st.isFile()) continue;
+			hash.update(relative(dirPath, abs).replace(/\\/g, "/"));
+			hash.update("\0");
+			hash.update(readFileSync(abs));
+			hash.update("\0");
+		}
+	};
+	if (!statSync(dirPath, { throwIfNoEntry: false })?.isDirectory()) return hash.digest("hex");
+	walk(dirPath);
+	return hash.digest("hex");
+}
+function listPackIds(rootPath) {
+	if (!statSync(rootPath, { throwIfNoEntry: false })?.isDirectory()) return [];
+	return readdirSync(rootPath).filter((name) => !SKIP_DIRS.has(name)).filter((name) => statSync(join(rootPath, name)).isDirectory()).sort();
+}
+function shardRelPath(kind, id) {
+	return `${kind}/${id}.json`;
+}
+function readIndex(assetsRoot) {
+	const path = join(assetsRoot, "index.json");
+	if (!existsSync(path)) return;
+	try {
+		return JSON.parse(readFileSync(path, "utf8"));
+	} catch {
+		return;
+	}
+}
+function loadShard(assetsRoot, rel) {
+	const abs = join(assetsRoot, rel);
+	if (!existsSync(abs)) return;
+	try {
+		return JSON.parse(readFileSync(abs, "utf8"));
+	} catch {
+		return;
+	}
+}
+function renderAssetModule$3(manifest) {
+	return `export default ${JSON.stringify(manifest)};\n`;
+}
+function packKind(input) {
+	const kindRoot = join(input.projectRoot, input.srcDir, input.kind);
+	const prevById = new Map((input.kind === "skills" ? input.previous?.skills : input.previous?.files)?.map((ref) => [ref.id, ref]) ?? []);
+	const packs = {};
+	const refs = [];
+	const wrote = [];
+	const skipped = [];
+	for (const id of listPackIds(kindRoot)) {
+		const packDir = join(kindRoot, id);
+		const contentHash = hashAssetPackDir(packDir);
+		const path = shardRelPath(input.kind, id);
+		const existing = prevById.get(id)?.contentHash === contentHash ? loadShard(input.assetsRoot, path) : void 0;
+		let packed;
+		if (existing) {
+			packed = existing;
+			skipped.push(path);
+		} else {
+			packed = packDirFromDisk(packDir);
+			const abs = join(input.assetsRoot, path);
+			mkdirSync(dirname(abs), { recursive: true });
+			writeFileSync(abs, `${JSON.stringify(packed)}\n`);
+			wrote.push(path);
+		}
+		packs[id] = packed;
+		refs.push({
+			id,
+			path,
+			contentHash
+		});
+	}
+	return {
+		packs,
+		refs,
+		wrote,
+		skipped
+	};
+}
+function removeOrphanShards(assetsRoot, kind, keep) {
+	const kindDir = join(assetsRoot, kind);
+	if (!existsSync(kindDir)) return;
+	for (const name of readdirSync(kindDir)) {
+		if (!name.endsWith(".json")) continue;
+		const rel = `${kind}/${name}`;
+		if (!keep.has(rel)) rmSync(join(kindDir, name), { force: true });
+	}
+}
+/**
+* Pack `src/skills` + `src/files` into per-pack shards with content-hash skip.
+* Composes `dist/.keystroke/assets.mjs` only when at least one shard changed
+* (or the composed module is missing) so the runtime loader stays unchanged.
+*/
+function packModularProjectAssets(input) {
+	const srcDir = input.srcDir ?? "src";
+	const outDir = input.outDir ?? "dist";
+	const keystrokeDir = join(input.projectRoot, outDir, ".keystroke");
+	const assetsRoot = join(keystrokeDir, "assets");
+	mkdirSync(assetsRoot, { recursive: true });
+	const previous = readIndex(assetsRoot);
+	const skills = packKind({
+		projectRoot: input.projectRoot,
+		srcDir,
+		kind: "skills",
+		assetsRoot,
+		previous
+	});
+	const files = packKind({
+		projectRoot: input.projectRoot,
+		srcDir,
+		kind: "files",
+		assetsRoot,
+		previous
+	});
+	removeOrphanShards(assetsRoot, "skills", new Set(skills.refs.map((ref) => ref.path)));
+	removeOrphanShards(assetsRoot, "files", new Set(files.refs.map((ref) => ref.path)));
+	const index = {
+		version: 1,
+		skills: skills.refs,
+		files: files.refs
+	};
+	writeFileSync(join(assetsRoot, "index.json"), `${JSON.stringify(index)}\n`);
+	const manifest = {
+		skills: skills.packs,
+		files: files.packs
+	};
+	const assetsModulePath = join(keystrokeDir, "assets.mjs");
+	const wroteShards = [...skills.wrote, ...files.wrote];
+	const skippedShards = [...skills.skipped, ...files.skipped];
+	const prevSkillIds = (previous?.skills ?? []).map((r) => r.id).join("\0");
+	const nextSkillIds = skills.refs.map((r) => r.id).join("\0");
+	const prevFileIds = (previous?.files ?? []).map((r) => r.id).join("\0");
+	const nextFileIds = files.refs.map((r) => r.id).join("\0");
+	const membershipChanged = prevSkillIds !== nextSkillIds || prevFileIds !== nextFileIds;
+	const anyDirty = wroteShards.length > 0 || !existsSync(assetsModulePath) || membershipChanged;
+	let wroteAssetsModule = false;
+	if (anyDirty) {
+		writeFileSync(assetsModulePath, renderAssetModule$3(manifest));
+		wroteAssetsModule = true;
+	}
+	return {
+		manifest,
+		index,
+		wroteShards,
+		skippedShards,
+		wroteAssetsModule
+	};
+}
+/** Relative path under project root. */
+const BUILD_INDEX_REL_PATH = "dist/.keystroke/build-index.json";
+function toPosix$3(path) {
+	return path.replace(/\\/g, "/");
+}
+function sha256Bytes(data) {
+	return createHash("sha256").update(data).digest("hex");
+}
+function compactJson(value) {
+	return `${JSON.stringify(value)}\n`;
+}
+/** sha256 over sorted (path, file bytes) for project-relative inputs. */
+function hashSourceInputs(projectRoot, inputs) {
+	const hash = createHash("sha256");
+	for (const rel of [...inputs].sort()) {
+		hash.update(rel);
+		hash.update("\0");
+		const abs = join(projectRoot, rel);
+		if (existsSync(abs) && statSync(abs).isFile()) hash.update(readFileSync(abs));
+		else hash.update("missing");
+		hash.update("\0");
+	}
+	return hash.digest("hex");
+}
+/** Fingerprint bundled package.json files (version bumps dirty consumers). */
+function hashBundledPackages(projectRoot, packages) {
+	const hash = createHash("sha256");
+	const packageJsonPath = join(projectRoot, "package.json");
+	if (!existsSync(packageJsonPath)) return hash.digest("hex");
+	const require = createRequire(packageJsonPath);
+	for (const name of [...packages].sort()) {
+		hash.update(name);
+		hash.update("\0");
+		try {
+			const resolved = require.resolve(`${name}/package.json`);
+			hash.update(readFileSync(resolved, "utf8"));
+		} catch {
+			hash.update("missing");
+		}
+		hash.update("\0");
+	}
+	return hash.digest("hex");
+}
+function buildIndexPath(projectRoot) {
+	return join(projectRoot, BUILD_INDEX_REL_PATH);
+}
+function tryReadBuildIndex(projectRoot) {
+	const path = buildIndexPath(projectRoot);
+	if (!existsSync(path)) return;
+	try {
+		const parsed = JSON.parse(readFileSync(path, "utf8"));
+		if (parsed.version !== 1 || typeof parsed.entries !== "object") return;
+		return parsed;
+	} catch {
+		return;
+	}
+}
+function writeBuildIndex(projectRoot, index) {
+	const path = buildIndexPath(projectRoot);
+	mkdirSync(dirname(path), { recursive: true });
+	writeFileSync(path, compactJson(index));
+}
+/**
+* Compare on-disk build-index to current sources / bundled package fingerprints.
+* Does not run the bundler.
+*/
+function listDirtyEntries(projectRoot, currentEntryKeys) {
+	const index = tryReadBuildIndex(projectRoot);
+	const expected = [...currentEntryKeys].filter((key) => key !== "config").sort();
+	if (!index) return {
+		dirty: expected,
+		forceFull: true,
+		reason: "missing build-index"
+	};
+	const indexed = Object.keys(index.entries).sort();
+	if (indexed.length !== expected.length || indexed.some((key, i) => key !== expected[i])) return {
+		dirty: expected,
+		forceFull: true,
+		reason: "entry membership changed"
+	};
+	const dirty = [];
+	for (const key of expected) {
+		const entry = index.entries[key];
+		if (!existsSync(join(projectRoot, "dist", entry.artifactPath))) {
+			dirty.push(key);
+			continue;
+		}
+		if (hashSourceInputs(projectRoot, entry.inputs) !== entry.sourceHash) {
+			dirty.push(key);
+			continue;
+		}
+		if (hashBundledPackages(projectRoot, entry.packages) !== entry.packagesHash) dirty.push(key);
+	}
+	return {
+		dirty,
+		forceFull: false
+	};
+}
+/** Default manifest shard paths for an entry key (best-effort). */
+function defaultManifestPathsForEntry(entryKey) {
+	const [kind, ...rest] = entryKey.split("/");
+	const id = rest.join("/");
+	if (!kind || !id) return [];
+	if (kind === "agents") return [`modules/agents/${id}.json`];
+	if (kind === "workflows") return [`modules/workflows/${id}.json`, `modules/workflows/${id}.flow.json`];
+	if (kind === "triggers") return [`modules/triggers/${id}.json`];
+	if (kind === "actions") return ["catalogs/actions.json"];
+	return [];
+}
+/** Build a BuildIndexEntry from closure facts + emitted artifact bytes. */
+function makeBuildIndexEntry(input) {
+	return {
+		sourceHash: hashSourceInputs(input.projectRoot, input.inputs),
+		artifactHash: sha256Bytes(input.artifactBytes),
+		artifactPath: toPosix$3(input.artifactPath),
+		inputs: [...input.inputs].sort(),
+		packages: [...input.packages].sort(),
+		packagesHash: hashBundledPackages(input.projectRoot, input.packages),
+		manifestPaths: defaultManifestPathsForEntry(input.entryKey)
+	};
+}
+function toPosix$2(path) {
+	return path.split(sep).join("/");
+}
+function projectRelativeModuleId$1(root, id) {
+	if (id.startsWith("\0") || id.includes("\0") || id.startsWith("node:")) return null;
+	let absolute = id;
+	if (id.startsWith("file://")) absolute = fileURLToPath(id);
+	if (!isAbsolute(absolute) && !absolute.startsWith(".")) return null;
+	const normalizedRoot = normalizeBuildFilePath(root);
+	let normalizedAbsolute;
+	try {
+		normalizedAbsolute = normalizeBuildFilePath(absolute);
+	} catch {
+		return null;
+	}
+	const relativePath = toPosix$2(relative(normalizedRoot, normalizedAbsolute));
+	if (!relativePath || relativePath.startsWith("..") || relativePath.includes("node_modules/") || relativePath.startsWith("node_modules/")) return null;
+	return relativePath;
+}
+function packageNameFromModuleId$1(id) {
+	if (id.startsWith("\0") || id.includes("\0") || id.startsWith("node:")) return null;
+	let absolute = id;
+	try {
+		if (id.startsWith("file://")) absolute = fileURLToPath(id);
+	} catch {
+		return null;
+	}
+	const normalized = absolute.replace(/\\/g, "/");
+	const index = normalized.lastIndexOf("/node_modules/");
+	if (index < 0) return null;
+	const rest = normalized.slice(index + 14);
+	if (!rest || rest.startsWith(".")) return null;
+	if (rest.startsWith("@")) {
+		const parts = rest.split("/");
+		if (parts.length < 2 || !parts[0] || !parts[1]) return null;
+		return `${parts[0]}/${parts[1]}`;
+	}
+	return rest.split("/")[0] || null;
+}
+function isFrameworkExternalPackage(name) {
+	if (!name.startsWith("@keystrokehq/")) return false;
+	const pkg = name.slice(13).split("/")[0] ?? "";
+	return RUNTIME_KEYSTROKE_PACKAGES.has(pkg);
+}
+/**
+* Collect per-entry source inputs + bundled packages from the emit graph.
+* Used to write `build-index.json` after tsdown.
+*/
+function entryClosurePlugin(options) {
+	const root = normalizeBuildFilePath(options.root);
+	return {
+		name: "keystroke-entry-closure",
+		generateBundle(_outputOptions, bundle) {
+			const closures = /* @__PURE__ */ new Map();
+			for (const output of Object.values(bundle)) {
+				if (output.type !== "chunk" || !output.isEntry) continue;
+				const entryKey = output.name.replace(/\\/g, "/");
+				if (entryKey === "config" || entryKey.includes("\0")) continue;
+				if (!entryKey.startsWith("agents/") && !entryKey.startsWith("actions/") && !entryKey.startsWith("workflows/") && !entryKey.startsWith("triggers/")) continue;
+				const inputs = /* @__PURE__ */ new Set();
+				const packages = /* @__PURE__ */ new Set();
+				const moduleIds = "moduleIds" in output && Array.isArray(output.moduleIds) ? output.moduleIds : Object.keys(output.modules ?? {});
+				for (const moduleId of moduleIds) {
+					const rel = projectRelativeModuleId$1(root, moduleId);
+					if (rel) inputs.add(rel);
+					const pkg = packageNameFromModuleId$1(moduleId);
+					if (pkg && !isFrameworkExternalPackage(pkg) && pkg !== "zod") packages.add(pkg);
+				}
+				if (output.facadeModuleId) {
+					const entryRel = projectRelativeModuleId$1(root, output.facadeModuleId);
+					if (entryRel) inputs.add(entryRel);
+				}
+				closures.set(entryKey, {
+					inputs: [...inputs].sort(),
+					packages: [...packages].sort()
+				});
+			}
+			options.onClosures(closures);
+		}
+	};
+}
+const ASSETS_MODULE$2 = "@keystrokehq/assets";
+const VIRTUAL_PREFIX$1 = `\0${ASSETS_MODULE$2}:`;
+function renderAssetModule$2(manifest) {
+	return `export default ${JSON.stringify(manifest)};\n`;
+}
+/** Resolve `@keystrokehq/assets` without re-packing on every entry. */
+function agentAssetsResolvePlugin(manifest) {
+	return {
+		name: "keystroke-assets-resolve",
+		resolveId(source) {
+			if (source !== ASSETS_MODULE$2) return null;
+			return `${VIRTUAL_PREFIX$1}manifest`;
+		},
+		load(id) {
+			if (id !== `${VIRTUAL_PREFIX$1}manifest`) return null;
+			return renderAssetModule$2(manifest);
+		}
+	};
+}
+/**
+* Build each entry in isolation so local imports are inlined (self-contained
+* `.mjs`) and closures include transitive project sources — same contract as
+* `buildFilteredApp`.
+*/
+async function buildSelfContainedEntries(options) {
+	const root = options.root;
+	const srcDir = options.srcDir ?? "src";
+	const outDir = options.outDir ?? "dist";
+	const phase = options.phase ?? "build";
+	const distRoot = join(root, outDir);
+	const clean = options.clean ?? true;
+	const allEntries = {
+		...options.configEntry ? { config: options.configEntry } : {},
+		...options.buildEntries
+	};
+	const entryKeys = Object.keys(allEntries).sort();
+	if (entryKeys.length === 0) throw new Error("Nothing to build — add keystroke.config.ts or modules under src/");
+	const dirtySet = new Set(options.dirtyKeys && options.dirtyKeys.length > 0 ? options.dirtyKeys : entryKeys.filter((key) => key !== "config").concat(options.configEntry ? ["config"] : []));
+	if (options.configEntry && (clean || dirtySet.size > 0)) dirtySet.add("config");
+	if (clean && existsSync(distRoot)) rmSync(distRoot, {
+		recursive: true,
+		force: true
+	});
+	const packed = packModularProjectAssets({
+		projectRoot: root,
+		srcDir,
+		outDir
+	});
+	const closures = /* @__PURE__ */ new Map();
+	const previous = tryReadBuildIndex(root);
+	for (const entryKey of [...dirtySet].sort()) {
+		const entryPath = allEntries[entryKey];
+		if (!entryPath) continue;
+		const plugins = [
+			keystrokeIgnoreGuardPlugin({
+				root,
+				ignoredFiles: options.ignoredFiles
+			}),
+			agentAssetsResolvePlugin(packed.manifest),
+			entryClosurePlugin({
+				root,
+				onClosures: (next) => {
+					for (const [key, value] of next) closures.set(key, value);
+				}
+			})
+		];
+		if (entryKey.startsWith("workflows/")) plugins.splice(1, 0, callSiteIdInjectionPlugin({
+			root,
+			srcDir
+		}));
+		await build(mergeConfig(baseTsdownConfig, {
+			entry: { [entryKey]: entryPath },
+			format: ["esm"],
+			outDir: distRoot,
+			clean: false,
+			dts: false,
+			sourcemap: phase === "deploy" ? false : true,
+			...phase === "deploy" ? { logLevel: "error" } : {},
+			loader: { ".md": "text" },
+			deps: userAppBuildDepsConfig(),
+			plugins
+		}));
+	}
+	const entries = {};
+	for (const key of Object.keys(options.buildEntries).sort()) {
+		if (closures.has(key)) {
+			const closure = closures.get(key);
+			const artifactPath = `${key}.mjs`;
+			const abs = join(distRoot, artifactPath);
+			if (!existsSync(abs)) continue;
+			entries[key] = makeBuildIndexEntry({
+				projectRoot: root,
+				entryKey: key,
+				inputs: closure.inputs,
+				packages: closure.packages,
+				artifactPath,
+				artifactBytes: readFileSync(abs)
+			});
+			continue;
+		}
+		if (previous?.entries[key]) entries[key] = previous.entries[key];
+	}
+	const index = {
+		version: 1,
+		integrationFingerprint: integrationPackagesFingerprint(root),
+		entries
+	};
+	writeBuildIndex(root, index);
+	return {
+		closures,
+		index
+	};
+}
+/** Analyzer stdout / plan digest contract version for Modal Precise Deploy. */
+const ANALYZER_CONTRACT_VERSION = "safe-filtered-deploy-v3";
+const PACKAGE_MANIFEST_FILES = new Set(["package.json"]);
+const LOCKFILE_NAMES = new Set([
+	"package-lock.json",
+	"pnpm-lock.yaml",
+	"yarn.lock",
+	"bun.lock",
+	"bun.lockb",
+	"npm-shrinkwrap.json"
+]);
+function toPosix(path) {
+	return path.split(sep).join("/");
+}
+function requireFull(code, reason) {
+	return {
+		requireFull: true,
+		code,
+		reason
+	};
+}
+function isDeployableResourceKey(key) {
+	return key.startsWith("agents/") || key.startsWith("workflows/");
+}
+function kindFromResourceKey(key) {
+	if (key.startsWith("agents/")) return "agent";
+	if (key.startsWith("workflows/")) return "workflow";
+	return null;
+}
+/** Normalize caller paths to project-relative posix form. */
+function normalizeProjectRelativePath(root, path) {
+	const withoutDot = path.trim().replace(/\\/g, "/").replace(/^\.\//, "");
+	const absolute = isAbsolute(withoutDot) ? withoutDot : join(normalizeBuildFilePath(root), withoutDot);
+	const relativePath = toPosix(relative(normalizeBuildFilePath(root), normalizeBuildFilePath(absolute)));
+	if (!relativePath || relativePath === "." || relativePath.startsWith("..")) throw new Error(`Path "${path}" is outside project root`);
+	return relativePath;
+}
+function basenamePosix(path) {
+	const parts = path.split("/");
+	return parts[parts.length - 1] ?? path;
+}
+function isPackageManifestPath(path) {
+	return PACKAGE_MANIFEST_FILES.has(basenamePosix(path));
+}
+function isLockfilePath(path) {
+	return LOCKFILE_NAMES.has(basenamePosix(path));
+}
+function normalizeChanges(root, changedPaths) {
+	const byPath = /* @__PURE__ */ new Map();
+	for (const change of changedPaths) {
+		const raw = typeof change === "string" ? {
+			path: change,
+			kind: "modified"
+		} : change;
+		let path;
+		try {
+			path = normalizeProjectRelativePath(root, raw.path);
+		} catch {
+			return requireFull("unproven_safe", `Changed path "${raw.path}" cannot be normalized to a project-relative source path`);
+		}
+		let previousPath;
+		if (raw.previousPath) try {
+			previousPath = normalizeProjectRelativePath(root, raw.previousPath);
+		} catch {
+			return requireFull("unproven_safe", `Rename previous path "${raw.previousPath}" cannot be normalized`);
+		}
+		const normalized = {
+			path,
+			kind: raw.kind,
+			...previousPath ? { previousPath } : {}
+		};
+		const existing = byPath.get(path);
+		if (existing && existing.kind !== normalized.kind) return requireFull("ambiguous_ownership", `Changed path "${path}" has ambiguous change kinds (${existing.kind} vs ${normalized.kind})`);
+		byPath.set(path, normalized);
+	}
+	return [...byPath.values()];
+}
+function projectRelativeModuleId(root, id) {
+	if (id.startsWith("\0") || id.includes("\0") || id.startsWith("node:")) return null;
+	let absolute = id;
+	if (id.startsWith("file://")) absolute = fileURLToPath(id);
+	if (!isAbsolute(absolute) && !absolute.startsWith(".")) return null;
+	const normalizedRoot = normalizeBuildFilePath(root);
+	let normalizedAbsolute;
+	try {
+		normalizedAbsolute = normalizeBuildFilePath(absolute);
+	} catch {
+		return null;
+	}
+	if (!normalizedAbsolute.startsWith(normalizedRoot + sep) && normalizedAbsolute !== normalizedRoot) {
+		const rel = toPosix(relative(normalizedRoot, normalizedAbsolute));
+		if (!rel || rel.startsWith("..") || rel.includes("node_modules/")) return null;
+	}
+	const relativePath = toPosix(relative(normalizedRoot, normalizedAbsolute));
+	if (!relativePath || relativePath.startsWith("..") || relativePath.includes("node_modules/") || relativePath.startsWith("node_modules/")) return null;
+	return relativePath;
+}
+/** Extract a package name from a resolved module id under node_modules. */
+function packageNameFromModuleId(id) {
+	if (id.startsWith("\0") || id.includes("\0") || id.startsWith("node:")) return null;
+	let absolute = id;
+	try {
+		if (id.startsWith("file://")) absolute = fileURLToPath(id);
+	} catch {
+		return null;
+	}
+	const normalized = absolute.replace(/\\/g, "/");
+	const index = normalized.lastIndexOf("/node_modules/");
+	if (index < 0) return null;
+	const rest = normalized.slice(index + 14);
+	if (!rest || rest.startsWith(".")) return null;
+	if (rest.startsWith("@")) {
+		const parts = rest.split("/");
+		if (parts.length < 2 || !parts[0] || !parts[1]) return null;
+		return `${parts[0]}/${parts[1]}`;
+	}
+	return rest.split("/")[0] || null;
+}
+function isRuntimeExternalPackage(name) {
+	if (!name.startsWith("@keystrokehq/")) return false;
+	const pkg = name.slice(13).split("/")[0] ?? "";
+	return RUNTIME_KEYSTROKE_PACKAGES.has(pkg);
+}
+function readDependencyMap(packageJsonContents) {
+	try {
+		const parsed = JSON.parse(packageJsonContents);
+		const map = /* @__PURE__ */ new Map();
+		for (const field of [
+			"dependencies",
+			"devDependencies",
+			"optionalDependencies",
+			"peerDependencies"
+		]) {
+			const value = parsed[field];
+			if (!value || typeof value !== "object" || Array.isArray(value)) continue;
+			for (const [name, version] of Object.entries(value)) if (typeof version === "string") map.set(name, version);
+		}
+		return map;
+	} catch {
+		return null;
+	}
+}
+function changedDependencyNames(base, draft) {
+	const names = new Set([...base.keys(), ...draft.keys()]);
+	const changed = [];
+	for (const name of names) if ((base.get(name) ?? null) !== (draft.get(name) ?? null)) changed.push(name);
+	return changed.sort();
+}
+function collectModuleGraphPlugin(graph) {
+	return {
+		name: "keystroke-collect-module-graph",
+		async resolveId(source, importer, resolveOptions) {
+			if (!importer || resolveOptions?.isEntry) return null;
+			if (!await this.resolve(source, importer, {
+				...resolveOptions,
+				skipSelf: true
+			})) {
+				const existing = graph.unresolvedByImporter.get(importer) ?? [];
+				existing.push(source);
+				graph.unresolvedByImporter.set(importer, existing);
+			}
+			return null;
+		},
+		buildEnd() {
+			for (const id of this.getModuleIds()) {
+				const info = this.getModuleInfo(id);
+				if (!info) continue;
+				graph.byId.set(id, {
+					importedIds: [...info.importedIds],
+					dynamicallyImportedIds: [...info.dynamicallyImportedIds]
+				});
+			}
+		}
+	};
+}
+function closureFromGraph(root, resourceKey, entryAbsolute, graph) {
+	const kind = kindFromResourceKey(resourceKey);
+	if (!kind) throw new Error(`Not a deployable workflow/agent key: ${resourceKey}`);
+	const entryNormalized = normalizeBuildFilePath(entryAbsolute);
+	const queue = [];
+	for (const id of graph.byId.keys()) try {
+		if (normalizeBuildFilePath(id.startsWith("file://") ? fileURLToPath(id) : id) === entryNormalized) {
+			queue.push(id);
+			break;
+		}
+	} catch {}
+	if (queue.length === 0) {
+		const entryRel = toPosix(relative(normalizeBuildFilePath(root), entryNormalized));
+		for (const id of graph.byId.keys()) if (projectRelativeModuleId(root, id) === entryRel) {
+			queue.push(id);
+			break;
+		}
+	}
+	const seen = /* @__PURE__ */ new Set();
+	const inputs = /* @__PURE__ */ new Set();
+	const packages = /* @__PURE__ */ new Set();
+	let hasDynamicImports = false;
+	const unresolvedImports = /* @__PURE__ */ new Set();
+	while (queue.length > 0) {
+		const id = queue.pop();
+		if (seen.has(id)) continue;
+		seen.add(id);
+		const relativePath = projectRelativeModuleId(root, id);
+		if (relativePath) inputs.add(relativePath);
+		const packageName = packageNameFromModuleId(id);
+		if (packageName && !isRuntimeExternalPackage(packageName)) packages.add(packageName);
+		for (const unresolved of graph.unresolvedByImporter.get(id) ?? []) unresolvedImports.add(unresolved);
+		const node = graph.byId.get(id);
+		if (!node) continue;
+		if (node.dynamicallyImportedIds.length > 0) hasDynamicImports = true;
+		for (const imported of node.importedIds) queue.push(imported);
+		for (const imported of node.dynamicallyImportedIds) queue.push(imported);
+	}
+	const entryPath = projectRelativeModuleId(root, entryAbsolute) ?? toPosix(relative(normalizeBuildFilePath(root), entryNormalized));
+	inputs.add(entryPath);
+	return {
+		resourceKey,
+		kind,
+		entryPath,
+		inputs: [...inputs].sort(),
+		packages: [...packages].sort(),
+		hasDynamicImports,
+		unresolvedImports: [...unresolvedImports].sort()
+	};
+}
+/**
+* Analyze bundler input closures for every deployable workflow and agent entry.
+*
+* Uses the same tsdown/rolldown resolver settings as artifact builds so aliases,
+* package exports, TS resolution, and externals match production.
+*/
+async function analyzeDeployableClosures(options = {}) {
+	const root = normalizeBuildFilePath(options.root ?? process.cwd());
+	const walked = walkProject(root, {
+		srcDir: options.srcDir ?? "src",
+		phase: options.phase ?? "deploy"
+	});
+	const entries = {};
+	for (const [key, absolute] of Object.entries(walked.buildEntries)) if (isDeployableResourceKey(key)) entries[key] = absolute;
+	const entryList = Object.entries(entries).sort(([a], [b]) => a.localeCompare(b));
+	if (entryList.length === 0) return {
+		closures: [],
+		failures: []
+	};
+	mkdirSync(join(root, ".keystroke"), { recursive: true });
+	const scratchRoot = mkdtempSync(join(root, ".keystroke", "closure-analyze-"));
+	const previous = process.cwd();
+	const closures = [];
+	const failures = [];
+	try {
+		process.chdir(root);
+		for (const [resourceKey, entryPath] of entryList) {
+			const graph = {
+				byId: /* @__PURE__ */ new Map(),
+				unresolvedByImporter: /* @__PURE__ */ new Map()
+			};
+			const outDir = join(scratchRoot, "dist", resourceKey.replaceAll("/", "__"));
+			try {
+				await build(mergeConfig(baseTsdownConfig, {
+					entry: { [resourceKey]: entryPath },
+					format: ["esm"],
+					outDir,
+					clean: true,
+					dts: false,
+					sourcemap: false,
+					logLevel: "error",
+					loader: { ".md": "text" },
+					deps: userAppBuildDepsConfig(),
+					plugins: [collectModuleGraphPlugin(graph)]
+				}));
+				const closure = closureFromGraph(root, resourceKey, entryPath, graph);
+				closures.push(closure);
+			} catch (error) {
+				const message = error instanceof Error ? error.message : String(error);
+				failures.push({
+					resourceKey,
+					reason: message
+				});
+			}
+		}
+	} finally {
+		process.chdir(previous);
+		rmSync(scratchRoot, {
+			recursive: true,
+			force: true
+		});
+	}
+	return {
+		closures,
+		failures
+	};
+}
+function ownershipIndex(closures) {
+	const index = /* @__PURE__ */ new Map();
+	for (const closure of closures) for (const input of closure.inputs) {
+		const owners = index.get(input) ?? [];
+		owners.push(closure.resourceKey);
+		index.set(input, owners);
+	}
+	for (const [path, owners] of index) index.set(path, [...new Set(owners)].sort());
+	return index;
+}
+function packageOwnershipIndex(closures) {
+	const packageOwners = /* @__PURE__ */ new Map();
+	for (const closure of closures) for (const packageName of closure.packages) {
+		const owners = packageOwners.get(packageName) ?? [];
+		owners.push(closure.resourceKey);
+		packageOwners.set(packageName, owners);
+	}
+	for (const [packageName, owners] of packageOwners) packageOwners.set(packageName, [...new Set(owners)].sort());
+	return packageOwners;
+}
+function unionOwners(...lists) {
+	return [...new Set(lists.flatMap((list) => list ?? []))].sort();
+}
+function intersectsRequested(owners, requested) {
+	return owners.some((owner) => requested.has(owner));
+}
+function sortCandidateOps(ops) {
+	return [...ops].sort((a, b) => {
+		const byPath = a.path.localeCompare(b.path);
+		if (byPath !== 0) return byPath;
+		return a.op.localeCompare(b.op);
+	});
+}
+/**
+* Transition ownership for a changed path:
+* - added → D0 owners
+* - deleted → M0 owners
+* - modified → M0 ∪ D0 owners
+* - renamed → previousPath M0 ∪ new path D0 (promote both ops when either side matches)
+*/
+function transitionAttribution(change, draftOwnersByPath, mainOwnersByPath) {
+	if (change.kind === "renamed") {
+		if (!change.previousPath) return requireFull("ambiguous_ownership", `Renamed path "${change.path}" is missing previousPath; filtered deploy cannot attribute ownership`);
+		return {
+			owners: unionOwners(mainOwnersByPath.get(change.previousPath), draftOwnersByPath.get(change.path)),
+			ops: [{
+				path: change.previousPath,
+				op: "delete"
+			}, {
+				path: change.path,
+				op: "upsert"
+			}]
+		};
+	}
+	if (change.kind === "added") return {
+		owners: draftOwnersByPath.get(change.path) ?? [],
+		ops: [{
+			path: change.path,
+			op: "upsert"
+		}]
+	};
+	if (change.kind === "deleted") return {
+		owners: mainOwnersByPath.get(change.path) ?? [],
+		ops: [{
+			path: change.path,
+			op: "delete"
+		}]
+	};
+	return {
+		owners: unionOwners(mainOwnersByPath.get(change.path), draftOwnersByPath.get(change.path)),
+		ops: [{
+			path: change.path,
+			op: "upsert"
+		}]
+	};
+}
+function filteredSuccess(input) {
+	return {
+		requireFull: false,
+		resourceKeys: [...input.resourceKeys].sort(),
+		impactedResourceKeys: [...input.impactedResourceKeys].sort(),
+		expansions: [...input.expansions].sort((a, b) => a.resourceKey.localeCompare(b.resourceKey)),
+		sourceDelta: [...input.sourceDelta].sort(),
+		candidateOps: sortCandidateOps(input.candidateOps),
+		impactCompleteness: input.impactCompleteness,
+		warnings: [...input.warnings]
+	};
+}
+/**
+* Compute the smallest safe filtered resource set + source delta for a draft delta.
+*
+* Dual-graph (M0/D0) transition ownership promotes only paths attributable to
+* the requested resources. Impacts are M0 consumers of promoted paths (candidate
+* = M0 + sourceDelta). Incomplete main-impact enumeration is soft-unknown, not
+* a hard block.
+*/
+async function computeSafeFilteredDeploy(options) {
+	const root = normalizeBuildFilePath(options.root ?? process.cwd());
+	const srcDir = options.srcDir ?? "src";
+	const phase = options.phase ?? "deploy";
+	const normalized = normalizeChanges(root, options.changedPaths);
+	if ("requireFull" in normalized && normalized.requireFull) return normalized;
+	const changes = normalized;
+	const packageManifestChanges = [];
+	const lockfileChanges = [];
+	const sourceLikeChanges = [];
+	for (const change of changes) {
+		if (isPackageManifestPath(change.path)) {
+			packageManifestChanges.push(change);
+			continue;
+		}
+		if (isLockfilePath(change.path)) {
+			lockfileChanges.push(change);
+			continue;
+		}
+		sourceLikeChanges.push(change);
+	}
+	const selected = [...new Set(options.selectedResourceKeys)];
+	if (selected.length === 0) return requireFull("unknown_selected_key", "At least one selected resource key is required");
+	const draftAnalysis = options.closures !== void 0 ? {
+		closures: options.closures,
+		failures: options.failures ?? []
+	} : await analyzeDeployableClosures({
+		root,
+		srcDir,
+		phase
+	});
+	const draftClosures = draftAnalysis.closures;
+	const draftFailures = draftAnalysis.failures;
+	const draftByKey = new Map(draftClosures.map((closure) => [closure.resourceKey, closure]));
+	const draftFailedKeys = new Set(draftFailures.map((failure) => failure.resourceKey));
+	const mainClosures = options.mainClosures ?? draftClosures;
+	const mainFailures = options.mainClosures !== void 0 ? options.mainFailures ?? [] : draftFailures;
+	const mainByKey = new Map(mainClosures.map((closure) => [closure.resourceKey, closure]));
+	const mainFailedKeys = new Set(mainFailures.map((failure) => failure.resourceKey));
+	for (const key of selected) {
+		if (draftFailedKeys.has(key)) {
+			const failure = draftFailures.find((item) => item.resourceKey === key);
+			return requireFull("unproven_safe", `Selected resource "${key}" failed bundler analysis; filtered deploy cannot prove a complete closure` + (failure ? `: ${failure.reason}` : ""));
+		}
+		if (!draftByKey.has(key)) return requireFull("unknown_selected_key", `Unknown selected resource key "${key}". Use keys like agents/foo or workflows/bar`);
+	}
+	for (const key of selected) {
+		const closure = draftByKey.get(key);
+		if (closure.hasDynamicImports || closure.unresolvedImports.length > 0) return requireFull("dynamic_or_unresolved_import", `Selected resource "${key}" has dynamic or unresolved imports; filtered deploy cannot prove a complete closure`);
+	}
+	const draftOwnersByPath = ownershipIndex(draftClosures);
+	const mainOwnersByPath = ownershipIndex(mainClosures);
+	const mainPackageOwners = packageOwnershipIndex(mainClosures);
+	const requestedSet = new Set(selected);
+	const sourceDelta = /* @__PURE__ */ new Set();
+	const candidateOpsByKey = /* @__PURE__ */ new Map();
+	const expansions = /* @__PURE__ */ new Map();
+	const impactedSet = /* @__PURE__ */ new Set();
+	const warnings = [];
+	let impactCompleteness = "complete";
+	const markUnknown = (warning) => {
+		impactCompleteness = "unknown";
+		if (!warnings.includes(warning)) warnings.push(warning);
+	};
+	const addCandidateOp = (op) => {
+		const key = `${op.op}:${op.path}`;
+		candidateOpsByKey.set(key, op);
+		sourceDelta.add(op.path);
+	};
+	const markImpact = (resourceKey, sharedInputs, reason) => {
+		if (requestedSet.has(resourceKey)) return;
+		impactedSet.add(resourceKey);
+		const existing = expansions.get(resourceKey);
+		const mergedInputs = existing ? [...new Set([...existing.sharedInputs, ...sharedInputs])].sort() : [...sharedInputs].sort();
+		expansions.set(resourceKey, {
+			resourceKey,
+			reason: existing ? `${existing.reason}; ${reason}` : reason,
+			sharedInputs: mergedInputs
+		});
+	};
+	const selectedEntryPaths = new Set(selected.map((key) => draftByKey.get(key)?.entryPath).filter((path) => Boolean(path)));
+	for (const change of sourceLikeChanges) {
+		const attribution = transitionAttribution(change, draftOwnersByPath, mainOwnersByPath);
+		if ("requireFull" in attribution) return attribution;
+		const { owners, ops } = attribution;
+		if ((selectedEntryPaths.has(change.path) || change.previousPath != null && selectedEntryPaths.has(change.previousPath) || selected.some((key) => {
+			const mainEntry = mainByKey.get(key)?.entryPath;
+			return mainEntry === change.path || mainEntry === change.previousPath;
+		})) && !intersectsRequested(owners, requestedSet)) return requireFull("missing_ownership", `Changed path "${change.path}" must be included for the selected resource(s) but selected ownership cannot be proven`);
+		if (!intersectsRequested(owners, requestedSet)) continue;
+		for (const op of ops) addCandidateOp(op);
+		for (const op of ops) {
+			const mainOwners = mainOwnersByPath.get(op.path) ?? [];
+			for (const owner of mainOwners) {
+				if (requestedSet.has(owner)) continue;
+				const mainClosure = mainByKey.get(owner);
+				if (!mainClosure) {
+					if (mainFailedKeys.has(owner)) {
+						markUnknown(`Main-tip analysis failed for "${owner}"; additional owners of promoted path "${op.path}" may be hidden`);
+						continue;
+					}
+					markUnknown(`Promoted path "${op.path}" lists main owner "${owner}" without an analyzable main closure`);
+					continue;
+				}
+				if (mainClosure.hasDynamicImports || mainClosure.unresolvedImports.length > 0) markUnknown(`Impacted main resource "${owner}" has dynamic or unresolved imports; additional impacts may be hidden`);
+				markImpact(owner, [op.path], `Shared input ${`"${op.path}"`} also used by requested resource(s) on main`);
+			}
+		}
+	}
+	if (packageManifestChanges.length > 0 || lockfileChanges.length > 0) {
+		const packageResult = attributePackageChanges({
+			root,
+			packageManifestChanges,
+			lockfileChanges,
+			baseManifestFiles: options.baseManifestFiles ?? [],
+			mainClosures,
+			draftClosures,
+			requestedSet,
+			mainPackageOwners
+		});
+		if (packageResult.include) {
+			for (const path of packageResult.manifestDelta) addCandidateOp({
+				path,
+				op: "upsert"
+			});
+			for (const expansion of packageResult.expansions) markImpact(expansion.resourceKey, expansion.sharedInputs, expansion.reason);
+			if (packageResult.unknownCompleteness) for (const warning of packageResult.warnings) markUnknown(warning);
+		}
+	}
+	if (mainFailures.length > 0 && sourceDelta.size > 0) {
+		const failedList = [...mainFailedKeys].sort().join(", ");
+		if (![...sourceDelta].every((path) => selectedEntryPaths.has(path))) markUnknown(`Main-tip bundler analysis failed for deployable resource(s) ${failedList}; additional owners of promoted shared paths may be hidden`);
+	}
+	if (sourceDelta.size === 0) return filteredSuccess({
+		resourceKeys: selected,
+		impactedResourceKeys: [],
+		expansions: [],
+		sourceDelta: [],
+		candidateOps: [],
+		impactCompleteness: "complete",
+		warnings: []
+	});
+	return filteredSuccess({
+		resourceKeys: [...requestedSet, ...impactedSet],
+		impactedResourceKeys: [...impactedSet],
+		expansions: [...expansions.values()],
+		sourceDelta: [...sourceDelta],
+		candidateOps: [...candidateOpsByKey.values()],
+		impactCompleteness,
+		warnings
+	});
+}
+function attributePackageChanges(input) {
+	if (input.packageManifestChanges.length === 0) return { include: false };
+	if (input.baseManifestFiles.length === 0) return { include: false };
+	const draftPackageJsonPath = join(input.root, "package.json");
+	let draftPackageJson;
+	try {
+		draftPackageJson = readFileSync(draftPackageJsonPath, "utf8");
+	} catch {
+		return { include: false };
+	}
+	const basePackageJson = new Map(input.baseManifestFiles.map((file) => [file.path.replace(/\\/g, "/"), file.contents])).get("package.json");
+	if (basePackageJson == null) return { include: false };
+	const baseDeps = readDependencyMap(basePackageJson);
+	const draftDeps = readDependencyMap(draftPackageJson);
+	if (!baseDeps || !draftDeps) return { include: false };
+	const changedPackages = changedDependencyNames(baseDeps, draftDeps);
+	if (changedPackages.length === 0) return { include: false };
+	const runtimeChanged = changedPackages.filter((name) => isRuntimeExternalPackage(name));
+	const bundledChanged = changedPackages.filter((name) => !isRuntimeExternalPackage(name));
+	const selectedConsumesBundled = [...input.requestedSet].some((key) => {
+		const draft = input.draftClosures.find((item) => item.resourceKey === key);
+		const main = input.mainClosures.find((item) => item.resourceKey === key);
+		const packages = new Set([...draft?.packages ?? [], ...main?.packages ?? []]);
+		return bundledChanged.some((name) => packages.has(name));
+	});
+	if (runtimeChanged.length === 0 && !selectedConsumesBundled) return { include: false };
+	const expansions = /* @__PURE__ */ new Map();
+	const markImpact = (resourceKey, reason, sharedInputs) => {
+		if (input.requestedSet.has(resourceKey)) return;
+		const existing = expansions.get(resourceKey);
+		expansions.set(resourceKey, {
+			resourceKey,
+			reason: existing ? `${existing.reason}; ${reason}` : reason,
+			sharedInputs: [...new Set([...existing?.sharedInputs ?? [], ...sharedInputs])].sort()
+		});
+	};
+	if (runtimeChanged.length > 0) for (const closure of input.mainClosures) markImpact(closure.resourceKey, `Runtime package update (${runtimeChanged.map((name) => `"${name}"`).join(", ")}) requires rebuilding all resources from main`, runtimeChanged);
+	for (const packageName of bundledChanged) {
+		if (!selectedConsumesBundled) continue;
+		const owners = input.mainPackageOwners.get(packageName) ?? [];
+		for (const owner of owners) markImpact(owner, `Bundled package "${packageName}" changed and is imported by this resource`, [packageName]);
+	}
+	const manifestDelta = [...input.packageManifestChanges.map((change) => change.path), ...input.lockfileChanges.map((change) => change.path)].sort();
+	const warnings = [];
+	let unknownCompleteness = false;
+	if (input.lockfileChanges.length > 0) {
+		unknownCompleteness = true;
+		warnings.push("Lockfile included with selected package change; lockfile resolution may hide additional package consumers");
+	}
+	return {
+		include: true,
+		manifestDelta,
+		expansions: [...expansions.values()],
+		unknownCompleteness,
+		warnings
+	};
+}
+/** Build user agents, workflows, triggers, and config to `dist/`. */
+async function buildApp(options = {}) {
+	const root = options.root ?? process.cwd();
+	const srcDir = options.srcDir ?? "src";
+	const emitManifest = options.emitManifest ?? true;
+	const collectSources = options.collectSources ?? false;
+	const phase = options.phase ?? "build";
+	const previous = process.cwd();
+	const walked = walkProject(root, {
+		srcDir,
+		collectSources,
+		phase
+	});
+	const timings = {
+		bundleMs: 0,
+		manifestMs: 0,
+		manifestCacheHit: false,
+		bundleSkipped: false
+	};
+	const cacheKey = phase === "deploy" && collectSources && walked.sourceFiles.length > 0 ? computeRouteManifestCacheKey({
+		phase,
+		sourceFiles: walked.sourceFiles,
+		buildEntryKeys: Object.keys(walked.buildEntries),
+		ignoredFiles: walked.ignoredFiles,
+		integrationFingerprint: integrationPackagesFingerprint(root)
+	}) : null;
+	try {
+		process.chdir(root);
+		if (cacheKey && emitManifest && isRouteManifestCacheHit(root, cacheKey) && distDeployOutputsPresent(root, walked.buildEntries)) {
+			const manifestStarted = Date.now();
+			tryRestoreCachedRouteManifest(root, cacheKey);
+			timings.manifestCacheHit = true;
+			timings.bundleSkipped = true;
+			timings.manifestMs = Date.now() - manifestStarted;
+			return {
+				sourceFiles: walked.sourceFiles,
+				timings
+			};
+		}
+		const dirtyResult = listDirtyEntries(root, Object.keys(walked.buildEntries));
+		const skipBundle = !dirtyResult.forceFull && dirtyResult.dirty.length === 0 && distDeployOutputsPresent(root, walked.buildEntries);
+		const workflowDiagnostics = collectWorkflowDiagnostics(root, srcDir);
+		assertWorkflowDiagnosticErrorsFrom(workflowDiagnostics);
+		try {
+			if (skipBundle) {
+				packModularProjectAssets({
+					projectRoot: root,
+					srcDir,
+					outDir: options.outDir ?? "dist"
+				});
+				timings.bundleSkipped = true;
+			} else {
+				const bundleStarted = Date.now();
+				const configEntry = existsSync(join(root, "keystroke.config.ts")) ? join(root, "keystroke.config.ts") : void 0;
+				await buildSelfContainedEntries({
+					root,
+					srcDir,
+					outDir: options.outDir ?? "dist",
+					phase,
+					clean: dirtyResult.forceFull && (options.clean ?? true),
+					buildEntries: walked.buildEntries,
+					ignoredFiles: walked.ignoredFiles,
+					dirtyKeys: dirtyResult.forceFull ? void 0 : dirtyResult.dirty,
+					configEntry
+				});
+				timings.bundleMs = Date.now() - bundleStarted;
+			}
+		} finally {
+			warnWorkflowDiagnosticsFrom(workflowDiagnostics);
+		}
+		if (emitManifest) {
+			const manifestStarted = Date.now();
+			if (cacheKey && tryRestoreCachedRouteManifest(root, cacheKey)) timings.manifestCacheHit = true;
+			else {
+				const { emitStoredRouteManifestForProject } = await import("./dist-Dq1kkbLy.mjs");
+				await emitStoredRouteManifestForProject(root);
+				if (cacheKey) storeCachedRouteManifest(root, cacheKey);
+			}
+			timings.manifestMs = Date.now() - manifestStarted;
+		}
+	} finally {
+		process.chdir(previous);
+	}
+	return {
+		sourceFiles: walked.sourceFiles,
+		timings
+	};
+}
+//#endregion
+export { buildApp as a, computeSafeFilteredDeploy as c, normalizeProjectRelativePath as d, tryReadBuildIndex as f, assertWorkflowDiagnosticErrorsFrom as i, injectCallSiteIds as l, BUILD_INDEX_REL_PATH as n, callSiteIdInjectionPlugin as o, warnWorkflowDiagnosticsFrom as p, analyzeDeployableClosures as r, collectWorkflowDiagnostics as s, ANALYZER_CONTRACT_VERSION as t, listDirtyEntries as u };
+
+//# sourceMappingURL=dist-DJQnugPi.mjs.map