@keystrokehq/cli 0.1.170 → 0.1.172

package/dist/{program-D15UmszI.mjs → program-BfapxNQ4.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { A as resolvePlatformUrlForWebUrl, C as createCliConfig, D as getWebUrl, E as getPlatformUrl, M as ExpectedCliError, N as isExpectedCliError, O as DEFAULT_PLATFORM_URL, S as resolveCliRoot, T as getCredentialStorage, _ as isLocalSdkSpec, a as formatReleaseAgeBlockMessage, b as shouldUpdateCliVersion, c as detectManagerFromLockfile, d as installDependencies$1, f as installPlaygroundDependencies, g as ensureSdkCurrent, i as readPnpmMinimumReleaseAgeMinutes, j as parseCredentialStorage, l as buildPlaygroundWorkspace, m as resolvePackageManager, n as ensureMinimumReleaseAgeExclude, o as isReleaseAgeBlock, p as resolveGithubPackagesToken, r as computeReleaseAgeRetryAfter, s as detectCliInstall, t as runPackageManagerUpdate, u as detectPackageManager$2, v as fetchLatestCliRelease, w as getCliConfigDir, x as readCliVersion, y as resolveCliDistTag } from "./run-package-manager-update-5Us7eEJy.mjs";
-import { $ as DeclineOrganizationInvitationResponseSchema, $i as ConfirmCheckoutResponseSchema, $r as WorkflowRunResponseSchema, $t as McpDiscoverResponseSchema, A as CreateApiKeyRequestSchema, Ai as CredentialAssignmentListResponseSchema, An as ProjectGitRemoteResponseSchema, Ar as UpdateOrganizationMemberResponseSchema, At as ListAgentWorkspaceFilesResponseSchema, B as CreateOrganizationResponseSchema, Bn as PublicFormSubmitBodySchema, Br as UserAvatarSchema, Bt as ListOrganizationMembersPageQuerySchema, C as CompleteManagedDeployArtifactRequestSchema, Cn as PresignOrgLogoResponseSchema, Cr as TriggerRunDetailResponseSchema, Ct as HistoryRunListQuerySchema, D as ConnectAuthorizeUrlResponseSchema, Dn as PresignUserAvatarResponseSchema, Dr as UpdateCredentialRequestSchema, Dt as InviteProjectMembersRequestSchema, E as CompleteProjectArtifactResponseSchema, Ei as slugifyAppName, En as PresignUserAvatarRequestSchema, Er as UpdateCredentialInstanceBodySchema, Et as InviteOrganizationMembersResponseSchema, F as CreateCustomAppRequestSchema, Fn as ProjectSettingsResponseSchema, Fr as UpdateProjectSettingsRequestSchema, Ft as ListCredentialsPageResponseSchema, G as CreateSlackAppRequestSchema, Gn as PublishedFormSchema, Gr as WorkflowCanvasSchema, Gt as ListProjectMembersResponseSchema, H as CreateProjectArtifactResponseSchema, Hi as CLIENT_CHANNEL_HEADER, Hn as PublishManagedDeployCandidateRequestSchema, Hr as UserPreferencesSchema, Ht as ListOrganizationsResponseSchema, I as CreateCustomAppResponseSchema, In as ProjectSlugAvailabilityResponseSchema, Ir as UploadProjectSourceManifestRequestSchema, It as ListDraftFilesResponseSchema, J as CreateSlackChannelResponseSchema, Ji as BillingInvoiceUrlResponseSchema, Jn as RecentResourceListResponseSchema, Jr as WorkflowRunDetailResponseSchema, Jt as ListTemplatesResponseSchema, K as CreateSlackAppResponseSchema, Ki as AutoTopupSummarySchema, Kn as QueuedAgentPromptResponseSchema, Kr as WorkflowFormResponseSchema, Kt as ListProjectMetricsResponseSchema, L as CreateDraftCommitRequestSchema, Ln as PromptInputSchema, Lr as UploadProjectSourceResponseSchema, Lt as ListManagedServiceCredentialsResponseSchema, M as CreateCredentialInstanceBodySchema, Mi as CredentialConsumerListQuerySchema, Mn as ProjectPullStateSchema, Mr as UpdateProjectMemberRequestSchema, Mt as ListAppsResponseSchema, N as CreateCredentialsRequestSchema, Ni as CredentialConsumerListResponseSchema, Nn as ProjectReachabilityResponseSchema, Nr as UpdateProjectMemberResponseSchema, Nt as ListChannelPlatformsResponseSchema, O as ConnectManagedServiceCredentialRequestSchema, Oi as AssignCredentialBodySchema, Or as UpdateManagedServiceCredentialRequestSchema, Ot as InviteProjectMembersResponseSchema, P as CreateCredentialsResponseSchema, Pi as ExecuteKeystrokeToolRequestSchema, Pn as ProjectResponseSchema, Pr as UpdateProjectRequestSchema, Pt as ListCredentialsPageQuerySchema, Q as DOCS_SEARCH_TOOL, Qi as ConfirmCheckoutRequestSchema, Qn as SLACK_PERSONAL_APP_SLUG, Qr as WorkflowRunListResponseSchema, Qt as ManagedServiceKindSchema, R as CreateDraftDiffCommitRequestSchema, Rn as PromptResponseSchema, Rr as UpsertGatewayAttachmentBodySchema, Rt as ListMcpAppToolsResponseSchema, S as ChannelDirectoryListResponseSchema, Si as parseSlackConnectFlow, Sn as PresignOrgLogoRequestSchema, Sr as TriggerListResponseSchema, St as HistoryRunDetailResponseSchema, T as CompleteProjectArtifactRequestSchema, Ti as resolveDocsMcpUrl, Tn as PresignProjectSourceResponseSchema, Tr as UpdateChannelBindingBodySchema, Tt as InviteOrganizationMembersRequestSchema, U as CreateProjectRequestSchema, Ui as PresignChatAttachmentRequestSchema, Un as PublishManagedDeployCandidateResponseSchema, Ur as WorkflowCanvasCredentialBindingsSchema, Ut as ListProjectDeploymentsResponseSchema, V as CreateProjectArtifactRequestSchema, Vi as ACTIVE_ORG_HEADER, Vn as PublicFormSubmitResponseSchema, Vr as UserPreferencesPatchSchema, Vt as ListOrganizationMembersPageResponseSchema, W as CreateProjectResponseSchema, Wi as PresignChatAttachmentResponseSchema, Wn as PublishedFormListResponseSchema, Wr as WorkflowCanvasRunSchema, Wt as ListProjectFilesResponseSchema, X as CredentialInstanceRecordSchema, Xi as BillingSummaryResponseSchema, Xn as RenewManagedDeployUploadResponseSchema, Xr as WorkflowRunInputsPutBodySchema, Xt as ManagedDeployResourceKeySchema, Y as CredentialInstanceListResponseSchema, Yi as BillingRedirectResponseSchema, Yn as RenewManagedDeployUploadRequestSchema, Yr as WorkflowRunHooksResponseSchema, Yt as MANAGED_DEPLOY_REQUEST_TIMEOUT_MS, Z as DOCS_QUERY_TOOL, Zi as BillingUsageResponseSchema, Zr as WorkflowRunInputsSchema, Zt as ManagedServiceCredentialSchema, _ as CatalogAppDetailResponseSchema, _i as normalizeDocsSearchPaths, _n as PlatformAgentSessionListResponseSchema, _r as SubmitTeamRequestRequestSchema, _t as GraphqlDiscoverResponseSchema, a as AgentSessionDetailResponseSchema, ai as WorkspaceTriggerOverviewSchema, an as PROJECT_DRAFT_DIFF_MAX_BYTES, ar as SlackAppManifestRequestSchema, at as DraftRevisionResponseSchema, b as ChannelConnectionListResponseSchema, bi as parseErrorResponse, bn as PresignCustomAppLogoRequestSchema, br as TriggerInvokeInputsSchema, bt as HeartbeatManagedDeployResponseSchema, c as AgentSummaryListResponseSchema, ci as buildAgentSlackDeeplink, cn as PROJECT_REACHABILITY_REQUEST_TIMEOUT_MS, cr as SlugAvailabilityResponseSchema, ct as DuplicateCredentialsResponseSchema, d as BindAgentSlackAppBodySchema, di as detectProjectPackageManagerFromSnapshot, dr as StartMcpOAuthConnectionInputSchema, dt as FormFieldConfigSchema, ea as CreateBillingPortalRequestSchema, ei as WorkflowSummaryDetailResponseSchema, en as OpenApiDiscoverResponseSchema, er as SkillSummaryDetailResponseSchema, et as DownloadActiveProjectArtifactResponseSchema, f as BindChannelBodySchema, fi as gitPorcelainLineTouchesManagedDraftPublishPath, fr as StartMcpOAuthConnectionResultSchema, ft as GatewayAttachmentRecordSchema, g as CatalogActionsPageResponseSchema, gn as PlatformAgentSessionDetailResponseSchema, gr as SubmitMarketingContactRequestSchema, gt as GetTemplateResponseSchema, h as CatalogActionDetailResponseSchema, hi as isIgnoredProjectSourcePath, hn as PlatformAgentPromptResponseSchema, hr as SubmitAgentFeedbackRequestSchema, ht as GetCustomAppResponseSchema, i as AgentEnvImageSnapshotResponseSchema, ii as WorkspaceTriggerListResponseSchema, in as PROJECT_DRAFT_COMMIT_REQUEST_TIMEOUT_MS, ir as SlackAppListResponseSchema, it as DraftFileContentResponseSchema, j as CreateApiKeyResponseSchema, ji as CredentialAssignmentRecordSchema, jn as ProjectGitStatusResponseSchema, jr as UpdateOrganizationRequestSchema, jt as ListApiKeysResponseSchema, k as ConnectProvidersResponseSchema, ki as CredentialAssignmentListQuerySchema, kn as ProjectGitRemoteRequestSchema, kr as UpdateOrganizationMemberRequestSchema, kt as ListAgentMemoryFilesResponseSchema, l as AgentTriggerSummaryListResponseSchema, li as buildConnectDeeplink, lr as StartKeystrokeConnectionInputSchema, lt as FinalizeCustomAppLogoRequestSchema, m as CancelManagedDeployResponseSchema, mn as PlatformAgentPromptInputSchema, mr as StartOAuthConnectionResultSchema, mt as GetCredentialResponseSchema, n as ActiveOrganizationResponseSchema, na as CreateSubscriptionCheckoutRequestSchema, ni as WorkspaceTriggerDetailSchema, nn as OrganizationSidebarBrandingSchema, nr as SlackAgentMembershipsResponseSchema, nt as DraftCommitResponseSchema, o as AgentSessionListResponseSchema, oi as WorkspaceTriggerRunListResponseSchema, or as SlackAppManifestResponseSchema, ot as DraftUpdateEventSchema, p as CancelManagedDeployRequestSchema, pi as isAcceptableInstallExit, pn as PlatformAgentCancelResponseSchema, pr as StartOAuthConnectionInputSchema, pt as GetAppCatalogEntryResponseSchema, q as CreateSlackChannelBodySchema, qi as BillingActivityResponseSchema, qn as QueuedRunResponseSchema, qr as WorkflowFormUpsertBodySchema, qt as ListProjectsResponseSchema, r as ActiveProjectSourceRevisionSchema, ra as UpdateAutoTopupRequestSchema, ri as WorkspaceTriggerFileSchema, rn as PNPM_FROZEN_INSTALL_ARGS, rr as SlackAppInstallStartResponseSchema, rt as DraftConflictResponseSchema, s as AgentSummaryDetailResponseSchema, si as WorkspaceWorkflowOverviewSchema, sn as PROJECT_PULL_STATE_RELATIVE_PATH, sr as SlackMembershipChannelBodySchema, st as DuplicateCredentialRequestSchema, t as AcceptOrganizationInvitationResponseSchema, ta as CreateCreditsCheckoutRequestSchema, ti as WorkflowSummaryListResponseSchema, tn as OrganizationSidebarBrandingPatchSchema, tr as SkillSummaryListResponseSchema, tt as DownloadActiveProjectSourceResponseSchema, u as AppSlugAvailabilityResponseSchema, ui as deriveCustomAppDisplay, ur as StartKeystrokeConnectionResultSchema, ut as FinalizeCustomAppLogoResponseSchema, v as CatalogAppsPageResponseSchema, vn as PrepareManagedDeployRequestSchema, vr as TemplateFilesResponseSchema, vt as HealthResponseSchema, w as CompleteManagedDeployArtifactResponseSchema, wi as resolveConnectAppSlug, wn as PresignProjectSourceRequestSchema, wr as TriggerRunListResponseSchema, wt as HistoryRunListResponseSchema, x as ChannelConnectionSchema, xn as PresignCustomAppLogoResponseSchema, xr as TriggerInvokeResponseSchema, xt as HistoryRunCancelResponseSchema, y as ChannelAccountListResponseSchema, yi as parseAppSlug, yn as PrepareManagedDeployResponseSchema, yr as TriggerDetailResponseSchema, yt as HeartbeatManagedDeployRequestSchema, z as CreateOrganizationRequestSchema, zn as PublicFormMetadataSchema, zr as UserAvatarPatchSchema, zt as ListOrganizationInvitationsResponseSchema } from "./dist-DaFb2eM_.mjs";
-import { $ as artifactIndexFromModules, Q as withMcpReadClient, X as PublicHttpUrlError, Z as assertPublicHttpUrl, _t as configureTelemetry, bt as shutdownTelemetry, et as collectArtifactModules, gt as captureException, ht as alias, nt as moduleBlobRefsFromModules, tt as mapInParallelBatches, vt as event, yt as flushTelemetry } from "./dist-DE0Y6ctP.mjs";
-import { a as buildApp, c as computeSafeFilteredDeploy, r as analyzeDeployableClosures, t as ANALYZER_CONTRACT_VERSION } from "./dist-DGYjDQkx.mjs";
+import { A as resolvePlatformUrlForWebUrl, C as createCliConfig, D as getWebUrl, E as getPlatformUrl, M as ExpectedCliError, N as isExpectedCliError, O as DEFAULT_PLATFORM_URL, S as resolveCliRoot, T as getCredentialStorage, _ as isLocalSdkSpec, a as formatReleaseAgeBlockMessage, b as shouldUpdateCliVersion, c as detectManagerFromLockfile, d as installDependencies$1, f as installPlaygroundDependencies, g as ensureSdkCurrent, i as readPnpmMinimumReleaseAgeMinutes, j as parseCredentialStorage, l as buildPlaygroundWorkspace, m as resolvePackageManager, n as ensureMinimumReleaseAgeExclude, o as isReleaseAgeBlock, p as resolveGithubPackagesToken, r as computeReleaseAgeRetryAfter, s as detectCliInstall, t as runPackageManagerUpdate, u as detectPackageManager$2, v as fetchLatestCliRelease, w as getCliConfigDir, x as readCliVersion, y as resolveCliDistTag } from "./run-package-manager-update-CcJWW5xj.mjs";
+import { $ as DeclineOrganizationInvitationResponseSchema, $i as ConfirmCheckoutResponseSchema, $r as WorkflowRunResponseSchema, $t as McpDiscoverResponseSchema, A as CreateApiKeyRequestSchema, Ai as CredentialAssignmentListResponseSchema, An as ProjectGitRemoteResponseSchema, Ar as UpdateOrganizationMemberResponseSchema, At as ListAgentWorkspaceFilesResponseSchema, B as CreateOrganizationResponseSchema, Bn as PublicFormSubmitBodySchema, Br as UserAvatarSchema, Bt as ListOrganizationMembersPageQuerySchema, C as CompleteManagedDeployArtifactRequestSchema, Cn as PresignOrgLogoResponseSchema, Cr as TriggerRunDetailResponseSchema, Ct as HistoryRunListQuerySchema, D as ConnectAuthorizeUrlResponseSchema, Dn as PresignUserAvatarResponseSchema, Dr as UpdateCredentialRequestSchema, Dt as InviteProjectMembersRequestSchema, E as CompleteProjectArtifactResponseSchema, Ei as slugifyAppName, En as PresignUserAvatarRequestSchema, Er as UpdateCredentialInstanceBodySchema, Et as InviteOrganizationMembersResponseSchema, F as CreateCustomAppRequestSchema, Fn as ProjectSettingsResponseSchema, Fr as UpdateProjectSettingsRequestSchema, Ft as ListCredentialsPageResponseSchema, G as CreateSlackAppRequestSchema, Gn as PublishedFormSchema, Gr as WorkflowCanvasSchema, Gt as ListProjectMembersResponseSchema, H as CreateProjectArtifactResponseSchema, Hi as CLIENT_CHANNEL_HEADER, Hn as PublishManagedDeployCandidateRequestSchema, Hr as UserPreferencesSchema, Ht as ListOrganizationsResponseSchema, I as CreateCustomAppResponseSchema, In as ProjectSlugAvailabilityResponseSchema, Ir as UploadProjectSourceManifestRequestSchema, It as ListDraftFilesResponseSchema, J as CreateSlackChannelResponseSchema, Ji as BillingInvoiceUrlResponseSchema, Jn as RecentResourceListResponseSchema, Jr as WorkflowRunDetailResponseSchema, Jt as ListTemplatesResponseSchema, K as CreateSlackAppResponseSchema, Ki as AutoTopupSummarySchema, Kn as QueuedAgentPromptResponseSchema, Kr as WorkflowFormResponseSchema, Kt as ListProjectMetricsResponseSchema, L as CreateDraftCommitRequestSchema, Ln as PromptInputSchema, Lr as UploadProjectSourceResponseSchema, Lt as ListManagedServiceCredentialsResponseSchema, M as CreateCredentialInstanceBodySchema, Mi as CredentialConsumerListQuerySchema, Mn as ProjectPullStateSchema, Mr as UpdateProjectMemberRequestSchema, Mt as ListAppsResponseSchema, N as CreateCredentialsRequestSchema, Ni as CredentialConsumerListResponseSchema, Nn as ProjectReachabilityResponseSchema, Nr as UpdateProjectMemberResponseSchema, Nt as ListChannelPlatformsResponseSchema, O as ConnectManagedServiceCredentialRequestSchema, Oi as AssignCredentialBodySchema, Or as UpdateManagedServiceCredentialRequestSchema, Ot as InviteProjectMembersResponseSchema, P as CreateCredentialsResponseSchema, Pi as ExecuteKeystrokeToolRequestSchema, Pn as ProjectResponseSchema, Pr as UpdateProjectRequestSchema, Pt as ListCredentialsPageQuerySchema, Q as DOCS_SEARCH_TOOL, Qi as ConfirmCheckoutRequestSchema, Qn as SLACK_PERSONAL_APP_SLUG, Qr as WorkflowRunListResponseSchema, Qt as ManagedServiceKindSchema, R as CreateDraftDiffCommitRequestSchema, Rn as PromptResponseSchema, Rr as UpsertGatewayAttachmentBodySchema, Rt as ListMcpAppToolsResponseSchema, S as ChannelDirectoryListResponseSchema, Si as parseSlackConnectFlow, Sn as PresignOrgLogoRequestSchema, Sr as TriggerListResponseSchema, St as HistoryRunDetailResponseSchema, T as CompleteProjectArtifactRequestSchema, Ti as resolveDocsMcpUrl, Tn as PresignProjectSourceResponseSchema, Tr as UpdateChannelBindingBodySchema, Tt as InviteOrganizationMembersRequestSchema, U as CreateProjectRequestSchema, Ui as PresignChatAttachmentRequestSchema, Un as PublishManagedDeployCandidateResponseSchema, Ur as WorkflowCanvasCredentialBindingsSchema, Ut as ListProjectDeploymentsResponseSchema, V as CreateProjectArtifactRequestSchema, Vi as ACTIVE_ORG_HEADER, Vn as PublicFormSubmitResponseSchema, Vr as UserPreferencesPatchSchema, Vt as ListOrganizationMembersPageResponseSchema, W as CreateProjectResponseSchema, Wi as PresignChatAttachmentResponseSchema, Wn as PublishedFormListResponseSchema, Wr as WorkflowCanvasRunSchema, Wt as ListProjectFilesResponseSchema, X as CredentialInstanceRecordSchema, Xi as BillingSummaryResponseSchema, Xn as RenewManagedDeployUploadResponseSchema, Xr as WorkflowRunInputsPutBodySchema, Xt as ManagedDeployResourceKeySchema, Y as CredentialInstanceListResponseSchema, Yi as BillingRedirectResponseSchema, Yn as RenewManagedDeployUploadRequestSchema, Yr as WorkflowRunHooksResponseSchema, Yt as MANAGED_DEPLOY_REQUEST_TIMEOUT_MS, Z as DOCS_QUERY_TOOL, Zi as BillingUsageResponseSchema, Zr as WorkflowRunInputsSchema, Zt as ManagedServiceCredentialSchema, _ as CatalogAppDetailResponseSchema, _i as normalizeDocsSearchPaths, _n as PlatformAgentSessionListResponseSchema, _r as SubmitTeamRequestRequestSchema, _t as GraphqlDiscoverResponseSchema, a as AgentSessionDetailResponseSchema, ai as WorkspaceTriggerOverviewSchema, an as PROJECT_DRAFT_DIFF_MAX_BYTES, ar as SlackAppManifestRequestSchema, at as DraftRevisionResponseSchema, b as ChannelConnectionListResponseSchema, bi as parseErrorResponse, bn as PresignCustomAppLogoRequestSchema, br as TriggerInvokeInputsSchema, bt as HeartbeatManagedDeployResponseSchema, c as AgentSummaryListResponseSchema, ci as buildAgentSlackDeeplink, cn as PROJECT_REACHABILITY_REQUEST_TIMEOUT_MS, cr as SlugAvailabilityResponseSchema, ct as DuplicateCredentialsResponseSchema, d as BindAgentSlackAppBodySchema, di as detectProjectPackageManagerFromSnapshot, dr as StartMcpOAuthConnectionInputSchema, dt as FormFieldConfigSchema, ea as CreateBillingPortalRequestSchema, ei as WorkflowSummaryDetailResponseSchema, en as OpenApiDiscoverResponseSchema, er as SkillSummaryDetailResponseSchema, et as DownloadActiveProjectArtifactResponseSchema, f as BindChannelBodySchema, fi as gitPorcelainLineTouchesManagedDraftPublishPath, fr as StartMcpOAuthConnectionResultSchema, ft as GatewayAttachmentRecordSchema, g as CatalogActionsPageResponseSchema, gn as PlatformAgentSessionDetailResponseSchema, gr as SubmitMarketingContactRequestSchema, gt as GetTemplateResponseSchema, h as CatalogActionDetailResponseSchema, hi as isIgnoredProjectSourcePath, hn as PlatformAgentPromptResponseSchema, hr as SubmitAgentFeedbackRequestSchema, ht as GetCustomAppResponseSchema, i as AgentEnvImageSnapshotResponseSchema, ii as WorkspaceTriggerListResponseSchema, in as PROJECT_DRAFT_COMMIT_REQUEST_TIMEOUT_MS, ir as SlackAppListResponseSchema, it as DraftFileContentResponseSchema, j as CreateApiKeyResponseSchema, ji as CredentialAssignmentRecordSchema, jn as ProjectGitStatusResponseSchema, jr as UpdateOrganizationRequestSchema, jt as ListApiKeysResponseSchema, k as ConnectProvidersResponseSchema, ki as CredentialAssignmentListQuerySchema, kn as ProjectGitRemoteRequestSchema, kr as UpdateOrganizationMemberRequestSchema, kt as ListAgentMemoryFilesResponseSchema, l as AgentTriggerSummaryListResponseSchema, li as buildConnectDeeplink, lr as StartKeystrokeConnectionInputSchema, lt as FinalizeCustomAppLogoRequestSchema, m as CancelManagedDeployResponseSchema, mn as PlatformAgentPromptInputSchema, mr as StartOAuthConnectionResultSchema, mt as GetCredentialResponseSchema, n as ActiveOrganizationResponseSchema, na as CreateSubscriptionCheckoutRequestSchema, ni as WorkspaceTriggerDetailSchema, nn as OrganizationSidebarBrandingSchema, nr as SlackAgentMembershipsResponseSchema, nt as DraftCommitResponseSchema, o as AgentSessionListResponseSchema, oi as WorkspaceTriggerRunListResponseSchema, or as SlackAppManifestResponseSchema, ot as DraftUpdateEventSchema, p as CancelManagedDeployRequestSchema, pi as isAcceptableInstallExit, pn as PlatformAgentCancelResponseSchema, pr as StartOAuthConnectionInputSchema, pt as GetAppCatalogEntryResponseSchema, q as CreateSlackChannelBodySchema, qi as BillingActivityResponseSchema, qn as QueuedRunResponseSchema, qr as WorkflowFormUpsertBodySchema, qt as ListProjectsResponseSchema, r as ActiveProjectSourceRevisionSchema, ra as UpdateAutoTopupRequestSchema, ri as WorkspaceTriggerFileSchema, rn as PNPM_FROZEN_INSTALL_ARGS, rr as SlackAppInstallStartResponseSchema, rt as DraftConflictResponseSchema, s as AgentSummaryDetailResponseSchema, si as WorkspaceWorkflowOverviewSchema, sn as PROJECT_PULL_STATE_RELATIVE_PATH, sr as SlackMembershipChannelBodySchema, st as DuplicateCredentialRequestSchema, t as AcceptOrganizationInvitationResponseSchema, ta as CreateCreditsCheckoutRequestSchema, ti as WorkflowSummaryListResponseSchema, tn as OrganizationSidebarBrandingPatchSchema, tr as SkillSummaryListResponseSchema, tt as DownloadActiveProjectSourceResponseSchema, u as AppSlugAvailabilityResponseSchema, ui as deriveCustomAppDisplay, ur as StartKeystrokeConnectionResultSchema, ut as FinalizeCustomAppLogoResponseSchema, v as CatalogAppsPageResponseSchema, vn as PrepareManagedDeployRequestSchema, vr as TemplateFilesResponseSchema, vt as HealthResponseSchema, w as CompleteManagedDeployArtifactResponseSchema, wi as resolveConnectAppSlug, wn as PresignProjectSourceRequestSchema, wr as TriggerRunListResponseSchema, wt as HistoryRunListResponseSchema, x as ChannelConnectionSchema, xn as PresignCustomAppLogoResponseSchema, xr as TriggerInvokeResponseSchema, xt as HistoryRunCancelResponseSchema, y as ChannelAccountListResponseSchema, yi as parseAppSlug, yn as PrepareManagedDeployResponseSchema, yr as TriggerDetailResponseSchema, yt as HeartbeatManagedDeployRequestSchema, z as CreateOrganizationRequestSchema, zn as PublicFormMetadataSchema, zr as UserAvatarPatchSchema, zt as ListOrganizationInvitationsResponseSchema } from "./dist-CnddVrzY.mjs";
+import { $ as withMcpReadClient, Q as assertPublicHttpUrl, Z as PublicHttpUrlError, _t as captureException, bt as flushTelemetry, et as artifactIndexFromModules, gt as alias, nt as mapInParallelBatches, rt as moduleBlobRefsFromModules, tt as collectArtifactModules, vt as configureTelemetry, xt as shutdownTelemetry, yt as event } from "./dist-B8ZXKNXj.mjs";
+import { a as buildApp, c as computeSafeFilteredDeploy, r as analyzeDeployableClosures, t as ANALYZER_CONTRACT_VERSION } from "./dist-C5ooQsTQ.mjs";
 import { createRequire } from "node:module";
 import { Command } from "commander";
 import { homedir, platform, release, tmpdir } from "node:os";
@@ -1628,6 +1628,7 @@ function createWorkflowsResource$1(http) {
 		}
 	};
 }
+const AUTH_RETRY_HEADER = "x-keystroke-auth-retry";
 function createKeystrokeClient(options) {
 	const auth = options.auth ?? { type: "none" };
 	const base = normalizeBaseUrl$1(options.baseUrl);
@@ -1635,10 +1636,21 @@ function createKeystrokeClient(options) {
 	const http = ky.create({
 		prefix: base === "" ? void 0 : `${base}/`,
 		credentials: "omit",
-		hooks: { beforeRequest: [({ request }) => {
-			applyActiveOrganizationHeader$1(request, getActiveOrganizationId?.());
-			return applyAuthHeaders$1(request, auth);
-		}] },
+		hooks: {
+			beforeRequest: [({ request }) => {
+				applyActiveOrganizationHeader$1(request, getActiveOrganizationId?.());
+				return applyAuthHeaders$1(request, auth);
+			}],
+			afterResponse: [({ request, response, retryCount }) => {
+				if (!options.retryUnauthorizedOnce || response.status !== 401 || retryCount > 0 || request.headers.get(AUTH_RETRY_HEADER) === "1") return;
+				const headers = new Headers(request.headers);
+				headers.set(AUTH_RETRY_HEADER, "1");
+				return ky.retry({
+					request: new Request(request, { headers }),
+					code: "AUTH_RETRY"
+				});
+			}]
+		},
 		...options.ky
 	});
 	return {
@@ -2045,7 +2057,7 @@ function createJwtTokenCache(mint) {
 	};
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._c472a772c8203e3e5cd8f6066a81eb33/node_modules/better-auth/dist/version.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.34_crossws@0.4._7ea36d5e08bcd78deb7bdb150330d5fb/node_modules/better-auth/dist/version.mjs
 const PACKAGE_VERSION = "1.6.23";
 //#endregion
 //#region ../../node_modules/.pnpm/better-call@1.3.7_zod@4.4.3/node_modules/better-call/dist/error.mjs
@@ -2170,7 +2182,7 @@ var BetterAuthError = class extends Error {
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._c472a772c8203e3e5cd8f6066a81eb33/node_modules/better-auth/dist/plugins/device-authorization/client.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.34_crossws@0.4._7ea36d5e08bcd78deb7bdb150330d5fb/node_modules/better-auth/dist/plugins/device-authorization/client.mjs
 const deviceAuthorizationClient = () => {
 	return {
 		id: "device-authorization",
@@ -2246,7 +2258,7 @@ Object.freeze({
 	}
 });
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._c472a772c8203e3e5cd8f6066a81eb33/node_modules/better-auth/dist/utils/url.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.34_crossws@0.4._7ea36d5e08bcd78deb7bdb150330d5fb/node_modules/better-auth/dist/utils/url.mjs
 const SLASH_CHAR_CODE = "/".charCodeAt(0);
 function trimTrailingSlashes(value) {
 	let end = value.length;
@@ -2519,7 +2531,7 @@ let onMount = ($store, initialize) => {
 	});
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._c472a772c8203e3e5cd8f6066a81eb33/node_modules/better-auth/dist/client/equality.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.34_crossws@0.4._7ea36d5e08bcd78deb7bdb150330d5fb/node_modules/better-auth/dist/client/equality.mjs
 function isPlainObject$1(value) {
 	if (typeof value !== "object" || value === null) return false;
 	const prototype = Object.getPrototypeOf(value);
@@ -2559,7 +2571,7 @@ function withEquality(store, isEqual) {
 	});
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._c472a772c8203e3e5cd8f6066a81eb33/node_modules/better-auth/dist/client/broadcast-channel.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.34_crossws@0.4._7ea36d5e08bcd78deb7bdb150330d5fb/node_modules/better-auth/dist/client/broadcast-channel.mjs
 const kBroadcastChannel = Symbol.for("better-auth:broadcast-channel");
 const now$1 = () => Math.floor(Date.now() / 1e3);
 var WindowBroadcastChannel = class {
@@ -2602,7 +2614,7 @@ function getGlobalBroadcastChannel(name = "better-auth.message") {
 	return globalThis[kBroadcastChannel];
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._c472a772c8203e3e5cd8f6066a81eb33/node_modules/better-auth/dist/client/focus-manager.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.34_crossws@0.4._7ea36d5e08bcd78deb7bdb150330d5fb/node_modules/better-auth/dist/client/focus-manager.mjs
 const kFocusManager = Symbol.for("better-auth:focus-manager");
 var WindowFocusManager = class {
 	listeners = /* @__PURE__ */ new Set();
@@ -2631,7 +2643,7 @@ function getGlobalFocusManager() {
 	return globalThis[kFocusManager];
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._c472a772c8203e3e5cd8f6066a81eb33/node_modules/better-auth/dist/client/online-manager.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.34_crossws@0.4._7ea36d5e08bcd78deb7bdb150330d5fb/node_modules/better-auth/dist/client/online-manager.mjs
 const kOnlineManager = Symbol.for("better-auth:online-manager");
 var WindowOnlineManager = class {
 	listeners = /* @__PURE__ */ new Set();
@@ -2663,7 +2675,7 @@ function getGlobalOnlineManager() {
 	return globalThis[kOnlineManager];
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._c472a772c8203e3e5cd8f6066a81eb33/node_modules/better-auth/dist/client/parser.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.34_crossws@0.4._7ea36d5e08bcd78deb7bdb150330d5fb/node_modules/better-auth/dist/client/parser.mjs
 const PROTO_POLLUTION_PATTERNS = {
 	proto: /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/,
 	constructor: /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/,
@@ -2732,7 +2744,7 @@ function parseJSON(value, options = { strict: true }) {
 	return betterJSONParse(value, options);
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._c472a772c8203e3e5cd8f6066a81eb33/node_modules/better-auth/dist/client/session-refresh.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.34_crossws@0.4._7ea36d5e08bcd78deb7bdb150330d5fb/node_modules/better-auth/dist/client/session-refresh.mjs
 const now = () => Math.floor(Date.now() / 1e3);
 /**
 * Rate limit: don't refetch on focus if a session request was made within this many seconds
@@ -2859,7 +2871,7 @@ function createSessionRefreshManager(opts) {
 	};
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._c472a772c8203e3e5cd8f6066a81eb33/node_modules/better-auth/dist/client/fetch-plugins.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.34_crossws@0.4._7ea36d5e08bcd78deb7bdb150330d5fb/node_modules/better-auth/dist/client/fetch-plugins.mjs
 const redirectPlugin = {
 	id: "redirect",
 	name: "Redirect",
@@ -2874,7 +2886,7 @@ const redirectPlugin = {
 	} }
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._c472a772c8203e3e5cd8f6066a81eb33/node_modules/better-auth/dist/client/session-atom.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.34_crossws@0.4._7ea36d5e08bcd78deb7bdb150330d5fb/node_modules/better-auth/dist/client/session-atom.mjs
 const isServer = () => typeof window === "undefined";
 /**
 * Normalize $fetch response: `throw: true` returns data directly,
@@ -3526,7 +3538,7 @@ var betterFetch = async (url, options) => {
 	};
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._c472a772c8203e3e5cd8f6066a81eb33/node_modules/better-auth/dist/client/config.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.34_crossws@0.4._7ea36d5e08bcd78deb7bdb150330d5fb/node_modules/better-auth/dist/client/config.mjs
 const resolvePublicAuthUrl = (basePath) => {
 	if (typeof process === "undefined") return void 0;
 	const path = basePath ?? "/api/auth";
@@ -3624,7 +3636,7 @@ const getClientConfig = (options, loadEnv) => {
 	};
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._c472a772c8203e3e5cd8f6066a81eb33/node_modules/better-auth/dist/utils/is-atom.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.34_crossws@0.4._7ea36d5e08bcd78deb7bdb150330d5fb/node_modules/better-auth/dist/utils/is-atom.mjs
 function isAtom(value) {
 	return typeof value === "object" && value !== null && "get" in value && typeof value.get === "function" && "lc" in value && typeof value.lc === "number";
 }
@@ -3642,7 +3654,7 @@ function toKebabCase(input) {
 	return splitWords(input).map((word) => word.toLowerCase()).join("-");
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._c472a772c8203e3e5cd8f6066a81eb33/node_modules/better-auth/dist/client/proxy.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.34_crossws@0.4._7ea36d5e08bcd78deb7bdb150330d5fb/node_modules/better-auth/dist/client/proxy.mjs
 function getMethod(path, knownPathMethods, args) {
 	const method = knownPathMethods[path];
 	const { fetchOptions, query: _query, ...body } = args || {};
@@ -3717,7 +3729,7 @@ function createDynamicPathProxy(routes, client, knownPathMethods, atoms, atomLis
 	return createProxy();
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._c472a772c8203e3e5cd8f6066a81eb33/node_modules/better-auth/dist/client/vanilla.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.34_crossws@0.4._7ea36d5e08bcd78deb7bdb150330d5fb/node_modules/better-auth/dist/client/vanilla.mjs
 function createAuthClient(options) {
 	const { pluginPathMethods, pluginsActions, pluginsAtoms, $fetch, atomListeners, $store } = getClientConfig(options);
 	const resolvedHooks = {};
@@ -3874,10 +3886,12 @@ function getResolvedOrganizationId() {
 //#endregion
 //#region src/client.ts
 function createCliClient(config, options) {
+	const auth = resolveCliAuth(config);
 	return createKeystrokeClient({
 		baseUrl: options.baseUrl,
-		auth: resolveCliAuth(config),
+		auth,
 		getActiveOrganizationId: options.platform ? () => options.organizationId ?? getResolvedOrganizationId() ?? null : void 0,
+		retryUnauthorizedOnce: auth.type === "apiKey",
 		ky: { headers: { [CLIENT_CHANNEL_HEADER]: "cli" } }
 	});
 }
@@ -6425,10 +6439,12 @@ function toPlatformAuth(auth) {
 function createCliPlatformClient(config, options = {}) {
 	const platformUrl = getPlatformUrl(config);
 	const storage = getCredentialStorage(config);
+	const auth = resolveCliAuth(config);
+	const refreshBearerToken = auth.type === "apiKey" ? async () => auth.getKey() : auth.type === "bearer" ? () => getCliJwt(platformUrl, true, storage) : void 0;
 	return createPlatformClient({
 		baseUrl: platformUrl,
-		auth: toPlatformAuth(resolveCliAuth(config)),
-		refreshBearerToken: () => getCliJwt(platformUrl, true, storage),
+		auth: toPlatformAuth(auth),
+		...refreshBearerToken ? { refreshBearerToken } : {},
 		getActiveOrganizationId: () => options.organizationId === void 0 ? getResolvedOrganizationId() ?? null : options.organizationId,
 		getExtraHeaders: () => ({ [CLIENT_CHANNEL_HEADER]: "cli" })
 	});
@@ -6776,6 +6792,7 @@ function unreachableServerMessage(targetUrl) {
 function formatHttpClientError(error, context) {
 	if (error.status === 401) {
 		if (context?.hasCredentials === false) return "Not logged in. Run `keystroke auth login` first.";
+		if (context?.credentialSource === "api-key") return "Authentication failed for `KEYSTROKE_API_KEY`. Check the key and retry the command.";
 		return "Authentication failed. Run `keystroke auth login` again.";
 	}
 	if (error.status === 403) {
@@ -7050,35 +7067,41 @@ async function runProjectCliCommand(fallback, fn, errorContext, targetOptions =
 }
 async function runCliCommand(fallback, fn, errorContext, targetOptions = {}) {
 	const config = createCliConfig();
-	const target = await resolveApiTarget(config, {
-		...getCliTargetOptions(),
-		...targetOptions
-	});
-	const organizationId = (await resolveActiveOrganization(config)).organization.id;
-	const ctx = {
-		config,
-		client: createCliClient(config, {
-			baseUrl: target.baseUrl,
-			platform: true,
-			organizationId
-		}),
-		serverUrl: target.baseUrl,
-		webUrl: getWebUrl(config),
-		apiTarget: target
-	};
+	const webUrl = getWebUrl(config);
+	let organizationId;
+	let projectId;
+	let serverUrl;
 	try {
-		await fn(ctx);
+		const target = await resolveApiTarget(config, {
+			...getCliTargetOptions(),
+			...targetOptions
+		});
+		serverUrl = target.baseUrl;
+		projectId = target.projectId;
+		organizationId = getResolvedOrganizationId() ?? (await resolveActiveOrganization(config)).organization.id;
+		await fn({
+			config,
+			client: createCliClient(config, {
+				baseUrl: target.baseUrl,
+				platform: true,
+				organizationId
+			}),
+			serverUrl: target.baseUrl,
+			webUrl,
+			apiTarget: target
+		});
 	} catch (error) {
 		await reportCliException(error, {
 			command: fallback,
 			operation: "cli.command",
 			organizationId,
-			projectId: target.projectId
+			projectId
 		});
 		process.stderr.write(`${formatCliError(error, fallback, {
 			...errorContext,
-			serverUrl: ctx.serverUrl,
-			webUrl: ctx.webUrl
+			serverUrl,
+			webUrl,
+			credentialSource: process.env.KEYSTROKE_API_KEY?.trim() ? "api-key" : "session"
 		})}\n`);
 		process.exitCode = 1;
 	}
@@ -9025,7 +9048,7 @@ function registerBuildCommand(program) {
 		try {
 			const root = resolveProjectRoot(options.dir);
 			await ensureSdkCurrent(root);
-			const { buildApp } = await import("./dist-C1SO9rxP.mjs");
+			const { buildApp } = await import("./dist-Brtmx-yx.mjs");
 			await buildApp({ root });
 			process.stdout.write(`Built ${root}\n`);
 		} catch (error) {
@@ -9038,15 +9061,18 @@ function registerBuildCommand(program) {
 //#endregion
 //#region src/deploy/assert-portable-dependencies.ts
 const LINK_SPEC = /^link:/i;
+const WORKSPACE_SPEC = /^workspace:/i;
+const FILE_SPEC = /^file:(?:\.\.?(?:\/|$)|\/|[A-Za-z]:\\|~)/i;
 const NONPORTABLE_SPEC = /^(?:link:|workspace:|file:(?:\.\.?(?:\/|$)|\/|[A-Za-z]:\\|~))/i;
 /**
 * Reject tracked dependency specs that cannot resolve in disposable/server
 * checkouts (absolute/local link:, external file:, unresolved workspace:).
 *
 * `KEYSTROKE_ALLOW_NONPORTABLE_DEPS=1` (local packs / soak deploys) permits
-* `link:` only — `file:` and unresolved `workspace:` still fail the gate.
+* `link:` only. Explicit options allow `workspace:`, `link:`, and local `file:`
+* specs when deploy deliberately builds from the current checkout.
 */
-async function assertPortableProjectDependencies(projectRoot) {
+async function assertPortableProjectDependencies(projectRoot, options = {}) {
 	const allowLinkDeps = process.env.KEYSTROKE_ALLOW_NONPORTABLE_DEPS === "1";
 	const packageJsonPath = join(projectRoot, "package.json");
 	let raw;
@@ -9076,7 +9102,7 @@ async function assertPortableProjectDependencies(projectRoot) {
 		for (const [name, spec] of Object.entries(deps)) {
 			if (typeof spec !== "string") continue;
 			const trimmed = spec.trim();
-			if (allowLinkDeps && LINK_SPEC.test(trimmed)) continue;
+			if ((allowLinkDeps || options.allowLink) && LINK_SPEC.test(trimmed) || options.allowWorkspace && WORKSPACE_SPEC.test(trimmed) || options.allowFile && FILE_SPEC.test(trimmed)) continue;
 			if (NONPORTABLE_SPEC.test(trimmed)) offenders.push(`${name}@${spec}`);
 		}
 	}
@@ -10996,6 +11022,25 @@ async function buildExactCandidate(input) {
 	const depsRoot = input.depsRoot ?? input.cwd;
 	const cleanEnv = worktreeGitEnv();
 	const skipVerify = input.skipVerify === true;
+	if (input.buildFromWorkspace) {
+		await rm(join(input.cwd, "dist"), {
+			recursive: true,
+			force: true
+		});
+		await buildInRoot({
+			buildRoot: input.cwd,
+			env: cleanEnv,
+			skipVerify,
+			manager: await detectPackageManager(input.cwd),
+			needInstall: false
+		});
+		const modules = collectArtifactModules(input.cwd);
+		return {
+			modules,
+			index: artifactIndexFromModules(modules),
+			blobs: moduleBlobRefsFromModules(modules)
+		};
+	}
 	if (input.allowInPlace) {
 		const head = await runGit(["rev-parse", "HEAD"], {
 			cwd: input.cwd,
@@ -11279,16 +11324,51 @@ async function assertDeployableCheckout(projectRoot, env = checkoutGitEnv()) {
 * Optionally verify HEAD against a server-pinned draft SHA.
 */
 async function assertHostedCheckoutDeployable(projectRoot, options = {}) {
-	const inspection = await assertDeployableCheckout(projectRoot, options.env ?? checkoutGitEnv());
+	const env = options.env ?? checkoutGitEnv();
+	const inspection = await assertDeployableCheckout(projectRoot, env);
 	if (inspection.branch !== "ks/draft") throw new ExpectedCliError(`Hosted deploy requires branch \`${HOSTED_DRAFT_BRANCH}\` (current: ${inspection.branch ?? "detached"}).`);
-	if (options.expectedDraftSha) assertCheckoutMatchesDraft(inspection, options.expectedDraftSha);
+	if (options.expectedDraftSha) await assertCheckoutMatchesDraft(inspection, options.expectedDraftSha, env);
 	return inspection;
 }
-function assertCheckoutMatchesDraft(inspection, expectedDraftSha) {
+async function resolveCheckoutDraftRelation(inspection, expectedDraftSha, env) {
+	const head = inspection.headSha;
+	if (!head) return "unknown";
+	const expectedIsAncestor = await runGit([
+		"merge-base",
+		"--is-ancestor",
+		expectedDraftSha,
+		head
+	], {
+		cwd: inspection.gitRoot,
+		env,
+		reject: false
+	});
+	if (expectedIsAncestor.code === 0) return "ahead";
+	if (expectedIsAncestor.code !== 1) return "unknown";
+	const headIsAncestor = await runGit([
+		"merge-base",
+		"--is-ancestor",
+		head,
+		expectedDraftSha
+	], {
+		cwd: inspection.gitRoot,
+		env,
+		reject: false
+	});
+	if (headIsAncestor.code === 0) return "behind";
+	return headIsAncestor.code === 1 ? "diverged" : "unknown";
+}
+async function assertCheckoutMatchesDraft(inspection, expectedDraftSha, env = checkoutGitEnv()) {
 	const head = inspection.headSha?.toLowerCase() ?? "";
 	const expected = expectedDraftSha.toLowerCase();
 	if (!/^[0-9a-f]{40}$/.test(expected)) throw new ExpectedCliError(`Invalid draft SHA: ${expectedDraftSha}`);
-	if (head !== expected) throw new ExpectedCliError(`Hosted checkout HEAD (${head || "unknown"}) does not match draft tip ${expected}. Sync the session workspace to ks/draft and retry.`);
+	if (head === expected) return;
+	const mismatch = `Hosted checkout HEAD (${head || "unknown"}) does not match draft tip ${expected}. `;
+	const relation = await resolveCheckoutDraftRelation(inspection, expected, env);
+	if (relation === "ahead") throw new ExpectedCliError(mismatch + "HEAD has unpublished commits. Run exactly `git push origin HEAD:ks/draft` as a separate command, then retry `keystroke deploy`.");
+	if (relation === "behind") throw new ExpectedCliError(mismatch + "HEAD is behind the shared draft. Run `git fetch origin`, then `git rebase origin/ks/draft` as separate commands, then retry `keystroke deploy`.");
+	if (relation === "diverged") throw new ExpectedCliError(mismatch + "HEAD and the shared draft have diverged. Run `git fetch origin`, `git rebase origin/ks/draft`, and `git push origin HEAD:ks/draft` as separate commands, then retry `keystroke deploy`.");
+	throw new ExpectedCliError(mismatch + "Run `git fetch origin`, `git rebase origin/ks/draft`, and `git push origin HEAD:ks/draft` as separate commands, then retry `keystroke deploy`.");
 }
 //#endregion
 //#region src/commands/deploy-output.ts
@@ -11457,7 +11537,13 @@ async function pollProjectActive(client, projectId, options = {}) {
 async function runManagedDeploy(client, config, options) {
 	const deployStarted = Date.now();
 	const root = resolveProjectRoot(options.dir);
-	await assertPortableProjectDependencies(root);
+	if (options.buildFromWorkspace && process.env["KEYSTROKE_DEPLOY_GIT_MODE"] === "checkout") throw new ExpectedCliError("--build-from-workspace is only available from a local monorepo checkout");
+	await assertPortableProjectDependencies(root, {
+		allowWorkspace: options.buildFromWorkspace === true,
+		allowFile: options.buildFromWorkspace === true,
+		allowLink: options.buildFromWorkspace === true
+	});
+	if (options.buildFromWorkspace) process.stderr.write("Warning: --build-from-workspace builds with local workspace dependencies that are not captured in Keystroke's managed source. Use published dependencies for reproducible deploys.\n");
 	const verbose = options.verbose === true;
 	const phase = (label, started) => {
 		if (!verbose) return;
@@ -11481,7 +11567,7 @@ async function runManagedDeploy(client, config, options) {
 	}) : Promise.resolve();
 	const remotePromise = client.projectGit.getRemote(options.projectId);
 	const draftStarted = Date.now();
-	const draftSha = await resolveManagedDeployDraftSha({
+	let draftSha = await resolveManagedDeployDraftSha({
 		client,
 		projectId: options.projectId,
 		root,
@@ -11505,6 +11591,10 @@ async function runManagedDeploy(client, config, options) {
 		env: gitContext.env,
 		...filter ? { filter } : {}
 	});
+	if (options.buildFromWorkspace && plan.mode === "no_op") plan = {
+		...plan,
+		mode: "full"
+	};
 	phase("plan", planStarted);
 	writePlan(plan);
 	if (plan.mode === "no_op") {
@@ -11649,7 +11739,8 @@ async function runManagedDeploy(client, config, options) {
 							candidateSha: composed.candidateSha,
 							depsRoot: root,
 							skipVerify: verifyOutside,
-							allowInPlace: hostedCheckout && prepared.mode === "full"
+							allowInPlace: hostedCheckout && prepared.mode === "full",
+							buildFromWorkspace: options.buildFromWorkspace === true
 						});
 						buildMs = Date.now() - buildStarted;
 						return result;
@@ -11686,7 +11777,8 @@ async function runManagedDeploy(client, config, options) {
 								candidateSha: publishedCandidateSha,
 								depsRoot: root,
 								skipVerify: verifyOutside,
-								allowInPlace: false
+								allowInPlace: false,
+								buildFromWorkspace: options.buildFromWorkspace === true
 							});
 							buildMs += Date.now() - rebuildStarted;
 						}
@@ -11745,6 +11837,13 @@ async function runManagedDeploy(client, config, options) {
 	} catch (error) {
 		if (!isStaleDeployPlanError(error)) throw error;
 		process.stdout.write("Deploy pins moved — recomputing local preflight once…\n");
+		draftSha = await resolveManagedDeployDraftSha({
+			client,
+			projectId: options.projectId,
+			root,
+			gitContext,
+			verbose
+		});
 		plan = await resolveManagedDeployPreflight({
 			cwd: root,
 			draftSha,
@@ -11752,6 +11851,10 @@ async function runManagedDeploy(client, config, options) {
 			env: gitContext.env,
 			...filter ? { filter } : {}
 		});
+		if (options.buildFromWorkspace && plan.mode === "no_op") plan = {
+			...plan,
+			mode: "full"
+		};
 		writePlan(plan);
 		if (plan.mode === "no_op") {
 			process.stdout.write("Nothing to deploy — draft matches main.\n");
@@ -11787,7 +11890,7 @@ async function resolveManagedDeployDraftSha(input) {
 	})).commitSha;
 	const inspection = await assertHostedCheckoutDeployable(input.root, { env: input.gitContext.env });
 	const revision = await input.client.projectDraft.getRevision(input.projectId);
-	assertCheckoutMatchesDraft(inspection, revision.commitSha);
+	await assertCheckoutMatchesDraft(inspection, revision.commitSha, input.gitContext.env);
 	if (input.verbose) process.stdout.write(`Hosted checkout ready (${revision.commitSha.slice(0, 12)} on ks/draft).\n`);
 	return revision.commitSha.toLowerCase();
 }
@@ -11805,6 +11908,7 @@ async function resolveTrustedDeployGitEnv(input) {
 }
 async function runDeploy(options) {
 	if (options.acceptImpact && !options.filter?.length) throw new ExpectedCliError("--accept-impact requires at least one --filter");
+	if (options.buildFromWorkspace && options.filter?.length) throw new ExpectedCliError("--build-from-workspace cannot be combined with --filter");
 	const root = resolveProjectRoot(options.dir);
 	await ensureSdkCurrent(root);
 	const config = createCliConfig();
@@ -11814,7 +11918,7 @@ async function runDeploy(options) {
 	await runManagedDeploy(client, config, options);
 }
 function registerDeployCommand(program) {
-	program.command("deploy").description("Deploy the project via managed Git (draft sync, local analyze/build, cutover)").option("--dir <path>", "Project directory", process.cwd()).option("--filter <entry>", "Deploy only matching workflow/agent keys (repeatable; e.g. workflows/ping)", (value, previous) => [...previous, value], []).option("--accept-impact", "Accept the current filtered deploy impact (required for non-TTY expansion)").option("--verbose", "Show phase timings, pin SHAs, and deploy detail").action(async (options) => {
+	program.command("deploy").description("Deploy the project via managed Git (draft sync, local analyze/build, cutover)").option("--dir <path>", "Project directory", process.cwd()).option("--filter <entry>", "Deploy only matching workflow/agent keys (repeatable; e.g. workflows/ping)", (value, previous) => [...previous, value], []).option("--accept-impact", "Accept the current filtered deploy impact (required for non-TTY expansion)").option("--build-from-workspace", "Build from the current monorepo checkout (full deploys only; non-reproducible)").option("--verbose", "Show phase timings, pin SHAs, and deploy detail").action(async (options) => {
 		let config;
 		try {
 			config = createCliConfig();
@@ -11826,6 +11930,7 @@ function registerDeployCommand(program) {
 				projectId,
 				filter: options.filter.length > 0 ? options.filter : void 0,
 				acceptImpact: options.acceptImpact === true,
+				buildFromWorkspace: options.buildFromWorkspace === true,
 				verbose: options.verbose === true
 			});
 			await trackCliEvent("cli:deploy", { projectId });
@@ -14266,7 +14371,7 @@ function createProgram() {
 async function runCli(argv) {
 	initCliTelemetry();
 	try {
-		const { maybeAutoUpdate } = await import("./maybe-auto-update-B2T950BL.mjs");
+		const { maybeAutoUpdate } = await import("./maybe-auto-update-28IpqxhP.mjs");
 		await maybeAutoUpdate(argv);
 		await createProgram().parseAsync(argv);
 	} finally {
@@ -14276,4 +14381,4 @@ async function runCli(argv) {
 //#endregion
 export { runCli };
 
-//# sourceMappingURL=program-D15UmszI.mjs.map
+//# sourceMappingURL=program-BfapxNQ4.mjs.map