@keystrokehq/cli 0.1.162 → 0.1.163

package/dist/index.mjs

@@ -40,7 +40,7 @@ process.emitWarning = ((warning, ...args) => {
 	if ((type === "ExperimentalWarning" || /ExperimentalWarning/i.test(type)) && /SQLite/i.test(message)) return;
 	return Reflect.apply(originalEmitWarning, process, [warning, ...args]);
 });
-const { runCli } = await import("./program-BWeEKhR_.mjs");
+const { runCli } = await import("./program-CKQqD-RE.mjs");
 await runCli(process.argv);
 //#endregion
 export {};

package/dist/{maybe-auto-update-J-Am1CbS.mjs → maybe-auto-update-oRHYV8-i.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { S as resolveCliRoot, a as formatReleaseAgeBlockMessage, b as shouldUpdateCliVersion, i as readPnpmMinimumReleaseAgeMinutes, o as isReleaseAgeBlock, r as computeReleaseAgeRetryAfter, s as detectCliInstall, t as runPackageManagerUpdate, v as fetchLatestCliRelease, w as getCliConfigDir, x as readCliVersion, y as resolveCliDistTag } from "./run-package-manager-update-CuLe-Jux.mjs";
+import { S as resolveCliRoot, a as formatReleaseAgeBlockMessage, b as shouldUpdateCliVersion, i as readPnpmMinimumReleaseAgeMinutes, o as isReleaseAgeBlock, r as computeReleaseAgeRetryAfter, s as detectCliInstall, t as runPackageManagerUpdate, v as fetchLatestCliRelease, w as getCliConfigDir, x as readCliVersion, y as resolveCliDistTag } from "./run-package-manager-update-D_nLqg4e.mjs";
 import { join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { spawnSync } from "node:child_process";
@@ -141,4 +141,4 @@ async function maybeAutoUpdate(argv) {
 //#endregion
 export { maybeAutoUpdate };
 
-//# sourceMappingURL=maybe-auto-update-J-Am1CbS.mjs.map
+//# sourceMappingURL=maybe-auto-update-oRHYV8-i.mjs.map

package/dist/{maybe-auto-update-J-Am1CbS.mjs.map → maybe-auto-update-oRHYV8-i.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"maybe-auto-update-J-Am1CbS.mjs","names":[],"sources":["../src/update/update-block-cache.ts","../src/update/maybe-auto-update.ts"],"sourcesContent":["import { existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\n\nimport { getCliConfigDir } from \"../config\";\n\nexport type UpdateBlockCache = {\n  registryLatest?: string;\n  blockedUntil?: string;\n  lastFailedAt?: string;\n};\n\nconst CACHE_FILE = \"update-check.json\";\nconst GENERIC_RETRY_MS = 24 * 60 * 60 * 1000;\n\nfunction cachePath(configDir = getCliConfigDir()): string {\n  return join(configDir, CACHE_FILE);\n}\n\nexport function readUpdateBlockCache(configDir?: string): UpdateBlockCache {\n  const path = cachePath(configDir);\n  if (!existsSync(path)) {\n    return {};\n  }\n\n  try {\n    return JSON.parse(readFileSync(path, \"utf8\")) as UpdateBlockCache;\n  } catch {\n    return {};\n  }\n}\n\nexport function writeUpdateBlockCache(cache: UpdateBlockCache, configDir?: string): void {\n  const dir = configDir ?? getCliConfigDir();\n  mkdirSync(dir, { recursive: true });\n  writeFileSync(cachePath(dir), `${JSON.stringify(cache, null, 2)}\\n`, \"utf8\");\n}\n\nexport function shouldSkipCachedUpdate(\n  cache: UpdateBlockCache,\n  registryLatest: string,\n  now = Date.now(),\n): boolean {\n  if (cache.registryLatest !== registryLatest) {\n    return false;\n  }\n\n  if (cache.blockedUntil) {\n    const blockedUntilMs = Date.parse(cache.blockedUntil);\n    if (Number.isFinite(blockedUntilMs) && blockedUntilMs > now) {\n      return true;\n    }\n  }\n\n  if (cache.lastFailedAt) {\n    const lastFailedMs = Date.parse(cache.lastFailedAt);\n    if (Number.isFinite(lastFailedMs) && now - lastFailedMs < GENERIC_RETRY_MS) {\n      return true;\n    }\n  }\n\n  return false;\n}\n\nexport function clearUpdateBlockCache(configDir?: string): void {\n  writeUpdateBlockCache({}, configDir);\n}\n\nexport function recordReleaseAgeBlock(options: {\n  registryLatest: string;\n  retryAfter?: Date;\n  configDir?: string;\n}): void {\n  writeUpdateBlockCache(\n    {\n      registryLatest: options.registryLatest,\n      blockedUntil: options.retryAfter?.toISOString(),\n    },\n    options.configDir,\n  );\n}\n\nexport function recordGenericUpdateFailure(registryLatest: string, configDir?: string): void {\n  writeUpdateBlockCache(\n    {\n      registryLatest,\n      lastFailedAt: new Date().toISOString(),\n    },\n    configDir,\n  );\n}\n","import { spawnSync } from \"node:child_process\";\n\nimport { resolveCliRoot } from \"../project/resolve-cli-root\";\nimport { readCliVersion } from \"../version\";\nimport { shouldUpdateCliVersion } from \"./compare-version\";\nimport { detectCliInstall } from \"./detect-cli-install\";\nimport { formatReleaseAgeBlockMessage, isReleaseAgeBlock } from \"./detect-release-age-block\";\nimport { fetchLatestCliRelease } from \"./fetch-latest-version\";\nimport {\n  computeReleaseAgeRetryAfter,\n  readPnpmMinimumReleaseAgeMinutes,\n} from \"./read-pnpm-release-age-minutes\";\nimport { resolveCliDistTag } from \"./resolve-cli-dist-tag\";\nimport { runPackageManagerUpdate } from \"./run-package-manager-update\";\nimport {\n  clearUpdateBlockCache,\n  readUpdateBlockCache,\n  recordGenericUpdateFailure,\n  recordReleaseAgeBlock,\n  shouldSkipCachedUpdate,\n} from \"./update-block-cache\";\n\nfunction isTopLevelUpdateCommand(args: string[]): boolean {\n  const valueFlags = new Set([\"--project\", \"--organization\", \"--dir\"]);\n\n  for (let i = 0; i < args.length; i++) {\n    const arg = args[i];\n    if (arg === undefined) {\n      return false;\n    }\n\n    if (arg === \"--\") {\n      return args[i + 1] === \"update\";\n    }\n\n    if (arg.startsWith(\"-\")) {\n      if (\n        arg === \"-h\" ||\n        arg === \"--help\" ||\n        arg === \"-V\" ||\n        arg === \"--version\" ||\n        arg.startsWith(\"-V\")\n      ) {\n        continue;\n      }\n\n      if (arg.includes(\"=\")) {\n        continue;\n      }\n\n      if (valueFlags.has(arg) || arg.startsWith(\"--\")) {\n        i++;\n      }\n      continue;\n    }\n\n    return arg === \"update\";\n  }\n\n  return false;\n}\n\nfunction shouldSkipAutoUpdate(argv: string[]): boolean {\n  if (\n    process.env.KEYSTROKE_DEV ||\n    process.env.KEYSTROKE_SKIP_UPDATE ||\n    process.env.KEYSTROKE_UPDATING\n  ) {\n    return true;\n  }\n\n  if (process.env.CI === \"true\" || process.env.CI === \"1\") {\n    return true;\n  }\n\n  const args = argv.slice(2);\n  if (args.length === 0) {\n    return false;\n  }\n\n  // Explicit `keystroke update` owns CLI + project package updates.\n  if (isTopLevelUpdateCommand(args)) {\n    return true;\n  }\n\n  return args.every(\n    (arg) =>\n      arg === \"-V\" ||\n      arg === \"--version\" ||\n      arg === \"-h\" ||\n      arg === \"--help\" ||\n      arg.startsWith(\"-V\"),\n  );\n}\n\nfunction reexecCli(argv: string[]): never {\n  const result = spawnSync(process.execPath, argv.slice(1), {\n    stdio: \"inherit\",\n    env: {\n      ...process.env,\n      KEYSTROKE_UPDATING: \"1\",\n    },\n  });\n\n  process.exit(result.status ?? 1);\n}\n\nfunction releaseAgeRetryAfter(\n  install: NonNullable<ReturnType<typeof detectCliInstall>>,\n  publishedAt: string | undefined,\n): Date | undefined {\n  if (install.packageManager !== \"pnpm\") {\n    return undefined;\n  }\n\n  return computeReleaseAgeRetryAfter(publishedAt, readPnpmMinimumReleaseAgeMinutes());\n}\n\nexport async function maybeAutoUpdate(argv: string[]): Promise<void> {\n  if (shouldSkipAutoUpdate(argv)) {\n    return;\n  }\n\n  const install = detectCliInstall(resolveCliRoot(import.meta.url));\n  if (!install || (install.kind === \"local\" && !install.projectRoot)) {\n    return;\n  }\n\n  const currentVersion = readCliVersion();\n  const distTag = resolveCliDistTag();\n  const release = await fetchLatestCliRelease(distTag);\n\n  if (\n    !release ||\n    !shouldUpdateCliVersion({\n      registryVersion: release.version,\n      currentVersion,\n      distTag,\n    })\n  ) {\n    clearUpdateBlockCache();\n    return;\n  }\n\n  const cache = readUpdateBlockCache();\n  if (shouldSkipCachedUpdate(cache, release.version)) {\n    return;\n  }\n\n  process.stderr.write(\n    `Updating @keystrokehq/cli ${currentVersion} -> ${release.version} (@${distTag}) via ${install.packageManager}...\\n`,\n  );\n\n  const result = runPackageManagerUpdate(install, distTag);\n  const installedVersion = readCliVersion();\n\n  if (installedVersion.trim() !== currentVersion.trim()) {\n    clearUpdateBlockCache();\n    process.stderr.write(`Updated @keystrokehq/cli ${currentVersion} -> ${installedVersion}.\\n`);\n    reexecCli(argv);\n  }\n\n  if (result.ok) {\n    clearUpdateBlockCache();\n    return;\n  }\n\n  if (isReleaseAgeBlock(result.output)) {\n    const retryAfter = releaseAgeRetryAfter(install, release.publishedAt);\n    recordReleaseAgeBlock({\n      registryLatest: release.version,\n      retryAfter,\n    });\n    process.stderr.write(\n      `${formatReleaseAgeBlockMessage({\n        currentVersion,\n        availableVersion: release.version,\n        retryAfter,\n      })}\\n`,\n    );\n    return;\n  }\n\n  recordGenericUpdateFailure(release.version);\n  process.stderr.write(\"Auto-update failed; continuing with the current version.\\n\");\n}\n"],"mappings":";;;;;;AAWA,MAAM,aAAa;AACnB,MAAM,mBAAmB,OAAU,KAAK;AAExC,SAAS,UAAU,YAAY,gBAAgB,GAAW;CACxD,OAAO,KAAK,WAAW,UAAU;AACnC;AAEA,SAAgB,qBAAqB,WAAsC;CACzE,MAAM,OAAO,UAAU,SAAS;CAChC,IAAI,CAAC,WAAW,IAAI,GAClB,OAAO,CAAC;CAGV,IAAI;EACF,OAAO,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;CAC9C,QAAQ;EACN,OAAO,CAAC;CACV;AACF;AAEA,SAAgB,sBAAsB,OAAyB,WAA0B;CACvF,MAAM,MAAM,aAAa,gBAAgB;CACzC,UAAU,KAAK,EAAE,WAAW,KAAK,CAAC;CAClC,cAAc,UAAU,GAAG,GAAG,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,EAAE,KAAK,MAAM;AAC7E;AAEA,SAAgB,uBACd,OACA,gBACA,MAAM,KAAK,IAAI,GACN;CACT,IAAI,MAAM,mBAAmB,gBAC3B,OAAO;CAGT,IAAI,MAAM,cAAc;EACtB,MAAM,iBAAiB,KAAK,MAAM,MAAM,YAAY;EACpD,IAAI,OAAO,SAAS,cAAc,KAAK,iBAAiB,KACtD,OAAO;CAEX;CAEA,IAAI,MAAM,cAAc;EACtB,MAAM,eAAe,KAAK,MAAM,MAAM,YAAY;EAClD,IAAI,OAAO,SAAS,YAAY,KAAK,MAAM,eAAe,kBACxD,OAAO;CAEX;CAEA,OAAO;AACT;AAEA,SAAgB,sBAAsB,WAA0B;CAC9D,sBAAsB,CAAC,GAAG,SAAS;AACrC;AAEA,SAAgB,sBAAsB,SAI7B;CACP,sBACE;EACE,gBAAgB,QAAQ;EACxB,cAAc,QAAQ,YAAY,YAAY;CAChD,GACA,QAAQ,SACV;AACF;AAEA,SAAgB,2BAA2B,gBAAwB,WAA0B;CAC3F,sBACE;EACE;EACA,+BAAc,IAAI,KAAK,GAAE,YAAY;CACvC,GACA,SACF;AACF;;;ACnEA,SAAS,wBAAwB,MAAyB;CACxD,MAAM,aAAa,IAAI,IAAI;EAAC;EAAa;EAAkB;CAAO,CAAC;CAEnE,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;EACpC,MAAM,MAAM,KAAK;EACjB,IAAI,QAAQ,KAAA,GACV,OAAO;EAGT,IAAI,QAAQ,MACV,OAAO,KAAK,IAAI,OAAO;EAGzB,IAAI,IAAI,WAAW,GAAG,GAAG;GACvB,IACE,QAAQ,QACR,QAAQ,YACR,QAAQ,QACR,QAAQ,eACR,IAAI,WAAW,IAAI,GAEnB;GAGF,IAAI,IAAI,SAAS,GAAG,GAClB;GAGF,IAAI,WAAW,IAAI,GAAG,KAAK,IAAI,WAAW,IAAI,GAC5C;GAEF;EACF;EAEA,OAAO,QAAQ;CACjB;CAEA,OAAO;AACT;AAEA,SAAS,qBAAqB,MAAyB;CACrD,IACE,QAAQ,IAAI,iBACZ,QAAQ,IAAI,yBACZ,QAAQ,IAAI,oBAEZ,OAAO;CAGT,IAAI,QAAQ,IAAI,OAAO,UAAU,QAAQ,IAAI,OAAO,KAClD,OAAO;CAGT,MAAM,OAAO,KAAK,MAAM,CAAC;CACzB,IAAI,KAAK,WAAW,GAClB,OAAO;CAIT,IAAI,wBAAwB,IAAI,GAC9B,OAAO;CAGT,OAAO,KAAK,OACT,QACC,QAAQ,QACR,QAAQ,eACR,QAAQ,QACR,QAAQ,YACR,IAAI,WAAW,IAAI,CACvB;AACF;AAEA,SAAS,UAAU,MAAuB;CACxC,MAAM,SAAS,UAAU,QAAQ,UAAU,KAAK,MAAM,CAAC,GAAG;EACxD,OAAO;EACP,KAAK;GACH,GAAG,QAAQ;GACX,oBAAoB;EACtB;CACF,CAAC;CAED,QAAQ,KAAK,OAAO,UAAU,CAAC;AACjC;AAEA,SAAS,qBACP,SACA,aACkB;CAClB,IAAI,QAAQ,mBAAmB,QAC7B;CAGF,OAAO,4BAA4B,aAAa,iCAAiC,CAAC;AACpF;AAEA,eAAsB,gBAAgB,MAA+B;CACnE,IAAI,qBAAqB,IAAI,GAC3B;CAGF,MAAM,UAAU,iBAAiB,eAAe,OAAO,KAAK,GAAG,CAAC;CAChE,IAAI,CAAC,WAAY,QAAQ,SAAS,WAAW,CAAC,QAAQ,aACpD;CAGF,MAAM,iBAAiB,eAAe;CACtC,MAAM,UAAU,kBAAkB;CAClC,MAAM,UAAU,MAAM,sBAAsB,OAAO;CAEnD,IACE,CAAC,WACD,CAAC,uBAAuB;EACtB,iBAAiB,QAAQ;EACzB;EACA;CACF,CAAC,GACD;EACA,sBAAsB;EACtB;CACF;CAGA,IAAI,uBADU,qBACiB,GAAG,QAAQ,OAAO,GAC/C;CAGF,QAAQ,OAAO,MACb,6BAA6B,eAAe,MAAM,QAAQ,QAAQ,KAAK,QAAQ,QAAQ,QAAQ,eAAe,MAChH;CAEA,MAAM,SAAS,wBAAwB,SAAS,OAAO;CACvD,MAAM,mBAAmB,eAAe;CAExC,IAAI,iBAAiB,KAAK,MAAM,eAAe,KAAK,GAAG;EACrD,sBAAsB;EACtB,QAAQ,OAAO,MAAM,4BAA4B,eAAe,MAAM,iBAAiB,IAAI;EAC3F,UAAU,IAAI;CAChB;CAEA,IAAI,OAAO,IAAI;EACb,sBAAsB;EACtB;CACF;CAEA,IAAI,kBAAkB,OAAO,MAAM,GAAG;EACpC,MAAM,aAAa,qBAAqB,SAAS,QAAQ,WAAW;EACpE,sBAAsB;GACpB,gBAAgB,QAAQ;GACxB;EACF,CAAC;EACD,QAAQ,OAAO,MACb,GAAG,6BAA6B;GAC9B;GACA,kBAAkB,QAAQ;GAC1B;EACF,CAAC,EAAE,GACL;EACA;CACF;CAEA,2BAA2B,QAAQ,OAAO;CAC1C,QAAQ,OAAO,MAAM,4DAA4D;AACnF"}
+{"version":3,"file":"maybe-auto-update-oRHYV8-i.mjs","names":[],"sources":["../src/update/update-block-cache.ts","../src/update/maybe-auto-update.ts"],"sourcesContent":["import { existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\n\nimport { getCliConfigDir } from \"../config\";\n\nexport type UpdateBlockCache = {\n  registryLatest?: string;\n  blockedUntil?: string;\n  lastFailedAt?: string;\n};\n\nconst CACHE_FILE = \"update-check.json\";\nconst GENERIC_RETRY_MS = 24 * 60 * 60 * 1000;\n\nfunction cachePath(configDir = getCliConfigDir()): string {\n  return join(configDir, CACHE_FILE);\n}\n\nexport function readUpdateBlockCache(configDir?: string): UpdateBlockCache {\n  const path = cachePath(configDir);\n  if (!existsSync(path)) {\n    return {};\n  }\n\n  try {\n    return JSON.parse(readFileSync(path, \"utf8\")) as UpdateBlockCache;\n  } catch {\n    return {};\n  }\n}\n\nexport function writeUpdateBlockCache(cache: UpdateBlockCache, configDir?: string): void {\n  const dir = configDir ?? getCliConfigDir();\n  mkdirSync(dir, { recursive: true });\n  writeFileSync(cachePath(dir), `${JSON.stringify(cache, null, 2)}\\n`, \"utf8\");\n}\n\nexport function shouldSkipCachedUpdate(\n  cache: UpdateBlockCache,\n  registryLatest: string,\n  now = Date.now(),\n): boolean {\n  if (cache.registryLatest !== registryLatest) {\n    return false;\n  }\n\n  if (cache.blockedUntil) {\n    const blockedUntilMs = Date.parse(cache.blockedUntil);\n    if (Number.isFinite(blockedUntilMs) && blockedUntilMs > now) {\n      return true;\n    }\n  }\n\n  if (cache.lastFailedAt) {\n    const lastFailedMs = Date.parse(cache.lastFailedAt);\n    if (Number.isFinite(lastFailedMs) && now - lastFailedMs < GENERIC_RETRY_MS) {\n      return true;\n    }\n  }\n\n  return false;\n}\n\nexport function clearUpdateBlockCache(configDir?: string): void {\n  writeUpdateBlockCache({}, configDir);\n}\n\nexport function recordReleaseAgeBlock(options: {\n  registryLatest: string;\n  retryAfter?: Date;\n  configDir?: string;\n}): void {\n  writeUpdateBlockCache(\n    {\n      registryLatest: options.registryLatest,\n      blockedUntil: options.retryAfter?.toISOString(),\n    },\n    options.configDir,\n  );\n}\n\nexport function recordGenericUpdateFailure(registryLatest: string, configDir?: string): void {\n  writeUpdateBlockCache(\n    {\n      registryLatest,\n      lastFailedAt: new Date().toISOString(),\n    },\n    configDir,\n  );\n}\n","import { spawnSync } from \"node:child_process\";\n\nimport { resolveCliRoot } from \"../project/resolve-cli-root\";\nimport { readCliVersion } from \"../version\";\nimport { shouldUpdateCliVersion } from \"./compare-version\";\nimport { detectCliInstall } from \"./detect-cli-install\";\nimport { formatReleaseAgeBlockMessage, isReleaseAgeBlock } from \"./detect-release-age-block\";\nimport { fetchLatestCliRelease } from \"./fetch-latest-version\";\nimport {\n  computeReleaseAgeRetryAfter,\n  readPnpmMinimumReleaseAgeMinutes,\n} from \"./read-pnpm-release-age-minutes\";\nimport { resolveCliDistTag } from \"./resolve-cli-dist-tag\";\nimport { runPackageManagerUpdate } from \"./run-package-manager-update\";\nimport {\n  clearUpdateBlockCache,\n  readUpdateBlockCache,\n  recordGenericUpdateFailure,\n  recordReleaseAgeBlock,\n  shouldSkipCachedUpdate,\n} from \"./update-block-cache\";\n\nfunction isTopLevelUpdateCommand(args: string[]): boolean {\n  const valueFlags = new Set([\"--project\", \"--organization\", \"--dir\"]);\n\n  for (let i = 0; i < args.length; i++) {\n    const arg = args[i];\n    if (arg === undefined) {\n      return false;\n    }\n\n    if (arg === \"--\") {\n      return args[i + 1] === \"update\";\n    }\n\n    if (arg.startsWith(\"-\")) {\n      if (\n        arg === \"-h\" ||\n        arg === \"--help\" ||\n        arg === \"-V\" ||\n        arg === \"--version\" ||\n        arg.startsWith(\"-V\")\n      ) {\n        continue;\n      }\n\n      if (arg.includes(\"=\")) {\n        continue;\n      }\n\n      if (valueFlags.has(arg) || arg.startsWith(\"--\")) {\n        i++;\n      }\n      continue;\n    }\n\n    return arg === \"update\";\n  }\n\n  return false;\n}\n\nfunction shouldSkipAutoUpdate(argv: string[]): boolean {\n  if (\n    process.env.KEYSTROKE_DEV ||\n    process.env.KEYSTROKE_SKIP_UPDATE ||\n    process.env.KEYSTROKE_UPDATING\n  ) {\n    return true;\n  }\n\n  if (process.env.CI === \"true\" || process.env.CI === \"1\") {\n    return true;\n  }\n\n  const args = argv.slice(2);\n  if (args.length === 0) {\n    return false;\n  }\n\n  // Explicit `keystroke update` owns CLI + project package updates.\n  if (isTopLevelUpdateCommand(args)) {\n    return true;\n  }\n\n  return args.every(\n    (arg) =>\n      arg === \"-V\" ||\n      arg === \"--version\" ||\n      arg === \"-h\" ||\n      arg === \"--help\" ||\n      arg.startsWith(\"-V\"),\n  );\n}\n\nfunction reexecCli(argv: string[]): never {\n  const result = spawnSync(process.execPath, argv.slice(1), {\n    stdio: \"inherit\",\n    env: {\n      ...process.env,\n      KEYSTROKE_UPDATING: \"1\",\n    },\n  });\n\n  process.exit(result.status ?? 1);\n}\n\nfunction releaseAgeRetryAfter(\n  install: NonNullable<ReturnType<typeof detectCliInstall>>,\n  publishedAt: string | undefined,\n): Date | undefined {\n  if (install.packageManager !== \"pnpm\") {\n    return undefined;\n  }\n\n  return computeReleaseAgeRetryAfter(publishedAt, readPnpmMinimumReleaseAgeMinutes());\n}\n\nexport async function maybeAutoUpdate(argv: string[]): Promise<void> {\n  if (shouldSkipAutoUpdate(argv)) {\n    return;\n  }\n\n  const install = detectCliInstall(resolveCliRoot(import.meta.url));\n  if (!install || (install.kind === \"local\" && !install.projectRoot)) {\n    return;\n  }\n\n  const currentVersion = readCliVersion();\n  const distTag = resolveCliDistTag();\n  const release = await fetchLatestCliRelease(distTag);\n\n  if (\n    !release ||\n    !shouldUpdateCliVersion({\n      registryVersion: release.version,\n      currentVersion,\n      distTag,\n    })\n  ) {\n    clearUpdateBlockCache();\n    return;\n  }\n\n  const cache = readUpdateBlockCache();\n  if (shouldSkipCachedUpdate(cache, release.version)) {\n    return;\n  }\n\n  process.stderr.write(\n    `Updating @keystrokehq/cli ${currentVersion} -> ${release.version} (@${distTag}) via ${install.packageManager}...\\n`,\n  );\n\n  const result = runPackageManagerUpdate(install, distTag);\n  const installedVersion = readCliVersion();\n\n  if (installedVersion.trim() !== currentVersion.trim()) {\n    clearUpdateBlockCache();\n    process.stderr.write(`Updated @keystrokehq/cli ${currentVersion} -> ${installedVersion}.\\n`);\n    reexecCli(argv);\n  }\n\n  if (result.ok) {\n    clearUpdateBlockCache();\n    return;\n  }\n\n  if (isReleaseAgeBlock(result.output)) {\n    const retryAfter = releaseAgeRetryAfter(install, release.publishedAt);\n    recordReleaseAgeBlock({\n      registryLatest: release.version,\n      retryAfter,\n    });\n    process.stderr.write(\n      `${formatReleaseAgeBlockMessage({\n        currentVersion,\n        availableVersion: release.version,\n        retryAfter,\n      })}\\n`,\n    );\n    return;\n  }\n\n  recordGenericUpdateFailure(release.version);\n  process.stderr.write(\"Auto-update failed; continuing with the current version.\\n\");\n}\n"],"mappings":";;;;;;AAWA,MAAM,aAAa;AACnB,MAAM,mBAAmB,OAAU,KAAK;AAExC,SAAS,UAAU,YAAY,gBAAgB,GAAW;CACxD,OAAO,KAAK,WAAW,UAAU;AACnC;AAEA,SAAgB,qBAAqB,WAAsC;CACzE,MAAM,OAAO,UAAU,SAAS;CAChC,IAAI,CAAC,WAAW,IAAI,GAClB,OAAO,CAAC;CAGV,IAAI;EACF,OAAO,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;CAC9C,QAAQ;EACN,OAAO,CAAC;CACV;AACF;AAEA,SAAgB,sBAAsB,OAAyB,WAA0B;CACvF,MAAM,MAAM,aAAa,gBAAgB;CACzC,UAAU,KAAK,EAAE,WAAW,KAAK,CAAC;CAClC,cAAc,UAAU,GAAG,GAAG,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,EAAE,KAAK,MAAM;AAC7E;AAEA,SAAgB,uBACd,OACA,gBACA,MAAM,KAAK,IAAI,GACN;CACT,IAAI,MAAM,mBAAmB,gBAC3B,OAAO;CAGT,IAAI,MAAM,cAAc;EACtB,MAAM,iBAAiB,KAAK,MAAM,MAAM,YAAY;EACpD,IAAI,OAAO,SAAS,cAAc,KAAK,iBAAiB,KACtD,OAAO;CAEX;CAEA,IAAI,MAAM,cAAc;EACtB,MAAM,eAAe,KAAK,MAAM,MAAM,YAAY;EAClD,IAAI,OAAO,SAAS,YAAY,KAAK,MAAM,eAAe,kBACxD,OAAO;CAEX;CAEA,OAAO;AACT;AAEA,SAAgB,sBAAsB,WAA0B;CAC9D,sBAAsB,CAAC,GAAG,SAAS;AACrC;AAEA,SAAgB,sBAAsB,SAI7B;CACP,sBACE;EACE,gBAAgB,QAAQ;EACxB,cAAc,QAAQ,YAAY,YAAY;CAChD,GACA,QAAQ,SACV;AACF;AAEA,SAAgB,2BAA2B,gBAAwB,WAA0B;CAC3F,sBACE;EACE;EACA,+BAAc,IAAI,KAAK,GAAE,YAAY;CACvC,GACA,SACF;AACF;;;ACnEA,SAAS,wBAAwB,MAAyB;CACxD,MAAM,aAAa,IAAI,IAAI;EAAC;EAAa;EAAkB;CAAO,CAAC;CAEnE,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;EACpC,MAAM,MAAM,KAAK;EACjB,IAAI,QAAQ,KAAA,GACV,OAAO;EAGT,IAAI,QAAQ,MACV,OAAO,KAAK,IAAI,OAAO;EAGzB,IAAI,IAAI,WAAW,GAAG,GAAG;GACvB,IACE,QAAQ,QACR,QAAQ,YACR,QAAQ,QACR,QAAQ,eACR,IAAI,WAAW,IAAI,GAEnB;GAGF,IAAI,IAAI,SAAS,GAAG,GAClB;GAGF,IAAI,WAAW,IAAI,GAAG,KAAK,IAAI,WAAW,IAAI,GAC5C;GAEF;EACF;EAEA,OAAO,QAAQ;CACjB;CAEA,OAAO;AACT;AAEA,SAAS,qBAAqB,MAAyB;CACrD,IACE,QAAQ,IAAI,iBACZ,QAAQ,IAAI,yBACZ,QAAQ,IAAI,oBAEZ,OAAO;CAGT,IAAI,QAAQ,IAAI,OAAO,UAAU,QAAQ,IAAI,OAAO,KAClD,OAAO;CAGT,MAAM,OAAO,KAAK,MAAM,CAAC;CACzB,IAAI,KAAK,WAAW,GAClB,OAAO;CAIT,IAAI,wBAAwB,IAAI,GAC9B,OAAO;CAGT,OAAO,KAAK,OACT,QACC,QAAQ,QACR,QAAQ,eACR,QAAQ,QACR,QAAQ,YACR,IAAI,WAAW,IAAI,CACvB;AACF;AAEA,SAAS,UAAU,MAAuB;CACxC,MAAM,SAAS,UAAU,QAAQ,UAAU,KAAK,MAAM,CAAC,GAAG;EACxD,OAAO;EACP,KAAK;GACH,GAAG,QAAQ;GACX,oBAAoB;EACtB;CACF,CAAC;CAED,QAAQ,KAAK,OAAO,UAAU,CAAC;AACjC;AAEA,SAAS,qBACP,SACA,aACkB;CAClB,IAAI,QAAQ,mBAAmB,QAC7B;CAGF,OAAO,4BAA4B,aAAa,iCAAiC,CAAC;AACpF;AAEA,eAAsB,gBAAgB,MAA+B;CACnE,IAAI,qBAAqB,IAAI,GAC3B;CAGF,MAAM,UAAU,iBAAiB,eAAe,OAAO,KAAK,GAAG,CAAC;CAChE,IAAI,CAAC,WAAY,QAAQ,SAAS,WAAW,CAAC,QAAQ,aACpD;CAGF,MAAM,iBAAiB,eAAe;CACtC,MAAM,UAAU,kBAAkB;CAClC,MAAM,UAAU,MAAM,sBAAsB,OAAO;CAEnD,IACE,CAAC,WACD,CAAC,uBAAuB;EACtB,iBAAiB,QAAQ;EACzB;EACA;CACF,CAAC,GACD;EACA,sBAAsB;EACtB;CACF;CAGA,IAAI,uBADU,qBACiB,GAAG,QAAQ,OAAO,GAC/C;CAGF,QAAQ,OAAO,MACb,6BAA6B,eAAe,MAAM,QAAQ,QAAQ,KAAK,QAAQ,QAAQ,QAAQ,eAAe,MAChH;CAEA,MAAM,SAAS,wBAAwB,SAAS,OAAO;CACvD,MAAM,mBAAmB,eAAe;CAExC,IAAI,iBAAiB,KAAK,MAAM,eAAe,KAAK,GAAG;EACrD,sBAAsB;EACtB,QAAQ,OAAO,MAAM,4BAA4B,eAAe,MAAM,iBAAiB,IAAI;EAC3F,UAAU,IAAI;CAChB;CAEA,IAAI,OAAO,IAAI;EACb,sBAAsB;EACtB;CACF;CAEA,IAAI,kBAAkB,OAAO,MAAM,GAAG;EACpC,MAAM,aAAa,qBAAqB,SAAS,QAAQ,WAAW;EACpE,sBAAsB;GACpB,gBAAgB,QAAQ;GACxB;EACF,CAAC;EACD,QAAQ,OAAO,MACb,GAAG,6BAA6B;GAC9B;GACA,kBAAkB,QAAQ;GAC1B;EACF,CAAC,EAAE,GACL;EACA;CACF;CAEA,2BAA2B,QAAQ,OAAO;CAC1C,QAAQ,OAAO,MAAM,4DAA4D;AACnF"}

package/dist/{program-BWeEKhR_.mjs → program-CKQqD-RE.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { A as resolvePlatformUrlForWebUrl, C as createCliConfig, D as getWebUrl, E as getPlatformUrl, M as ExpectedCliError, N as isExpectedCliError, O as DEFAULT_PLATFORM_URL, S as resolveCliRoot, T as getCredentialStorage, _ as isLocalSdkSpec, a as formatReleaseAgeBlockMessage, b as shouldUpdateCliVersion, c as detectManagerFromLockfile, d as installDependencies$1, f as installPlaygroundDependencies, g as ensureSdkCurrent, i as readPnpmMinimumReleaseAgeMinutes, j as parseCredentialStorage, l as buildPlaygroundWorkspace, m as resolvePackageManager, n as ensureMinimumReleaseAgeExclude, o as isReleaseAgeBlock, p as resolveGithubPackagesToken, r as computeReleaseAgeRetryAfter, s as detectCliInstall, t as runPackageManagerUpdate, u as detectPackageManager$2, v as fetchLatestCliRelease, w as getCliConfigDir, x as readCliVersion, y as resolveCliDistTag } from "./run-package-manager-update-CuLe-Jux.mjs";
-import { $ as DownloadActiveProjectArtifactResponseSchema, $i as CreateBillingPortalRequestSchema, $n as SkillSummaryDetailResponseSchema, $r as WorkflowSummaryDetailResponseSchema, $t as OpenApiDiscoverResponseSchema, A as CreateApiKeyResponseSchema, Ai as CredentialAssignmentRecordSchema, An as ProjectGitStatusResponseSchema, Ar as UpdateOrganizationRequestSchema, At as ListApiKeysResponseSchema, B as CreateProjectArtifactRequestSchema, Bi as ACTIVE_ORG_HEADER, Bn as PublicFormSubmitResponseSchema, Br as UserPreferencesPatchSchema, Bt as ListOrganizationMembersPageResponseSchema, C as CompleteManagedDeployArtifactResponseSchema, Ci as resolveConnectAppSlug, Cn as PresignProjectSourceRequestSchema, Cr as TriggerRunListResponseSchema, Ct as HistoryRunListResponseSchema, D as ConnectManagedServiceCredentialRequestSchema, Di as AssignCredentialBodySchema, Dr as UpdateManagedServiceCredentialRequestSchema, Dt as InviteProjectMembersResponseSchema, E as ConnectAuthorizeUrlResponseSchema, En as PresignUserAvatarResponseSchema, Er as UpdateCredentialRequestSchema, Et as InviteProjectMembersRequestSchema, F as CreateCustomAppResponseSchema, Fn as ProjectSlugAvailabilityResponseSchema, Fr as UploadProjectSourceManifestRequestSchema, Ft as ListDraftFilesResponseSchema, G as CreateSlackAppResponseSchema, Gi as AutoTopupSummarySchema, Gn as QueuedAgentPromptResponseSchema, Gr as WorkflowFormResponseSchema, Gt as ListProjectMetricsResponseSchema, H as CreateProjectRequestSchema, Hi as PresignChatAttachmentRequestSchema, Hn as PublishManagedDeployCandidateResponseSchema, Hr as WorkflowCanvasCredentialBindingsSchema, Ht as ListProjectDeploymentsResponseSchema, I as CreateDraftCommitRequestSchema, In as PromptInputSchema, Ir as UploadProjectSourceResponseSchema, It as ListManagedServiceCredentialsResponseSchema, J as CredentialInstanceListResponseSchema, Ji as BillingRedirectResponseSchema, Jn as RenewManagedDeployUploadRequestSchema, Jr as WorkflowRunHooksResponseSchema, Jt as MANAGED_DEPLOY_REQUEST_TIMEOUT_MS, K as CreateSlackChannelBodySchema, Ki as BillingActivityResponseSchema, Kn as QueuedRunResponseSchema, Kr as WorkflowFormUpsertBodySchema, Kt as ListProjectsResponseSchema, L as CreateDraftDiffCommitRequestSchema, Ln as PromptResponseSchema, Lr as UpsertGatewayAttachmentBodySchema, Lt as ListMcpAppToolsResponseSchema, M as CreateCredentialsRequestSchema, Mi as CredentialConsumerListResponseSchema, Mn as ProjectReachabilityResponseSchema, Mr as UpdateProjectMemberResponseSchema, Mt as ListChannelPlatformsResponseSchema, N as CreateCredentialsResponseSchema, Ni as ExecuteKeystrokeToolRequestSchema, Nn as ProjectResponseSchema, Nr as UpdateProjectRequestSchema, Nt as ListCredentialsPageQuerySchema, O as ConnectProvidersResponseSchema, Oi as CredentialAssignmentListQuerySchema, On as ProjectGitRemoteRequestSchema, Or as UpdateOrganizationMemberRequestSchema, Ot as ListAgentMemoryFilesResponseSchema, P as CreateCustomAppRequestSchema, Pn as ProjectSettingsResponseSchema, Pr as UpdateProjectSettingsRequestSchema, Pt as ListCredentialsPageResponseSchema, Q as DeclineOrganizationInvitationResponseSchema, Qi as ConfirmCheckoutResponseSchema, Qr as WorkflowRunResponseSchema, Qt as McpDiscoverResponseSchema, R as CreateOrganizationRequestSchema, Rn as PublicFormMetadataSchema, Rr as UserAvatarPatchSchema, Rt as ListOrganizationInvitationsResponseSchema, S as CompleteManagedDeployArtifactRequestSchema, Sn as PresignOrgLogoResponseSchema, Sr as TriggerRunDetailResponseSchema, St as HistoryRunListQuerySchema, T as CompleteProjectArtifactResponseSchema, Ti as slugifyAppName, Tn as PresignUserAvatarRequestSchema, Tr as UpdateCredentialInstanceBodySchema, Tt as InviteOrganizationMembersResponseSchema, U as CreateProjectResponseSchema, Ui as PresignChatAttachmentResponseSchema, Un as PublishedFormListResponseSchema, Ur as WorkflowCanvasRunSchema, Ut as ListProjectFilesResponseSchema, V as CreateProjectArtifactResponseSchema, Vi as CLIENT_CHANNEL_HEADER, Vn as PublishManagedDeployCandidateRequestSchema, Vr as UserPreferencesSchema, Vt as ListOrganizationsResponseSchema, W as CreateSlackAppRequestSchema, Wn as PublishedFormSchema, Wr as WorkflowCanvasSchema, Wt as ListProjectMembersResponseSchema, X as DOCS_QUERY_TOOL, Xi as BillingUsageResponseSchema, Xr as WorkflowRunInputsSchema, Xt as ManagedServiceCredentialSchema, Y as CredentialInstanceRecordSchema, Yi as BillingSummaryResponseSchema, Yn as RenewManagedDeployUploadResponseSchema, Yr as WorkflowRunInputsPutBodySchema, Yt as ManagedDeployResourceKeySchema, Z as DOCS_SEARCH_TOOL, Zi as ConfirmCheckoutRequestSchema, Zn as SLACK_PERSONAL_APP_SLUG, Zr as WorkflowRunListResponseSchema, Zt as ManagedServiceKindSchema, _ as CatalogAppsPageResponseSchema, _n as PrepareManagedDeployRequestSchema, _r as TemplateFilesResponseSchema, _t as HealthResponseSchema, a as AgentSessionListResponseSchema, ai as WorkspaceTriggerRunListResponseSchema, ar as SlackAppManifestResponseSchema, at as DraftUpdateEventSchema, b as ChannelConnectionSchema, bn as PresignCustomAppLogoResponseSchema, br as TriggerInvokeResponseSchema, bt as HistoryRunCancelResponseSchema, c as AgentTriggerSummaryListResponseSchema, ci as buildConnectDeeplink, cr as StartKeystrokeConnectionInputSchema, ct as FinalizeCustomAppLogoRequestSchema, d as BindChannelBodySchema, di as gitPorcelainLineTouchesManagedDraftPublishPath, dr as StartMcpOAuthConnectionResultSchema, dt as GatewayAttachmentRecordSchema, ea as CreateCreditsCheckoutRequestSchema, ei as WorkflowSummaryListResponseSchema, en as OrganizationSidebarBrandingPatchSchema, er as SkillSummaryListResponseSchema, et as DownloadActiveProjectSourceResponseSchema, f as CancelManagedDeployRequestSchema, fi as isAcceptableInstallExit, fn as PlatformAgentCancelResponseSchema, fr as StartOAuthConnectionInputSchema, ft as GetAppCatalogEntryResponseSchema, g as CatalogAppDetailResponseSchema, gi as normalizeDocsSearchPaths, gn as PlatformAgentSessionListResponseSchema, gr as SubmitTeamRequestRequestSchema, gt as GraphqlDiscoverResponseSchema, h as CatalogActionsPageResponseSchema, hn as PlatformAgentSessionDetailResponseSchema, hr as SubmitMarketingContactRequestSchema, ht as GetTemplateResponseSchema, i as AgentSessionDetailResponseSchema, ii as WorkspaceTriggerOverviewSchema, in as PROJECT_DRAFT_DIFF_MAX_BYTES, ir as SlackAppManifestRequestSchema, it as DraftRevisionResponseSchema, j as CreateCredentialInstanceBodySchema, ji as CredentialConsumerListQuerySchema, jn as ProjectPullStateSchema, jr as UpdateProjectMemberRequestSchema, jt as ListAppsResponseSchema, k as CreateApiKeyRequestSchema, ki as CredentialAssignmentListResponseSchema, kn as ProjectGitRemoteResponseSchema, kr as UpdateOrganizationMemberResponseSchema, kt as ListAgentWorkspaceFilesResponseSchema, l as AppSlugAvailabilityResponseSchema, li as deriveCustomAppDisplay, lr as StartKeystrokeConnectionResultSchema, lt as FinalizeCustomAppLogoResponseSchema, m as CatalogActionDetailResponseSchema, mi as isIgnoredProjectSourcePath, mn as PlatformAgentPromptResponseSchema, mr as SubmitAgentFeedbackRequestSchema, mt as GetCustomAppResponseSchema, n as ActiveOrganizationResponseSchema, na as UpdateAutoTopupRequestSchema, ni as WorkspaceTriggerFileSchema, nn as PNPM_FROZEN_INSTALL_ARGS, nr as SlackAppInstallStartResponseSchema, nt as DraftConflictResponseSchema, o as AgentSummaryDetailResponseSchema, oi as WorkspaceWorkflowOverviewSchema, on as PROJECT_PULL_STATE_RELATIVE_PATH, or as SlackMembershipChannelBodySchema, ot as DuplicateCredentialRequestSchema, p as CancelManagedDeployResponseSchema, pn as PlatformAgentPromptInputSchema, pr as StartOAuthConnectionResultSchema, pt as GetCredentialResponseSchema, q as CreateSlackChannelResponseSchema, qi as BillingInvoiceUrlResponseSchema, qn as RecentResourceListResponseSchema, qr as WorkflowRunDetailResponseSchema, qt as ListTemplatesResponseSchema, r as ActiveProjectSourceRevisionSchema, ri as WorkspaceTriggerListResponseSchema, rn as PROJECT_DRAFT_COMMIT_REQUEST_TIMEOUT_MS, rr as SlackAppListResponseSchema, rt as DraftFileContentResponseSchema, s as AgentSummaryListResponseSchema, si as buildAgentSlackDeeplink, sn as PROJECT_REACHABILITY_REQUEST_TIMEOUT_MS, sr as SlugAvailabilityResponseSchema, st as DuplicateCredentialsResponseSchema, t as AcceptOrganizationInvitationResponseSchema, ta as CreateSubscriptionCheckoutRequestSchema, ti as WorkspaceTriggerDetailSchema, tn as OrganizationSidebarBrandingSchema, tr as SlackAgentMembershipsResponseSchema, tt as DraftCommitResponseSchema, u as BindAgentSlackAppBodySchema, ui as detectProjectPackageManagerFromSnapshot, ur as StartMcpOAuthConnectionInputSchema, ut as FormFieldConfigSchema, v as ChannelAccountListResponseSchema, vi as parseAppSlug, vn as PrepareManagedDeployResponseSchema, vr as TriggerDetailResponseSchema, vt as HeartbeatManagedDeployRequestSchema, w as CompleteProjectArtifactRequestSchema, wi as resolveDocsMcpUrl, wn as PresignProjectSourceResponseSchema, wr as UpdateChannelBindingBodySchema, wt as InviteOrganizationMembersRequestSchema, x as ChannelDirectoryListResponseSchema, xi as parseSlackConnectFlow, xn as PresignOrgLogoRequestSchema, xr as TriggerListResponseSchema, xt as HistoryRunDetailResponseSchema, y as ChannelConnectionListResponseSchema, yi as parseErrorResponse, yn as PresignCustomAppLogoRequestSchema, yr as TriggerInvokeInputsSchema, yt as HeartbeatManagedDeployResponseSchema, z as CreateOrganizationResponseSchema, zn as PublicFormSubmitBodySchema, zr as UserAvatarSchema, zt as ListOrganizationMembersPageQuerySchema } from "./dist-Cy2nsWsI.mjs";
-import { $ as artifactIndexFromModules, Q as withMcpReadClient, X as PublicHttpUrlError, Z as assertPublicHttpUrl, _t as configureTelemetry, bt as shutdownTelemetry, et as collectArtifactModules, gt as captureException, ht as alias, nt as moduleBlobRefsFromModules, tt as mapInParallelBatches, vt as event, yt as flushTelemetry } from "./dist-Dg-PHK0j.mjs";
-import { a as buildApp, c as computeSafeFilteredDeploy, r as analyzeDeployableClosures, t as ANALYZER_CONTRACT_VERSION } from "./dist-DeMzV-BR.mjs";
+import { A as resolvePlatformUrlForWebUrl, C as createCliConfig, D as getWebUrl, E as getPlatformUrl, M as ExpectedCliError, N as isExpectedCliError, O as DEFAULT_PLATFORM_URL, S as resolveCliRoot, T as getCredentialStorage, _ as isLocalSdkSpec, a as formatReleaseAgeBlockMessage, b as shouldUpdateCliVersion, c as detectManagerFromLockfile, d as installDependencies$1, f as installPlaygroundDependencies, g as ensureSdkCurrent, i as readPnpmMinimumReleaseAgeMinutes, j as parseCredentialStorage, l as buildPlaygroundWorkspace, m as resolvePackageManager, n as ensureMinimumReleaseAgeExclude, o as isReleaseAgeBlock, p as resolveGithubPackagesToken, r as computeReleaseAgeRetryAfter, s as detectCliInstall, t as runPackageManagerUpdate, u as detectPackageManager$2, v as fetchLatestCliRelease, w as getCliConfigDir, x as readCliVersion, y as resolveCliDistTag } from "./run-package-manager-update-D_nLqg4e.mjs";
+import { $ as DownloadActiveProjectArtifactResponseSchema, $i as CreateBillingPortalRequestSchema, $n as SkillSummaryDetailResponseSchema, $r as WorkflowSummaryDetailResponseSchema, $t as OpenApiDiscoverResponseSchema, A as CreateApiKeyResponseSchema, Ai as CredentialAssignmentRecordSchema, An as ProjectGitStatusResponseSchema, Ar as UpdateOrganizationRequestSchema, At as ListApiKeysResponseSchema, B as CreateProjectArtifactRequestSchema, Bi as ACTIVE_ORG_HEADER, Bn as PublicFormSubmitResponseSchema, Br as UserPreferencesPatchSchema, Bt as ListOrganizationMembersPageResponseSchema, C as CompleteManagedDeployArtifactResponseSchema, Ci as resolveConnectAppSlug, Cn as PresignProjectSourceRequestSchema, Cr as TriggerRunListResponseSchema, Ct as HistoryRunListResponseSchema, D as ConnectManagedServiceCredentialRequestSchema, Di as AssignCredentialBodySchema, Dr as UpdateManagedServiceCredentialRequestSchema, Dt as InviteProjectMembersResponseSchema, E as ConnectAuthorizeUrlResponseSchema, En as PresignUserAvatarResponseSchema, Er as UpdateCredentialRequestSchema, Et as InviteProjectMembersRequestSchema, F as CreateCustomAppResponseSchema, Fn as ProjectSlugAvailabilityResponseSchema, Fr as UploadProjectSourceManifestRequestSchema, Ft as ListDraftFilesResponseSchema, G as CreateSlackAppResponseSchema, Gi as AutoTopupSummarySchema, Gn as QueuedAgentPromptResponseSchema, Gr as WorkflowFormResponseSchema, Gt as ListProjectMetricsResponseSchema, H as CreateProjectRequestSchema, Hi as PresignChatAttachmentRequestSchema, Hn as PublishManagedDeployCandidateResponseSchema, Hr as WorkflowCanvasCredentialBindingsSchema, Ht as ListProjectDeploymentsResponseSchema, I as CreateDraftCommitRequestSchema, In as PromptInputSchema, Ir as UploadProjectSourceResponseSchema, It as ListManagedServiceCredentialsResponseSchema, J as CredentialInstanceListResponseSchema, Ji as BillingRedirectResponseSchema, Jn as RenewManagedDeployUploadRequestSchema, Jr as WorkflowRunHooksResponseSchema, Jt as MANAGED_DEPLOY_REQUEST_TIMEOUT_MS, K as CreateSlackChannelBodySchema, Ki as BillingActivityResponseSchema, Kn as QueuedRunResponseSchema, Kr as WorkflowFormUpsertBodySchema, Kt as ListProjectsResponseSchema, L as CreateDraftDiffCommitRequestSchema, Ln as PromptResponseSchema, Lr as UpsertGatewayAttachmentBodySchema, Lt as ListMcpAppToolsResponseSchema, M as CreateCredentialsRequestSchema, Mi as CredentialConsumerListResponseSchema, Mn as ProjectReachabilityResponseSchema, Mr as UpdateProjectMemberResponseSchema, Mt as ListChannelPlatformsResponseSchema, N as CreateCredentialsResponseSchema, Ni as ExecuteKeystrokeToolRequestSchema, Nn as ProjectResponseSchema, Nr as UpdateProjectRequestSchema, Nt as ListCredentialsPageQuerySchema, O as ConnectProvidersResponseSchema, Oi as CredentialAssignmentListQuerySchema, On as ProjectGitRemoteRequestSchema, Or as UpdateOrganizationMemberRequestSchema, Ot as ListAgentMemoryFilesResponseSchema, P as CreateCustomAppRequestSchema, Pn as ProjectSettingsResponseSchema, Pr as UpdateProjectSettingsRequestSchema, Pt as ListCredentialsPageResponseSchema, Q as DeclineOrganizationInvitationResponseSchema, Qi as ConfirmCheckoutResponseSchema, Qr as WorkflowRunResponseSchema, Qt as McpDiscoverResponseSchema, R as CreateOrganizationRequestSchema, Rn as PublicFormMetadataSchema, Rr as UserAvatarPatchSchema, Rt as ListOrganizationInvitationsResponseSchema, S as CompleteManagedDeployArtifactRequestSchema, Sn as PresignOrgLogoResponseSchema, Sr as TriggerRunDetailResponseSchema, St as HistoryRunListQuerySchema, T as CompleteProjectArtifactResponseSchema, Ti as slugifyAppName, Tn as PresignUserAvatarRequestSchema, Tr as UpdateCredentialInstanceBodySchema, Tt as InviteOrganizationMembersResponseSchema, U as CreateProjectResponseSchema, Ui as PresignChatAttachmentResponseSchema, Un as PublishedFormListResponseSchema, Ur as WorkflowCanvasRunSchema, Ut as ListProjectFilesResponseSchema, V as CreateProjectArtifactResponseSchema, Vi as CLIENT_CHANNEL_HEADER, Vn as PublishManagedDeployCandidateRequestSchema, Vr as UserPreferencesSchema, Vt as ListOrganizationsResponseSchema, W as CreateSlackAppRequestSchema, Wn as PublishedFormSchema, Wr as WorkflowCanvasSchema, Wt as ListProjectMembersResponseSchema, X as DOCS_QUERY_TOOL, Xi as BillingUsageResponseSchema, Xr as WorkflowRunInputsSchema, Xt as ManagedServiceCredentialSchema, Y as CredentialInstanceRecordSchema, Yi as BillingSummaryResponseSchema, Yn as RenewManagedDeployUploadResponseSchema, Yr as WorkflowRunInputsPutBodySchema, Yt as ManagedDeployResourceKeySchema, Z as DOCS_SEARCH_TOOL, Zi as ConfirmCheckoutRequestSchema, Zn as SLACK_PERSONAL_APP_SLUG, Zr as WorkflowRunListResponseSchema, Zt as ManagedServiceKindSchema, _ as CatalogAppsPageResponseSchema, _n as PrepareManagedDeployRequestSchema, _r as TemplateFilesResponseSchema, _t as HealthResponseSchema, a as AgentSessionListResponseSchema, ai as WorkspaceTriggerRunListResponseSchema, ar as SlackAppManifestResponseSchema, at as DraftUpdateEventSchema, b as ChannelConnectionSchema, bn as PresignCustomAppLogoResponseSchema, br as TriggerInvokeResponseSchema, bt as HistoryRunCancelResponseSchema, c as AgentTriggerSummaryListResponseSchema, ci as buildConnectDeeplink, cr as StartKeystrokeConnectionInputSchema, ct as FinalizeCustomAppLogoRequestSchema, d as BindChannelBodySchema, di as gitPorcelainLineTouchesManagedDraftPublishPath, dr as StartMcpOAuthConnectionResultSchema, dt as GatewayAttachmentRecordSchema, ea as CreateCreditsCheckoutRequestSchema, ei as WorkflowSummaryListResponseSchema, en as OrganizationSidebarBrandingPatchSchema, er as SkillSummaryListResponseSchema, et as DownloadActiveProjectSourceResponseSchema, f as CancelManagedDeployRequestSchema, fi as isAcceptableInstallExit, fn as PlatformAgentCancelResponseSchema, fr as StartOAuthConnectionInputSchema, ft as GetAppCatalogEntryResponseSchema, g as CatalogAppDetailResponseSchema, gi as normalizeDocsSearchPaths, gn as PlatformAgentSessionListResponseSchema, gr as SubmitTeamRequestRequestSchema, gt as GraphqlDiscoverResponseSchema, h as CatalogActionsPageResponseSchema, hn as PlatformAgentSessionDetailResponseSchema, hr as SubmitMarketingContactRequestSchema, ht as GetTemplateResponseSchema, i as AgentSessionDetailResponseSchema, ii as WorkspaceTriggerOverviewSchema, in as PROJECT_DRAFT_DIFF_MAX_BYTES, ir as SlackAppManifestRequestSchema, it as DraftRevisionResponseSchema, j as CreateCredentialInstanceBodySchema, ji as CredentialConsumerListQuerySchema, jn as ProjectPullStateSchema, jr as UpdateProjectMemberRequestSchema, jt as ListAppsResponseSchema, k as CreateApiKeyRequestSchema, ki as CredentialAssignmentListResponseSchema, kn as ProjectGitRemoteResponseSchema, kr as UpdateOrganizationMemberResponseSchema, kt as ListAgentWorkspaceFilesResponseSchema, l as AppSlugAvailabilityResponseSchema, li as deriveCustomAppDisplay, lr as StartKeystrokeConnectionResultSchema, lt as FinalizeCustomAppLogoResponseSchema, m as CatalogActionDetailResponseSchema, mi as isIgnoredProjectSourcePath, mn as PlatformAgentPromptResponseSchema, mr as SubmitAgentFeedbackRequestSchema, mt as GetCustomAppResponseSchema, n as ActiveOrganizationResponseSchema, na as UpdateAutoTopupRequestSchema, ni as WorkspaceTriggerFileSchema, nn as PNPM_FROZEN_INSTALL_ARGS, nr as SlackAppInstallStartResponseSchema, nt as DraftConflictResponseSchema, o as AgentSummaryDetailResponseSchema, oi as WorkspaceWorkflowOverviewSchema, on as PROJECT_PULL_STATE_RELATIVE_PATH, or as SlackMembershipChannelBodySchema, ot as DuplicateCredentialRequestSchema, p as CancelManagedDeployResponseSchema, pn as PlatformAgentPromptInputSchema, pr as StartOAuthConnectionResultSchema, pt as GetCredentialResponseSchema, q as CreateSlackChannelResponseSchema, qi as BillingInvoiceUrlResponseSchema, qn as RecentResourceListResponseSchema, qr as WorkflowRunDetailResponseSchema, qt as ListTemplatesResponseSchema, r as ActiveProjectSourceRevisionSchema, ri as WorkspaceTriggerListResponseSchema, rn as PROJECT_DRAFT_COMMIT_REQUEST_TIMEOUT_MS, rr as SlackAppListResponseSchema, rt as DraftFileContentResponseSchema, s as AgentSummaryListResponseSchema, si as buildAgentSlackDeeplink, sn as PROJECT_REACHABILITY_REQUEST_TIMEOUT_MS, sr as SlugAvailabilityResponseSchema, st as DuplicateCredentialsResponseSchema, t as AcceptOrganizationInvitationResponseSchema, ta as CreateSubscriptionCheckoutRequestSchema, ti as WorkspaceTriggerDetailSchema, tn as OrganizationSidebarBrandingSchema, tr as SlackAgentMembershipsResponseSchema, tt as DraftCommitResponseSchema, u as BindAgentSlackAppBodySchema, ui as detectProjectPackageManagerFromSnapshot, ur as StartMcpOAuthConnectionInputSchema, ut as FormFieldConfigSchema, v as ChannelAccountListResponseSchema, vi as parseAppSlug, vn as PrepareManagedDeployResponseSchema, vr as TriggerDetailResponseSchema, vt as HeartbeatManagedDeployRequestSchema, w as CompleteProjectArtifactRequestSchema, wi as resolveDocsMcpUrl, wn as PresignProjectSourceResponseSchema, wr as UpdateChannelBindingBodySchema, wt as InviteOrganizationMembersRequestSchema, x as ChannelDirectoryListResponseSchema, xi as parseSlackConnectFlow, xn as PresignOrgLogoRequestSchema, xr as TriggerListResponseSchema, xt as HistoryRunDetailResponseSchema, y as ChannelConnectionListResponseSchema, yi as parseErrorResponse, yn as PresignCustomAppLogoRequestSchema, yr as TriggerInvokeInputsSchema, yt as HeartbeatManagedDeployResponseSchema, z as CreateOrganizationResponseSchema, zn as PublicFormSubmitBodySchema, zr as UserAvatarSchema, zt as ListOrganizationMembersPageQuerySchema } from "./dist-BgPOKEEt.mjs";
+import { $ as artifactIndexFromModules, Q as withMcpReadClient, X as PublicHttpUrlError, Z as assertPublicHttpUrl, _t as configureTelemetry, bt as shutdownTelemetry, et as collectArtifactModules, gt as captureException, ht as alias, nt as moduleBlobRefsFromModules, tt as mapInParallelBatches, vt as event, yt as flushTelemetry } from "./dist-fy1jz-eq.mjs";
+import { a as buildApp, c as computeSafeFilteredDeploy, r as analyzeDeployableClosures, t as ANALYZER_CONTRACT_VERSION } from "./dist-v54rjb2O.mjs";
 import { createRequire } from "node:module";
 import { Command } from "commander";
 import { homedir, platform, release, tmpdir } from "node:os";
@@ -11,7 +11,7 @@ import { chmodSync, cpSync, existsSync, lstatSync, mkdirSync, readFileSync, real
 import { execFile, spawn, spawnSync } from "node:child_process";
 import { Entry } from "@napi-rs/keyring";
 import { PostHog } from "posthog-node";
-import { access, chmod, copyFile, lstat, mkdir, mkdtemp, readFile, readdir, rm, stat, symlink, writeFile } from "node:fs/promises";
+import { access, chmod, lstat, mkdir, mkdtemp, readFile, readdir, rm, stat, symlink, writeFile } from "node:fs/promises";
 import { confirm, input } from "@inquirer/prompts";
 import { createHash, randomUUID } from "node:crypto";
 //#region ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/errors/KyError.js
@@ -7739,21 +7739,21 @@ function listActionsHint(app) {
 /** Hint when listing actions for a custom org app (no toolkit tools). */
 function listCustomAppActionsHint(app) {
 	const bin = cliBinaryName();
-	return `\nCustom org apps have no catalog action list.\n  Inspect app:     ${bin} apps get ${app}\n  Scaffold code:   ${bin} apps sync ${app}\n  Connect secret:  ${bin} connect ${app}\n  Author actions:  defineApp({ slug: "${app}", ... }).action(...)\n  Smoke-test:      deploy a thin workflow that calls the action, then\n                   ${bin} workflows run <workflow-slug> --input '{...}' --wait\n  (${bin} apps execute is catalog-only — not for custom app actions.)\n`;
+	return `\nCustom org apps have no catalog action list.\n  Inspect app:     ${bin} apps get ${app}\n  Scaffold code:   ${bin} apps sync ${app}\n  Connect secret:  ${bin} connect ${app}\n  Author actions:  defineApp({ slug: "${app}", ... }).action(...)\n  Smoke-test:      deploy a thin workflow that calls the action, then\n                   ${bin} workflows run <workflow-slug> --input '{...}' --wait\n  (${bin} apps execute is for catalog toolkit actions and custom MCP tools.)\n`;
 }
 /**
-* Error when `apps execute` is pointed at a custom org app (`{org}/{name}`).
+* Error when `apps execute` is pointed at a non-MCP custom org app (`{org}/{name}`).
 * Catalog toolkit execute cannot reach defineApp(...).action(...) project code.
 */
 function customAppExecuteError(app, options) {
 	const bin = cliBinaryName();
-	const mcpLine = options?.source === "mcp" ? `  Live MCP tools:  ${bin} apps actions list ${app}  (after connect)\n` : "";
-	return `${bin} apps execute only runs built-in catalog toolkit actions.\n"${app}" is a custom org app — its actions live in project code as defineApp(...).action(...), not in the catalog.\n\nSmoke-test a custom app action by deploying a thin workflow that calls it, then:\n  ${bin} workflows run <workflow-slug> --input '{...}' --wait\n\n  Inspect app:     ${bin} apps get ${app}\n  Scaffold/author: ${bin} apps sync ${app}\n` + mcpLine;
+	if (options?.source === "mcp") return `"${app}" is a custom MCP app. Smoke-test a remote tool after connect:\n  ${bin} apps actions list ${app}\n  ${bin} apps execute ${app} <tool> --input '{...}'\n`;
+	return `${bin} apps execute runs catalog toolkit actions and custom MCP tools.\n"${app}" is a custom org app — its actions live in project code as defineApp(...).action(...), not in the catalog.\n\nSmoke-test a custom app action by deploying a thin workflow that calls it, then:\n  ${bin} workflows run <workflow-slug> --input '{...}' --wait\n\n  Inspect app:     ${bin} apps get ${app}\n  Scaffold/author: ${bin} apps sync ${app}\n`;
 }
 /** Hint after listing live tools on a connected custom MCP app. */
 function listMcpAppActionsHint(app) {
 	const bin = cliBinaryName();
-	return `\nMCP tool registry (live tools/list).\n  Docs first:      ${bin} docs search "custom apps MCP"\n  Inspect app:     ${bin} apps get ${app}\n  Scaffold code:   ${bin} apps sync ${app}\n  Author actions:  defineApp({ slug: "${app}", ... }).action(...) for tools you need\n  Do not use defineMcp from @keystrokehq/keystroke/agent.\n`;
+	return `\nMCP tool registry (live tools/list).\n  Docs first:      ${bin} docs search "custom apps MCP"\n  Inspect app:     ${bin} apps get ${app}\n  Smoke-test tool: ${bin} apps execute ${app} <tool> --input '{...}'\n  Scaffold code:   ${bin} apps sync ${app}\n  Author actions:  defineApp(...).action(...) from the tool schemas above\n  Attach to agent: tools: [<app>] for every registered action, or pick actions\n  Do not use defineMcp from @keystrokehq/keystroke/agent.\n`;
 }
 /** Hint when MCP list fails because the app is not connected. */
 function listMcpAppConnectHint(app) {
@@ -8101,10 +8101,27 @@ function isNotFoundError(error) {
 	if (error.status === 404) return true;
 	return /not found/i.test(error.message);
 }
+async function executeConnectedAppTool(client, app, tool, options) {
+	const credentialSlug = options.credentialSlug?.trim() || void 0;
+	const projectSlug = options.projectSlug?.trim() || void 0;
+	try {
+		const { result } = await client.apps.executeTool({
+			app,
+			tool,
+			...options.version ? { version: options.version } : {},
+			arguments: typeof options.input === "object" && options.input !== null && !Array.isArray(options.input) ? options.input : {},
+			...credentialSlug ? { credentialSlug } : {},
+			...projectSlug ? { projectSlug } : {}
+		});
+		return result;
+	} catch (error) {
+		if (isNotConnectedError(error) && !credentialSlug) throw new Error(`Not connected to ${app}. Run: ${cliBinaryName()} connect ${app}`);
+		throw error;
+	}
+}
 async function runAppExecute(client, appSlug, toolSlug, options) {
 	const app = appSlug.trim().toLowerCase();
-	const tool = toolSlug.trim().toUpperCase();
-	if (!app || !tool) throw new Error("App and tool slugs are required (e.g. github github_get_the_authenticated_user)");
+	if (!app || !toolSlug.trim()) throw new Error("App and tool slugs are required (e.g. github github_get_the_authenticated_user)");
 	const parsed = parseAppSlug(app);
 	if (parsed.kind === "org") {
 		let source;
@@ -8112,35 +8129,26 @@ async function runAppExecute(client, appSlug, toolSlug, options) {
 			const shown = await runAppShow(client, parsed.slug);
 			if (shown.kind === "custom") source = shown.app.source;
 		} catch {}
+		if (source === "mcp") return executeConnectedAppTool(client, parsed.slug, toolSlug.trim(), options);
 		throw new Error(customAppExecuteError(parsed.slug, { source }));
 	}
-	const credentialSlug = options.credentialSlug?.trim() || void 0;
-	const projectSlug = options.projectSlug?.trim() || void 0;
+	const tool = toolSlug.trim().toUpperCase();
 	let version = options.version?.trim() || void 0;
 	if (!version) try {
 		version = (await client.apps.getCatalogAction(tool)).version?.trim() || void 0;
 	} catch (error) {
 		if (isNotFoundError(error)) {
 			const shown = await runAppShow(client, app).catch(() => null);
+			if (shown?.kind === "custom" && shown.app.source === "mcp") return executeConnectedAppTool(client, shown.app.slug, toolSlug.trim(), options);
 			if (shown?.kind === "custom") throw new Error(customAppExecuteError(shown.app.slug, { source: shown.app.source }));
 		}
 		throw error;
 	}
 	if (!version) throw new Error(`Catalog action "${tool}" has no pinned version. Pass --version explicitly.`);
-	try {
-		const { result } = await client.apps.executeTool({
-			app,
-			tool,
-			version,
-			arguments: typeof options.input === "object" && options.input !== null && !Array.isArray(options.input) ? options.input : {},
-			...credentialSlug ? { credentialSlug } : {},
-			...projectSlug ? { projectSlug } : {}
-		});
-		return result;
-	} catch (error) {
-		if (isNotConnectedError(error) && !credentialSlug) throw new Error(`Not connected to ${app}. Run: ${cliBinaryName()} connect ${app}`);
-		throw error;
-	}
+	return executeConnectedAppTool(client, app, tool, {
+		...options,
+		version
+	});
 }
 //#endregion
 //#region src/commands/apps/execute.ts
@@ -8228,13 +8236,15 @@ function resolveSyncedAppDirName(slug) {
 }
 function generateAppStub(app) {
 	const exportName = resolveSyncedAppExportName(app.slug);
-	const mcpNote = app.source === "mcp" ? `\n * MCP URL: ${app.url ?? "(missing)"}. Prefer \`keystroke docs search "custom apps MCP"\`, then \`keystroke apps actions list ${app.slug}\` after connect.` : "";
+	const isMcp = app.source === "mcp";
+	const mcpNote = isMcp ? `\n * MCP URL: ${app.url ?? "(missing)"}. After connect, run \`keystroke apps actions list ${app.slug}\` to inspect tools, author \`app.action(...)\` wrappers, then put \`${exportName}\` in an agent's \`tools: [${exportName}]\` (or pick individual actions).` : "";
+	const sourceField = isMcp ? `\n  source: "mcp",` : "";
 	if (app.authKind === "oauth") return `import { defineApp } from "@keystrokehq/keystroke/app";
 
 /** Synced from platform app \`${app.slug}\`. Re-run \`keystroke apps sync ${app.slug}\` after template changes.${mcpNote} */
 export const ${exportName} = defineApp({
   slug: ${JSON.stringify(app.slug)},
-  auth: "oauth",
+  auth: "oauth",${sourceField}
 });
 `;
 	const credentialLines = Object.entries(app.credentialFields ?? {}).map(([key, field]) => {
@@ -8246,7 +8256,7 @@ import { z } from "zod";
 /** Synced from platform app \`${app.slug}\`. Re-run \`keystroke apps sync ${app.slug}\` after template changes.${mcpNote} */
 export const ${exportName} = defineApp({
   slug: ${JSON.stringify(app.slug)},
-  auth: "api_key",
+  auth: "api_key",${sourceField}
   credential: {
 ${credentialLines}
   },
@@ -8966,7 +8976,7 @@ function registerBuildCommand(program) {
 		try {
 			const root = resolveProjectRoot(options.dir);
 			await ensureSdkCurrent(root);
-			const { buildApp } = await import("./dist-B_Dy4mW_.mjs");
+			const { buildApp } = await import("./dist-Co-J5D_c.mjs");
 			await buildApp({ root });
 			process.stdout.write(`Built ${root}\n`);
 		} catch (error) {
@@ -9793,136 +9803,31 @@ function managedDeployNeedsImpactAcceptance(preflight) {
 	return preflight.mode === "filtered" && (preflight.impactCompleteness === "unknown" || preflight.impactedResourceKeys.length > 0 || preflight.expansions.length > 0 || preflight.requestedResourceKeys.length !== preflight.resourceKeys.length || !preflight.requestedResourceKeys.every((key) => preflight.resourceKeys.includes(key)));
 }
 //#endregion
-//#region src/git/compute-working-tree-diff.ts
-/** Resolve a path returned by `git rev-parse --git-path` (absolute or cwd-relative). */
-function resolveGitPath(cwd, gitPath) {
-	return isAbsolute(gitPath) ? gitPath : resolve(cwd, gitPath);
-}
-async function listNullSeparatedPaths(cwd, args, env) {
-	const { stdout } = await runGit(args, {
-		cwd,
-		env
-	});
-	return stdout.split("\0").filter((path) => path.length > 0);
-}
-/**
-* Build a `git diff --binary` from `baseSha` to the desired working tree
-* (staged + unstaged + untracked), without mutating the real index.
-*
-* Uses `GIT_INDEX_FILE` against a copied index. Source-excluded paths
-* (`.env`, `node_modules`, `.keystroke`, …) keep their `baseSha` blob when
-* present on D0 (so the patch never deletes or locally-edits them); otherwise
-* they are dropped from the temp index so untracked secrets stay out.
-*/
-async function computeWorkingTreeDiff(input) {
-	const baseEnv = input.env;
-	const gitIndexPath = (await runGit([
-		"rev-parse",
-		"--git-path",
-		"index"
-	], {
-		cwd: input.cwd,
-		env: baseEnv
-	})).stdout.trim();
-	const realIndexPath = resolveGitPath(input.cwd, gitIndexPath);
-	const tempDir = await mkdtemp(join(tmpdir(), "keystroke-draft-index-"));
-	const tempIndexPath = input.resolveTempIndexPath?.() ?? join(tempDir, "index");
-	try {
-		await copyFile(realIndexPath, tempIndexPath);
-		const indexEnv = {
-			...baseEnv,
-			GIT_INDEX_FILE: tempIndexPath
-		};
-		await runGit([
-			"add",
-			"-A",
-			"--",
-			"."
-		], {
-			cwd: input.cwd,
-			env: indexEnv
-		});
-		const baseExcluded = (await listNullSeparatedPaths(input.cwd, [
-			"ls-tree",
-			"-r",
-			"--name-only",
-			"-z",
-			input.baseSha
-		], baseEnv)).filter((path) => isIgnoredProjectSourcePath(path));
-		for (const path of baseExcluded) await runGit([
-			"restore",
-			"--source",
-			input.baseSha,
-			"--staged",
-			"--",
-			path
-		], {
-			cwd: input.cwd,
-			env: indexEnv
-		});
-		const indexExcluded = (await listNullSeparatedPaths(input.cwd, ["ls-files", "-z"], indexEnv)).filter((path) => isIgnoredProjectSourcePath(path));
-		const baseExcludedSet = new Set(baseExcluded);
-		const toRemove = indexExcluded.filter((path) => !baseExcludedSet.has(path));
-		if (toRemove.length > 0) await runGit([
-			"rm",
-			"--cached",
-			"-f",
-			"-q",
-			"--",
-			...toRemove
-		], {
-			cwd: input.cwd,
-			env: indexEnv
-		});
-		const diff = await runGitBuffer([
-			"diff",
-			"--binary",
-			"--cached",
-			input.baseSha
-		], {
-			cwd: input.cwd,
-			env: indexEnv,
-			reject: false
-		});
-		if (diff.code !== 0 && diff.code !== 1) throw new Error(`git diff --binary failed (exit ${diff.code}): ${diff.stderr.toString("utf8")}`);
-		if (diff.stdout.byteLength > 2097152) throw new ExpectedCliError(`Working tree diff exceeds the ${PROJECT_DRAFT_DIFF_MAX_BYTES} byte limit. Reduce local changes or split them before syncing.`);
-		return new Uint8Array(diff.stdout);
-	} finally {
-		await rm(tempDir, {
-			recursive: true,
-			force: true
-		}).catch(() => {});
-	}
-}
-//#endregion
 //#region src/git/commit-working-tree.ts
 /**
 * Create a local commit from the desired working tree (source-filtered),
 * parented by `baseSha`, without mutating the real index. Returns null when
 * the resulting tree matches `baseSha`.
+*
+* Seeds the temp index with `read-tree baseSha` (not a copy of the real index)
+* so same-size same-mtime worktree rewrites cannot be skipped under racy-git.
 */
 async function commitWorkingTreeOntoBase(input) {
 	const baseEnv = await resolveGitCommitEnv({
 		cwd: input.cwd,
 		env: input.env
 	});
-	const gitIndexPath = (await runGit([
-		"rev-parse",
-		"--git-path",
-		"index"
-	], {
-		cwd: input.cwd,
-		env: baseEnv
-	})).stdout.trim();
-	const realIndexPath = resolveGitPath(input.cwd, gitIndexPath);
 	const tempDir = await mkdtemp(join(tmpdir(), "keystroke-draft-commit-"));
 	const tempIndexPath = join(tempDir, "index");
 	try {
-		await copyFile(realIndexPath, tempIndexPath);
 		const indexEnv = {
 			...baseEnv,
 			GIT_INDEX_FILE: tempIndexPath
 		};
+		await runGit(["read-tree", input.baseSha], {
+			cwd: input.cwd,
+			env: indexEnv
+		});
 		await runGit([
 			"add",
 			"-A",
@@ -10000,6 +9905,101 @@ async function commitWorkingTreeOntoBase(input) {
 	}
 }
 //#endregion
+//#region src/git/compute-working-tree-diff.ts
+async function listNullSeparatedPaths(cwd, args, env) {
+	const { stdout } = await runGit(args, {
+		cwd,
+		env
+	});
+	return stdout.split("\0").filter((path) => path.length > 0);
+}
+/**
+* Build a `git diff --binary` from `baseSha` to the desired working tree
+* (staged + unstaged + untracked), without mutating the real index.
+*
+* Seeds a temp `GIT_INDEX_FILE` with `read-tree baseSha` (zeroed stats) then
+* `git add -A`. Copying the real index is unsafe: same-size same-mtime rewrites
+* can look clean under racy-git once the copied index file is newer than the
+* worktree. Source-excluded paths (`.env`, `node_modules`, `.keystroke`, …)
+* keep their `baseSha` blob when present on D0 (so the patch never deletes or
+* locally-edits them); otherwise they are dropped from the temp index so
+* untracked secrets stay out.
+*/
+async function computeWorkingTreeDiff(input) {
+	const baseEnv = input.env;
+	const tempDir = await mkdtemp(join(tmpdir(), "keystroke-draft-index-"));
+	const tempIndexPath = input.resolveTempIndexPath?.() ?? join(tempDir, "index");
+	try {
+		const indexEnv = {
+			...baseEnv,
+			GIT_INDEX_FILE: tempIndexPath
+		};
+		await runGit(["read-tree", input.baseSha], {
+			cwd: input.cwd,
+			env: indexEnv
+		});
+		await runGit([
+			"add",
+			"-A",
+			"--",
+			"."
+		], {
+			cwd: input.cwd,
+			env: indexEnv
+		});
+		const baseExcluded = (await listNullSeparatedPaths(input.cwd, [
+			"ls-tree",
+			"-r",
+			"--name-only",
+			"-z",
+			input.baseSha
+		], baseEnv)).filter((path) => isIgnoredProjectSourcePath(path));
+		for (const path of baseExcluded) await runGit([
+			"restore",
+			"--source",
+			input.baseSha,
+			"--staged",
+			"--",
+			path
+		], {
+			cwd: input.cwd,
+			env: indexEnv
+		});
+		const indexExcluded = (await listNullSeparatedPaths(input.cwd, ["ls-files", "-z"], indexEnv)).filter((path) => isIgnoredProjectSourcePath(path));
+		const baseExcludedSet = new Set(baseExcluded);
+		const toRemove = indexExcluded.filter((path) => !baseExcludedSet.has(path));
+		if (toRemove.length > 0) await runGit([
+			"rm",
+			"--cached",
+			"-f",
+			"-q",
+			"--",
+			...toRemove
+		], {
+			cwd: input.cwd,
+			env: indexEnv
+		});
+		const diff = await runGitBuffer([
+			"diff",
+			"--binary",
+			"--cached",
+			input.baseSha
+		], {
+			cwd: input.cwd,
+			env: indexEnv,
+			reject: false
+		});
+		if (diff.code !== 0 && diff.code !== 1) throw new Error(`git diff --binary failed (exit ${diff.code}): ${diff.stderr.toString("utf8")}`);
+		if (diff.stdout.byteLength > 2097152) throw new ExpectedCliError(`Working tree diff exceeds the ${PROJECT_DRAFT_DIFF_MAX_BYTES} byte limit. Reduce local changes or split them before syncing.`);
+		return new Uint8Array(diff.stdout);
+	} finally {
+		await rm(tempDir, {
+			recursive: true,
+			force: true
+		}).catch(() => {});
+	}
+}
+//#endregion
 //#region src/git/managed-transport.ts
 /**
 * Fetch a remote branch into a temporary ref, then pin to an exact commit SHA.
@@ -14210,7 +14210,7 @@ function createProgram() {
 async function runCli(argv) {
 	initCliTelemetry();
 	try {
-		const { maybeAutoUpdate } = await import("./maybe-auto-update-J-Am1CbS.mjs");
+		const { maybeAutoUpdate } = await import("./maybe-auto-update-oRHYV8-i.mjs");
 		await maybeAutoUpdate(argv);
 		await createProgram().parseAsync(argv);
 	} finally {
@@ -14220,4 +14220,4 @@ async function runCli(argv) {
 //#endregion
 export { runCli };
 
-//# sourceMappingURL=program-BWeEKhR_.mjs.map
+//# sourceMappingURL=program-CKQqD-RE.mjs.map