@keystrokehq/cli 0.1.148 → 0.1.150

package/dist/{program-DU1iPR-p.mjs → program-Bv7Wv_O4.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { A as resolvePlatformUrlForWebUrl, C as createCliConfig, D as getWebUrl, E as getPlatformUrl, M as ExpectedCliError, N as isExpectedCliError, O as DEFAULT_PLATFORM_URL, S as resolveCliRoot, T as getCredentialStorage, _ as isLocalSdkSpec, a as formatReleaseAgeBlockMessage, b as shouldUpdateCliVersion, c as detectManagerFromLockfile, d as installDependencies$1, f as installPlaygroundDependencies, g as ensureSdkCurrent, i as readPnpmMinimumReleaseAgeMinutes, j as parseCredentialStorage, l as buildPlaygroundWorkspace, m as resolvePackageManager, n as ensureMinimumReleaseAgeExclude, o as isReleaseAgeBlock, p as resolveGithubPackagesToken, r as computeReleaseAgeRetryAfter, s as detectCliInstall, t as runPackageManagerUpdate, u as detectPackageManager$2, v as fetchLatestCliRelease, w as getCliConfigDir, x as readCliVersion, y as resolveCliDistTag } from "./run-package-manager-update-C4uA6xWB.mjs";
 import { $ as DownloadActiveProjectArtifactResponseSchema, $i as CreateCreditsCheckoutRequestSchema, $n as SkillSummaryDetailResponseSchema, $r as WorkflowSummaryDetailResponseSchema, $t as OpenApiDiscoverResponseSchema, A as CreateApiKeyResponseSchema, Ai as CredentialConsumerListQuerySchema, An as ProjectGitStatusResponseSchema, Ar as UpdateOrganizationRequestSchema, At as ListApiKeysResponseSchema, B as CreateProjectArtifactRequestSchema, Bi as CLIENT_CHANNEL_HEADER, Bn as PublicFormSubmitResponseSchema, Br as UserPreferencesPatchSchema, Bt as ListOrganizationMembersPageResponseSchema, C as CompleteManagedDeployArtifactResponseSchema, Ci as resolveDocsMcpUrl, Cn as PresignProjectSourceRequestSchema, Cr as TriggerRunListResponseSchema, Ct as HistoryRunListResponseSchema, D as ConnectManagedServiceCredentialRequestSchema, Di as CredentialAssignmentListQuerySchema, Dr as UpdateManagedServiceCredentialRequestSchema, Dt as InviteProjectMembersResponseSchema, E as ConnectAuthorizeUrlResponseSchema, Ei as AssignCredentialBodySchema, En as PresignUserAvatarResponseSchema, Er as UpdateCredentialRequestSchema, Et as InviteProjectMembersRequestSchema, F as CreateCustomAppResponseSchema, Fn as ProjectSlugAvailabilityResponseSchema, Fr as UploadProjectSourceManifestRequestSchema, Ft as ListDraftFilesResponseSchema, G as CreateSlackAppResponseSchema, Gi as BillingActivityResponseSchema, Gn as QueuedAgentPromptResponseSchema, Gr as WorkflowFormResponseSchema, Gt as ListProjectMetricsResponseSchema, H as CreateProjectRequestSchema, Hi as PresignChatAttachmentResponseSchema, Hn as PublishManagedDeployCandidateResponseSchema, Hr as WorkflowCanvasCredentialBindingsSchema, Ht as ListProjectDeploymentsResponseSchema, I as CreateDraftCommitRequestSchema, In as PromptInputSchema, Ir as UploadProjectSourceResponseSchema, It as ListManagedServiceCredentialsResponseSchema, J as CredentialInstanceListResponseSchema, Ji as BillingSummaryResponseSchema, Jn as RenewManagedDeployUploadRequestSchema, Jr as WorkflowRunHooksResponseSchema, Jt as MANAGED_DEPLOY_REQUEST_TIMEOUT_MS, K as CreateSlackChannelBodySchema, Ki as BillingInvoiceUrlResponseSchema, Kn as QueuedRunResponseSchema, Kr as WorkflowFormUpsertBodySchema, Kt as ListProjectsResponseSchema, L as CreateDraftDiffCommitRequestSchema, Ln as PromptResponseSchema, Lr as UpsertGatewayAttachmentBodySchema, Lt as ListMcpAppToolsResponseSchema, M as CreateCredentialsRequestSchema, Mi as ExecuteKeystrokeToolRequestSchema, Mn as ProjectReachabilityResponseSchema, Mr as UpdateProjectMemberResponseSchema, Mt as ListChannelPlatformsResponseSchema, N as CreateCredentialsResponseSchema, Nn as ProjectResponseSchema, Nr as UpdateProjectRequestSchema, Nt as ListCredentialsPageQuerySchema, O as ConnectProvidersResponseSchema, Oi as CredentialAssignmentListResponseSchema, On as ProjectGitRemoteRequestSchema, Or as UpdateOrganizationMemberRequestSchema, Ot as ListAgentMemoryFilesResponseSchema, P as CreateCustomAppRequestSchema, Pn as ProjectSettingsResponseSchema, Pr as UpdateProjectSettingsRequestSchema, Pt as ListCredentialsPageResponseSchema, Q as DeclineOrganizationInvitationResponseSchema, Qi as CreateBillingPortalRequestSchema, Qr as WorkflowRunResponseSchema, Qt as McpDiscoverResponseSchema, R as CreateOrganizationRequestSchema, Rn as PublicFormMetadataSchema, Rr as UserAvatarPatchSchema, Rt as ListOrganizationInvitationsResponseSchema, S as CompleteManagedDeployArtifactRequestSchema, Si as resolveConnectAppSlug, Sn as PresignOrgLogoResponseSchema, Sr as TriggerRunDetailResponseSchema, St as HistoryRunListQuerySchema, T as CompleteProjectArtifactResponseSchema, Tn as PresignUserAvatarRequestSchema, Tr as UpdateCredentialInstanceBodySchema, Tt as InviteOrganizationMembersResponseSchema, U as CreateProjectResponseSchema, Un as PublishedFormListResponseSchema, Ur as WorkflowCanvasRunSchema, Ut as ListProjectFilesResponseSchema, V as CreateProjectArtifactResponseSchema, Vi as PresignChatAttachmentRequestSchema, Vn as PublishManagedDeployCandidateRequestSchema, Vr as UserPreferencesSchema, Vt as ListOrganizationsResponseSchema, W as CreateSlackAppRequestSchema, Wi as AutoTopupSummarySchema, Wn as PublishedFormSchema, Wr as WorkflowCanvasSchema, Wt as ListProjectMembersResponseSchema, X as DOCS_QUERY_TOOL, Xi as ConfirmCheckoutRequestSchema, Xr as WorkflowRunInputsSchema, Xt as ManagedServiceCredentialSchema, Y as CredentialInstanceRecordSchema, Yi as BillingUsageResponseSchema, Yn as RenewManagedDeployUploadResponseSchema, Yr as WorkflowRunInputsPutBodySchema, Yt as ManagedDeployResourceKeySchema, Z as DOCS_SEARCH_TOOL, Zi as ConfirmCheckoutResponseSchema, Zn as SLACK_PERSONAL_APP_SLUG, Zr as WorkflowRunListResponseSchema, Zt as ManagedServiceKindSchema, _ as CatalogAppsPageResponseSchema, _i as parseAppSlug, _n as PrepareManagedDeployRequestSchema, _r as TemplateFilesResponseSchema, _t as HealthResponseSchema, a as AgentSessionListResponseSchema, ai as WorkspaceTriggerRunListResponseSchema, ar as SlackAppManifestResponseSchema, at as DraftUpdateEventSchema, b as ChannelConnectionSchema, bi as parseSlackConnectFlow, bn as PresignCustomAppLogoResponseSchema, br as TriggerInvokeResponseSchema, bt as HistoryRunCancelResponseSchema, c as AgentTriggerSummaryListResponseSchema, ci as buildConnectDeeplink, cr as StartKeystrokeConnectionInputSchema, ct as FinalizeCustomAppLogoRequestSchema, d as BindChannelBodySchema, di as isAcceptableInstallExit, dr as StartMcpOAuthConnectionResultSchema, dt as GatewayAttachmentRecordSchema, ea as CreateSubscriptionCheckoutRequestSchema, ei as WorkflowSummaryListResponseSchema, en as OrganizationSidebarBrandingPatchSchema, er as SkillSummaryListResponseSchema, et as DownloadActiveProjectSourceResponseSchema, f as CancelManagedDeployRequestSchema, fn as PlatformAgentCancelResponseSchema, fr as StartOAuthConnectionInputSchema, ft as GetAppCatalogEntryResponseSchema, g as CatalogAppDetailResponseSchema, gn as PlatformAgentSessionListResponseSchema, gr as SubmitTeamRequestRequestSchema, gt as GraphqlDiscoverResponseSchema, h as CatalogActionsPageResponseSchema, hi as normalizeDocsSearchPaths, hn as PlatformAgentSessionDetailResponseSchema, hr as SubmitMarketingContactRequestSchema, ht as GetTemplateResponseSchema, i as AgentSessionDetailResponseSchema, ii as WorkspaceTriggerOverviewSchema, in as PROJECT_DRAFT_DIFF_MAX_BYTES, ir as SlackAppManifestRequestSchema, it as DraftRevisionResponseSchema, j as CreateCredentialInstanceBodySchema, ji as CredentialConsumerListResponseSchema, jn as ProjectPullStateSchema, jr as UpdateProjectMemberRequestSchema, jt as ListAppsResponseSchema, k as CreateApiKeyRequestSchema, ki as CredentialAssignmentRecordSchema, kn as ProjectGitRemoteResponseSchema, kr as UpdateOrganizationMemberResponseSchema, kt as ListAgentWorkspaceFilesResponseSchema, l as AppSlugAvailabilityResponseSchema, li as deriveCustomAppDisplay, lr as StartKeystrokeConnectionResultSchema, lt as FinalizeCustomAppLogoResponseSchema, m as CatalogActionDetailResponseSchema, mn as PlatformAgentPromptResponseSchema, mr as SubmitAgentFeedbackRequestSchema, mt as GetCustomAppResponseSchema, n as ActiveOrganizationResponseSchema, ni as WorkspaceTriggerFileSchema, nn as PNPM_FROZEN_INSTALL_ARGS, nr as SlackAppInstallStartResponseSchema, nt as DraftConflictResponseSchema, o as AgentSummaryDetailResponseSchema, oi as WorkspaceWorkflowOverviewSchema, on as PROJECT_PULL_STATE_RELATIVE_PATH, or as SlackMembershipChannelBodySchema, ot as DuplicateCredentialRequestSchema, p as CancelManagedDeployResponseSchema, pi as isIgnoredProjectSourcePath, pn as PlatformAgentPromptInputSchema, pr as StartOAuthConnectionResultSchema, pt as GetCredentialResponseSchema, q as CreateSlackChannelResponseSchema, qi as BillingRedirectResponseSchema, qn as RecentResourceListResponseSchema, qr as WorkflowRunDetailResponseSchema, qt as ListTemplatesResponseSchema, r as ActiveProjectSourceRevisionSchema, ri as WorkspaceTriggerListResponseSchema, rn as PROJECT_DRAFT_COMMIT_REQUEST_TIMEOUT_MS, rr as SlackAppListResponseSchema, rt as DraftFileContentResponseSchema, s as AgentSummaryListResponseSchema, si as buildAgentSlackDeeplink, sn as PROJECT_REACHABILITY_REQUEST_TIMEOUT_MS, sr as SlugAvailabilityResponseSchema, st as DuplicateCredentialsResponseSchema, t as AcceptOrganizationInvitationResponseSchema, ta as UpdateAutoTopupRequestSchema, ti as WorkspaceTriggerDetailSchema, tn as OrganizationSidebarBrandingSchema, tr as SlackAgentMembershipsResponseSchema, tt as DraftCommitResponseSchema, u as BindAgentSlackAppBodySchema, ui as detectProjectPackageManagerFromSnapshot, ur as StartMcpOAuthConnectionInputSchema, ut as FormFieldConfigSchema, v as ChannelAccountListResponseSchema, vi as parseErrorResponse, vn as PrepareManagedDeployResponseSchema, vr as TriggerDetailResponseSchema, vt as HeartbeatManagedDeployRequestSchema, w as CompleteProjectArtifactRequestSchema, wi as slugifyAppName, wn as PresignProjectSourceResponseSchema, wr as UpdateChannelBindingBodySchema, wt as InviteOrganizationMembersRequestSchema, x as ChannelDirectoryListResponseSchema, xn as PresignOrgLogoRequestSchema, xr as TriggerListResponseSchema, xt as HistoryRunDetailResponseSchema, y as ChannelConnectionListResponseSchema, yn as PresignCustomAppLogoRequestSchema, yr as TriggerInvokeInputsSchema, yt as HeartbeatManagedDeployResponseSchema, z as CreateOrganizationResponseSchema, zi as ACTIVE_ORG_HEADER, zn as PublicFormSubmitBodySchema, zr as UserAvatarSchema, zt as ListOrganizationMembersPageQuerySchema } from "./dist-C6adeAws.mjs";
-import { $ as collectArtifactModules, Q as artifactIndexFromModules, Z as withMcpReadClient, _t as event, et as mapInParallelBatches, gt as configureTelemetry, ht as captureException, mt as alias, tt as moduleBlobRefsFromModules, vt as flushTelemetry, yt as shutdownTelemetry } from "./dist-BjwZD7UZ.mjs";
-import { a as buildApp, c as computeSafeFilteredDeploy, r as analyzeDeployableClosures, t as ANALYZER_CONTRACT_VERSION } from "./dist-xLTJXuWY.mjs";
+import { $ as withMcpReadClient, Q as assertPublicHttpUrl, Z as PublicHttpUrlError, _t as captureException, bt as flushTelemetry, et as artifactIndexFromModules, gt as alias, nt as mapInParallelBatches, rt as moduleBlobRefsFromModules, tt as collectArtifactModules, vt as configureTelemetry, xt as shutdownTelemetry, yt as event } from "./dist-CtEL33PB.mjs";
+import { a as buildApp, c as computeSafeFilteredDeploy, r as analyzeDeployableClosures, t as ANALYZER_CONTRACT_VERSION } from "./dist-DG8fjuMY.mjs";
 import { createRequire } from "node:module";
 import { Command } from "commander";
 import { homedir, platform, release, tmpdir } from "node:os";
@@ -7739,7 +7739,16 @@ function listActionsHint(app) {
 /** Hint when listing actions for a custom org app (no toolkit tools). */
 function listCustomAppActionsHint(app) {
 	const bin = cliBinaryName();
-	return `\nCustom org apps have no catalog action list.\n  Inspect app:     ${bin} apps get ${app}\n  Scaffold code:   ${bin} apps sync ${app}\n  Connect secret:  ${bin} connect ${app}\n  Author actions:  defineApp({ slug: "${app}", ... }).action(...)\n`;
+	return `\nCustom org apps have no catalog action list.\n  Inspect app:     ${bin} apps get ${app}\n  Scaffold code:   ${bin} apps sync ${app}\n  Connect secret:  ${bin} connect ${app}\n  Author actions:  defineApp({ slug: "${app}", ... }).action(...)\n  Smoke-test:      deploy a thin workflow that calls the action, then\n                   ${bin} workflows run <workflow-slug> --input '{...}' --wait\n  (${bin} apps execute is catalog-only — not for custom app actions.)\n`;
+}
+/**
+* Error when `apps execute` is pointed at a custom org app (`{org}/{name}`).
+* Catalog toolkit execute cannot reach defineApp(...).action(...) project code.
+*/
+function customAppExecuteError(app, options) {
+	const bin = cliBinaryName();
+	const mcpLine = options?.source === "mcp" ? `  Live MCP tools:  ${bin} apps actions list ${app}  (after connect)\n` : "";
+	return `${bin} apps execute only runs built-in catalog toolkit actions.\n"${app}" is a custom org app — its actions live in project code as defineApp(...).action(...), not in the catalog.\n\nSmoke-test a custom app action by deploying a thin workflow that calls it, then:\n  ${bin} workflows run <workflow-slug> --input '{...}' --wait\n\n  Inspect app:     ${bin} apps get ${app}\n  Scaffold/author: ${bin} apps sync ${app}\n` + mcpLine;
 }
 /** Hint after listing live tools on a connected custom MCP app. */
 function listMcpAppActionsHint(app) {
@@ -7760,7 +7769,7 @@ function showActionHint(app, tool, inputParameters) {
 //#region src/commands/apps/run-app-catalog.ts
 const CUSTOM_APP_ACTIONS_MESSAGE = "Custom org apps do not expose catalog actions. Actions live in your project as defineApp(...).action(...). Use `keystroke apps get <slug>` for the credential template, or `keystroke apps sync <slug>` to scaffold the app module.";
 const MCP_CONNECT_HINT = "Connect this MCP app first (`keystroke connect <slug> --print-url`), then re-run `keystroke apps actions list <slug>`. Prefer `keystroke docs search` for Keystroke docs before inventing integration code.";
-function isNotFoundError(error) {
+function isNotFoundError$1(error) {
 	if (!(error instanceof PlatformError)) return false;
 	if (error.status === 404) return true;
 	return /not found/i.test(error.message);
@@ -7789,14 +7798,14 @@ async function runAppShow(client, slug) {
 			app: await client.apps.getCatalogApp(trimmed)
 		};
 	} catch (error) {
-		if (!isNotFoundError(error)) throw error;
+		if (!isNotFoundError$1(error)) throw error;
 		try {
 			return {
 				kind: "custom",
 				app: await client.apps.get(trimmed)
 			};
 		} catch (fallbackError) {
-			if (isNotFoundError(fallbackError)) throw error;
+			if (isNotFoundError$1(fallbackError)) throw error;
 			throw fallbackError;
 		}
 	}
@@ -8087,13 +8096,36 @@ function isNotConnectedError(error) {
 	if (typeof body !== "object" || body === null || !("error" in body)) return false;
 	return body.error === "not_found";
 }
+function isNotFoundError(error) {
+	if (!(error instanceof PlatformError)) return false;
+	if (error.status === 404) return true;
+	return /not found/i.test(error.message);
+}
 async function runAppExecute(client, appSlug, toolSlug, options) {
 	const app = appSlug.trim().toLowerCase();
 	const tool = toolSlug.trim().toUpperCase();
 	if (!app || !tool) throw new Error("App and tool slugs are required (e.g. github github_get_the_authenticated_user)");
+	const parsed = parseAppSlug(app);
+	if (parsed.kind === "org") {
+		let source;
+		try {
+			const shown = await runAppShow(client, parsed.slug);
+			if (shown.kind === "custom") source = shown.app.source;
+		} catch {}
+		throw new Error(customAppExecuteError(parsed.slug, { source }));
+	}
 	const credentialSlug = options.credentialSlug?.trim() || void 0;
 	const projectSlug = options.projectSlug?.trim() || void 0;
-	const version = options.version?.trim() || (await client.apps.getCatalogAction(tool)).version?.trim() || void 0;
+	let version = options.version?.trim() || void 0;
+	if (!version) try {
+		version = (await client.apps.getCatalogAction(tool)).version?.trim() || void 0;
+	} catch (error) {
+		if (isNotFoundError(error)) {
+			const shown = await runAppShow(client, app).catch(() => null);
+			if (shown?.kind === "custom") throw new Error(customAppExecuteError(shown.app.slug, { source: shown.app.source }));
+		}
+		throw error;
+	}
 	if (!version) throw new Error(`Catalog action "${tool}" has no pinned version. Pass --version explicitly.`);
 	try {
 		const { result } = await client.apps.executeTool({
@@ -8113,7 +8145,7 @@ async function runAppExecute(client, appSlug, toolSlug, options) {
 //#endregion
 //#region src/commands/apps/execute.ts
 function registerAppExecuteCommand(app) {
-	app.command("execute").description("Run a connected catalog action against the cloud (no local server)").argument("<app>", "App slug (e.g. github)").argument("<tool>", "Tool slug (e.g. github_get_the_authenticated_user)").option("--input <json>", "JSON arguments (defaults to {})", "{}").option("--version <version>", "Pinned toolkit version (defaults to the catalog value)").option("--credential <slug>", `Pin a specific credential by slug (see '${cliBinaryName()} credentials list'); overrides the default and is the only way to use a user credential`).addHelpText("after", `
+	app.command("execute").description("Run a connected catalog toolkit action against the cloud (no local server). Custom org apps ({org}/{name}) are not supported — smoke-test those via workflows run.").argument("<app>", "Catalog app slug (e.g. github); not a custom {org}/{name} app").argument("<tool>", "Catalog tool slug (e.g. github_get_the_authenticated_user)").option("--input <json>", "JSON arguments (defaults to {})", "{}").option("--version <version>", "Pinned toolkit version (defaults to the catalog value)").option("--credential <slug>", `Pin a specific credential by slug (see '${cliBinaryName()} credentials list'); overrides the default and is the only way to use a user credential`).addHelpText("after", `
 Credential resolution matches the runtime: project default → org default. User credentials are
 never a default — reach one with --credential <slug>. Target a project with the global
 --project <slug> flag; without it, only org credentials resolve.
@@ -8934,7 +8966,7 @@ function registerBuildCommand(program) {
 		try {
 			const root = resolveProjectRoot(options.dir);
 			await ensureSdkCurrent(root);
-			const { buildApp } = await import("./dist-CgDJj_3M.mjs");
+			const { buildApp } = await import("./dist-CSUmvad5.mjs");
 			await buildApp({ root });
 			process.stdout.write(`Built ${root}\n`);
 		} catch (error) {
@@ -11094,6 +11126,64 @@ function assertCheckoutMatchesDraft(inspection, expectedDraftSha) {
 	if (head !== expected) throw new ExpectedCliError(`Hosted checkout HEAD (${head || "unknown"}) does not match draft tip ${expected}. Sync the session workspace to ks/draft and retry.`);
 }
 //#endregion
+//#region src/commands/deploy-output.ts
+/** Format elapsed deploy wall time for the success line. */
+function formatDeployDuration(ms) {
+	return `${(Math.max(0, ms) / 1e3).toFixed(1)}s`;
+}
+/**
+* True for hosts that are not useful on CLI stdout (private / loopback / link-local).
+* Reuses the MCP SSRF host classifier so deploy URL filtering stays in sync.
+*/
+function isPrivateDeployBaseUrl(baseUrl) {
+	try {
+		assertPublicHttpUrl(baseUrl);
+		return false;
+	} catch (error) {
+		if (error instanceof PublicHttpUrlError) return true;
+		throw error;
+	}
+}
+/** Short default progress line after local preflight. */
+function formatPlanProgress(plan) {
+	const fileCount = plan.changedPaths.length;
+	const files = fileCount === 1 ? "1 file changed" : `${fileCount} files changed`;
+	const lines = [`Deploying (${plan.mode}) — ${files}`];
+	if (plan.mode === "filtered") {
+		if (plan.requestedResourceKeys.length > 0) lines.push(`  Requested: ${plan.requestedResourceKeys.join(", ")}`);
+		if (plan.impactedResourceKeys.length > 0) lines.push(`  Also rebuilding from main: ${plan.impactedResourceKeys.sort().join(", ")}`);
+		if (plan.impactCompleteness === "unknown") lines.push("  Impact completeness: unknown (additional resources may be affected)");
+		for (const warning of plan.warnings) lines.push(`  Warning: ${warning}`);
+	}
+	return `${lines.join("\n")}\n`;
+}
+/** Full plan dump for `--verbose` (pins, paths, expansions). */
+function formatPlanSummary(plan) {
+	const lines = [
+		`Pinned main (M0): ${plan.mainSha}`,
+		`Pinned draft (D0): ${plan.draftSha}`,
+		`Mode: ${plan.mode}`
+	];
+	if ("requestedResourceKeys" in plan && plan.requestedResourceKeys.length > 0) lines.push(`Requested: ${plan.requestedResourceKeys.join(", ")}`);
+	if ("impactedResourceKeys" in plan && plan.impactedResourceKeys.length > 0) lines.push(`Impacted (rebuild from main): ${plan.impactedResourceKeys.join(", ")}`);
+	if ("resourceKeys" in plan && plan.resourceKeys.length > 0) lines.push(`Rebuild set: ${plan.resourceKeys.join(", ")}`);
+	if ("impactCompleteness" in plan && plan.impactCompleteness === "unknown") lines.push("Impact completeness: unknown (additional resources may be affected)");
+	if ("warnings" in plan && plan.warnings.length > 0) {
+		lines.push("Warnings:");
+		for (const warning of plan.warnings) lines.push(`  - ${warning}`);
+	}
+	if ("expansions" in plan && plan.expansions.length > 0) {
+		lines.push("Impacts:");
+		for (const expansion of plan.expansions) lines.push(`  - ${expansion.resourceKey}: ${expansion.reason}` + (expansion.sharedInputs.length ? ` (${expansion.sharedInputs.slice(0, 3).join(", ")}${expansion.sharedInputs.length > 3 ? ", …" : ""})` : ""));
+	}
+	if (plan.mode === "blocked") lines.push(`Blocked (${plan.requireFull?.code ?? "unknown"}): ${plan.requireFull?.reason ?? "filtered deploy not safe"}`);
+	if (plan.changedPaths.length > 0) {
+		const preview = plan.changedPaths.slice(0, 8).join(", ");
+		lines.push(`Changed paths (${plan.changedPaths.length}): ${preview}${plan.changedPaths.length > 8 ? ", …" : ""}`);
+	}
+	return `${lines.join("\n")}\n`;
+}
+//#endregion
 //#region src/commands/deploy.ts
 /**
 * Poll aggressively at first — sticky loads often finish in well under 2s.
@@ -11149,31 +11239,6 @@ function parseManagedFilter(filter) {
 	}
 	return keys;
 }
-function formatPlanSummary(plan) {
-	const lines = [
-		`Pinned main (M0): ${plan.mainSha}`,
-		`Pinned draft (D0): ${plan.draftSha}`,
-		`Mode: ${plan.mode}`
-	];
-	if ("requestedResourceKeys" in plan && plan.requestedResourceKeys.length > 0) lines.push(`Requested: ${plan.requestedResourceKeys.join(", ")}`);
-	if ("impactedResourceKeys" in plan && plan.impactedResourceKeys.length > 0) lines.push(`Impacted (rebuild from main): ${plan.impactedResourceKeys.join(", ")}`);
-	if ("resourceKeys" in plan && plan.resourceKeys.length > 0) lines.push(`Rebuild set: ${plan.resourceKeys.join(", ")}`);
-	if ("impactCompleteness" in plan && plan.impactCompleteness === "unknown") lines.push("Impact completeness: unknown (additional resources may be affected)");
-	if ("warnings" in plan && plan.warnings.length > 0) {
-		lines.push("Warnings:");
-		for (const warning of plan.warnings) lines.push(`  - ${warning}`);
-	}
-	if ("expansions" in plan && plan.expansions.length > 0) {
-		lines.push("Impacts:");
-		for (const expansion of plan.expansions) lines.push(`  - ${expansion.resourceKey}: ${expansion.reason}` + (expansion.sharedInputs.length ? ` (${expansion.sharedInputs.slice(0, 3).join(", ")}${expansion.sharedInputs.length > 3 ? ", …" : ""})` : ""));
-	}
-	if (plan.mode === "blocked") lines.push(`Blocked (${plan.requireFull?.code ?? "unknown"}): ${plan.requireFull?.reason ?? "filtered deploy not safe"}`);
-	if (plan.changedPaths.length > 0) {
-		const preview = plan.changedPaths.slice(0, 8).join(", ");
-		lines.push(`Changed paths (${plan.changedPaths.length}): ${preview}${plan.changedPaths.length > 8 ? ", …" : ""}`);
-	}
-	return `${lines.join("\n")}\n`;
-}
 function confirmationMessage(plan) {
 	if (plan.impactCompleteness === "unknown") return "Deploy impact may be incomplete — additional resources could be affected.\nProceed with this managed deploy?";
 	if (plan.impactedResourceKeys.length > 0 || plan.expansions.length > 0) {
@@ -11211,8 +11276,8 @@ async function pollProjectActive(client, projectId, options = {}) {
 			throw new Error(`${lastError}${unpackHint}`);
 		}
 		if (current.status === "active" && (!requestedArtifactId || current.activeArtifactId === requestedArtifactId)) {
-			process.stdout.write(`Project active${current.baseUrl ? `: ${current.baseUrl}` : ""}\n`);
-			return;
+			if (options.verbose) process.stdout.write(`Project active${current.baseUrl ? `: ${current.baseUrl}` : ""}\n`);
+			return { baseUrl: current.baseUrl };
 		}
 		await sleep(POLL_INTERVAL_MS);
 	}
@@ -11223,9 +11288,18 @@ async function runManagedDeploy(client, config, options) {
 	const deployStarted = Date.now();
 	const root = resolveProjectRoot(options.dir);
 	await assertPortableProjectDependencies(root);
+	const verbose = options.verbose === true;
 	const phase = (label, started) => {
+		if (!verbose) return;
 		process.stdout.write(`  ${label}: ${Date.now() - started}ms\n`);
 	};
+	const writePlan = (activePlan) => {
+		if (verbose) {
+			process.stdout.write(formatPlanSummary(activePlan));
+			return;
+		}
+		if (activePlan.mode === "full" || activePlan.mode === "filtered") process.stdout.write(formatPlanProgress(activePlan));
+	};
 	const gitContext = await resolveDeployGitContext(root);
 	const gatesStarted = Date.now();
 	let gatesMs = 0;
@@ -11241,7 +11315,8 @@ async function runManagedDeploy(client, config, options) {
 		client,
 		projectId: options.projectId,
 		root,
-		gitContext
+		gitContext,
+		verbose
 	});
 	phase("draft sync", draftStarted);
 	const filter = parseManagedFilter(options.filter);
@@ -11261,7 +11336,7 @@ async function runManagedDeploy(client, config, options) {
 		...filter ? { filter } : {}
 	});
 	phase("plan", planStarted);
-	process.stdout.write(formatPlanSummary(plan));
+	writePlan(plan);
 	if (plan.mode === "no_op") {
 		earlyGatesPromise.catch(() => void 0);
 		process.stdout.write("Nothing to deploy — draft matches main.\n");
@@ -11336,6 +11411,7 @@ async function runManagedDeploy(client, config, options) {
 					const gatesPromise = verifyOutside && !hostedCheckout ? earlyGatesPromise : Promise.resolve().then(() => {
 						gatesMs = 0;
 					});
+					if (!verbose) process.stdout.write("Building…\n");
 					const publishStarted = Date.now();
 					const publishPromise = (async () => {
 						if (prepared.publishMode === "git_push") {
@@ -11422,8 +11498,10 @@ async function runManagedDeploy(client, config, options) {
 						]);
 						throw error;
 					}
-					process.stdout.write(`  publish candidate: ${publishMs}ms\n`);
-					if (gatesMs > 0) process.stdout.write(`  gates: ${gatesMs}ms\n`);
+					if (verbose) {
+						process.stdout.write(`  publish candidate: ${publishMs}ms\n`);
+						if (gatesMs > 0) process.stdout.write(`  gates: ${gatesMs}ms\n`);
+					}
 					let built = await buildPromise;
 					if (publishedCandidateSha.toLowerCase() !== composed.candidateSha.toLowerCase()) {
 						if (await resolveCommitTreeSha({
@@ -11443,8 +11521,9 @@ async function runManagedDeploy(client, config, options) {
 							buildMs += Date.now() - rebuildStarted;
 						}
 					}
-					process.stdout.write(`  build: ${buildMs}ms\n`);
+					if (verbose) process.stdout.write(`  build: ${buildMs}ms\n`);
 					assertLease();
+					if (!verbose) process.stdout.write("Uploading…\n");
 					const uploadStarted = Date.now();
 					const renewed = await client.projectGit.renewDeployUpload(options.projectId, {
 						artifactId: prepared.artifact.id,
@@ -11469,7 +11548,7 @@ async function runManagedDeploy(client, config, options) {
 						index: built.index
 					});
 					phase("complete", completeStarted);
-					process.stdout.write(`Deploy ${completed.artifact.id} started (${completed.mode})\n`);
+					if (verbose) process.stdout.write(`Deploy ${completed.artifact.id} started (${completed.mode})\n`);
 					return completed.artifact.id;
 				}
 			});
@@ -11491,7 +11570,7 @@ async function runManagedDeploy(client, config, options) {
 			env: gitContext.env,
 			...filter ? { filter } : {}
 		});
-		process.stdout.write(formatPlanSummary(plan));
+		writePlan(plan);
 		if (plan.mode === "no_op") {
 			process.stdout.write("Nothing to deploy — draft matches main.\n");
 			return;
@@ -11504,10 +11583,18 @@ async function runManagedDeploy(client, config, options) {
 		});
 		artifactId = await runTrusted(plan);
 	}
+	if (!verbose) process.stdout.write("Activating…\n");
 	const healthStarted = Date.now();
-	await pollProjectActive(client, options.projectId, { artifactId });
+	const active = await pollProjectActive(client, options.projectId, {
+		artifactId,
+		verbose
+	});
 	phase("health/promotion", healthStarted);
-	process.stdout.write(`CLI→active: ${Date.now() - deployStarted}ms\n`);
+	if (verbose) process.stdout.write(`CLI→active: ${Date.now() - deployStarted}ms\n`);
+	else {
+		process.stdout.write(`Deployed in ${formatDeployDuration(Date.now() - deployStarted)}\n`);
+		if (active.baseUrl && !isPrivateDeployBaseUrl(active.baseUrl)) process.stdout.write(`${active.baseUrl}\n`);
+	}
 }
 /** @internal Exported for unit tests. */
 async function resolveManagedDeployDraftSha(input) {
@@ -11519,7 +11606,7 @@ async function resolveManagedDeployDraftSha(input) {
 	const inspection = await assertHostedCheckoutDeployable(input.root, { env: input.gitContext.env });
 	const revision = await input.client.projectDraft.getRevision(input.projectId);
 	assertCheckoutMatchesDraft(inspection, revision.commitSha);
-	process.stdout.write(`Hosted checkout ready (${revision.commitSha.slice(0, 12)} on ks/draft).\n`);
+	if (input.verbose) process.stdout.write(`Hosted checkout ready (${revision.commitSha.slice(0, 12)} on ks/draft).\n`);
 	return revision.commitSha.toLowerCase();
 }
 /** @internal Exported for unit tests. */
@@ -11545,7 +11632,7 @@ async function runDeploy(options) {
 	await runManagedDeploy(client, config, options);
 }
 function registerDeployCommand(program) {
-	program.command("deploy").description("Deploy the project via managed Git (draft sync, local analyze/build, cutover)").option("--dir <path>", "Project directory", process.cwd()).option("--filter <entry>", "Deploy only matching workflow/agent keys (repeatable; e.g. workflows/ping)", (value, previous) => [...previous, value], []).option("--accept-impact", "Accept the current filtered deploy impact (required for non-TTY expansion)").action(async (options) => {
+	program.command("deploy").description("Deploy the project via managed Git (draft sync, local analyze/build, cutover)").option("--dir <path>", "Project directory", process.cwd()).option("--filter <entry>", "Deploy only matching workflow/agent keys (repeatable; e.g. workflows/ping)", (value, previous) => [...previous, value], []).option("--accept-impact", "Accept the current filtered deploy impact (required for non-TTY expansion)").option("--verbose", "Show phase timings, pin SHAs, and deploy detail").action(async (options) => {
 		let config;
 		try {
 			config = createCliConfig();
@@ -11556,7 +11643,8 @@ function registerDeployCommand(program) {
 				dir: options.dir,
 				projectId,
 				filter: options.filter.length > 0 ? options.filter : void 0,
-				acceptImpact: options.acceptImpact === true
+				acceptImpact: options.acceptImpact === true,
+				verbose: options.verbose === true
 			});
 			await trackCliEvent("cli:deploy", { projectId });
 		} catch (error) {
@@ -14006,4 +14094,4 @@ async function runCli(argv) {
 //#endregion
 export { runCli };
 
-//# sourceMappingURL=program-DU1iPR-p.mjs.map
+//# sourceMappingURL=program-Bv7Wv_O4.mjs.map