@keystrokehq/cli 0.1.171 → 0.1.173

package/dist/{program-Ckl_ELbL.mjs → program-DO7ZQHjx.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { A as resolvePlatformUrlForWebUrl, C as createCliConfig, D as getWebUrl, E as getPlatformUrl, M as ExpectedCliError, N as isExpectedCliError, O as DEFAULT_PLATFORM_URL, S as resolveCliRoot, T as getCredentialStorage, _ as isLocalSdkSpec, a as formatReleaseAgeBlockMessage, b as shouldUpdateCliVersion, c as detectManagerFromLockfile, d as installDependencies$1, f as installPlaygroundDependencies, g as ensureSdkCurrent, i as readPnpmMinimumReleaseAgeMinutes, j as parseCredentialStorage, l as buildPlaygroundWorkspace, m as resolvePackageManager, n as ensureMinimumReleaseAgeExclude, o as isReleaseAgeBlock, p as resolveGithubPackagesToken, r as computeReleaseAgeRetryAfter, s as detectCliInstall, t as runPackageManagerUpdate, u as detectPackageManager$2, v as fetchLatestCliRelease, w as getCliConfigDir, x as readCliVersion, y as resolveCliDistTag } from "./run-package-manager-update-CcJWW5xj.mjs";
-import { $ as DeclineOrganizationInvitationResponseSchema, $i as ConfirmCheckoutResponseSchema, $r as WorkflowRunResponseSchema, $t as McpDiscoverResponseSchema, A as CreateApiKeyRequestSchema, Ai as CredentialAssignmentListResponseSchema, An as ProjectGitRemoteResponseSchema, Ar as UpdateOrganizationMemberResponseSchema, At as ListAgentWorkspaceFilesResponseSchema, B as CreateOrganizationResponseSchema, Bn as PublicFormSubmitBodySchema, Br as UserAvatarSchema, Bt as ListOrganizationMembersPageQuerySchema, C as CompleteManagedDeployArtifactRequestSchema, Cn as PresignOrgLogoResponseSchema, Cr as TriggerRunDetailResponseSchema, Ct as HistoryRunListQuerySchema, D as ConnectAuthorizeUrlResponseSchema, Dn as PresignUserAvatarResponseSchema, Dr as UpdateCredentialRequestSchema, Dt as InviteProjectMembersRequestSchema, E as CompleteProjectArtifactResponseSchema, Ei as slugifyAppName, En as PresignUserAvatarRequestSchema, Er as UpdateCredentialInstanceBodySchema, Et as InviteOrganizationMembersResponseSchema, F as CreateCustomAppRequestSchema, Fn as ProjectSettingsResponseSchema, Fr as UpdateProjectSettingsRequestSchema, Ft as ListCredentialsPageResponseSchema, G as CreateSlackAppRequestSchema, Gn as PublishedFormSchema, Gr as WorkflowCanvasSchema, Gt as ListProjectMembersResponseSchema, H as CreateProjectArtifactResponseSchema, Hi as CLIENT_CHANNEL_HEADER, Hn as PublishManagedDeployCandidateRequestSchema, Hr as UserPreferencesSchema, Ht as ListOrganizationsResponseSchema, I as CreateCustomAppResponseSchema, In as ProjectSlugAvailabilityResponseSchema, Ir as UploadProjectSourceManifestRequestSchema, It as ListDraftFilesResponseSchema, J as CreateSlackChannelResponseSchema, Ji as BillingInvoiceUrlResponseSchema, Jn as RecentResourceListResponseSchema, Jr as WorkflowRunDetailResponseSchema, Jt as ListTemplatesResponseSchema, K as CreateSlackAppResponseSchema, Ki as AutoTopupSummarySchema, Kn as QueuedAgentPromptResponseSchema, Kr as WorkflowFormResponseSchema, Kt as ListProjectMetricsResponseSchema, L as CreateDraftCommitRequestSchema, Ln as PromptInputSchema, Lr as UploadProjectSourceResponseSchema, Lt as ListManagedServiceCredentialsResponseSchema, M as CreateCredentialInstanceBodySchema, Mi as CredentialConsumerListQuerySchema, Mn as ProjectPullStateSchema, Mr as UpdateProjectMemberRequestSchema, Mt as ListAppsResponseSchema, N as CreateCredentialsRequestSchema, Ni as CredentialConsumerListResponseSchema, Nn as ProjectReachabilityResponseSchema, Nr as UpdateProjectMemberResponseSchema, Nt as ListChannelPlatformsResponseSchema, O as ConnectManagedServiceCredentialRequestSchema, Oi as AssignCredentialBodySchema, Or as UpdateManagedServiceCredentialRequestSchema, Ot as InviteProjectMembersResponseSchema, P as CreateCredentialsResponseSchema, Pi as ExecuteKeystrokeToolRequestSchema, Pn as ProjectResponseSchema, Pr as UpdateProjectRequestSchema, Pt as ListCredentialsPageQuerySchema, Q as DOCS_SEARCH_TOOL, Qi as ConfirmCheckoutRequestSchema, Qn as SLACK_PERSONAL_APP_SLUG, Qr as WorkflowRunListResponseSchema, Qt as ManagedServiceKindSchema, R as CreateDraftDiffCommitRequestSchema, Rn as PromptResponseSchema, Rr as UpsertGatewayAttachmentBodySchema, Rt as ListMcpAppToolsResponseSchema, S as ChannelDirectoryListResponseSchema, Si as parseSlackConnectFlow, Sn as PresignOrgLogoRequestSchema, Sr as TriggerListResponseSchema, St as HistoryRunDetailResponseSchema, T as CompleteProjectArtifactRequestSchema, Ti as resolveDocsMcpUrl, Tn as PresignProjectSourceResponseSchema, Tr as UpdateChannelBindingBodySchema, Tt as InviteOrganizationMembersRequestSchema, U as CreateProjectRequestSchema, Ui as PresignChatAttachmentRequestSchema, Un as PublishManagedDeployCandidateResponseSchema, Ur as WorkflowCanvasCredentialBindingsSchema, Ut as ListProjectDeploymentsResponseSchema, V as CreateProjectArtifactRequestSchema, Vi as ACTIVE_ORG_HEADER, Vn as PublicFormSubmitResponseSchema, Vr as UserPreferencesPatchSchema, Vt as ListOrganizationMembersPageResponseSchema, W as CreateProjectResponseSchema, Wi as PresignChatAttachmentResponseSchema, Wn as PublishedFormListResponseSchema, Wr as WorkflowCanvasRunSchema, Wt as ListProjectFilesResponseSchema, X as CredentialInstanceRecordSchema, Xi as BillingSummaryResponseSchema, Xn as RenewManagedDeployUploadResponseSchema, Xr as WorkflowRunInputsPutBodySchema, Xt as ManagedDeployResourceKeySchema, Y as CredentialInstanceListResponseSchema, Yi as BillingRedirectResponseSchema, Yn as RenewManagedDeployUploadRequestSchema, Yr as WorkflowRunHooksResponseSchema, Yt as MANAGED_DEPLOY_REQUEST_TIMEOUT_MS, Z as DOCS_QUERY_TOOL, Zi as BillingUsageResponseSchema, Zr as WorkflowRunInputsSchema, Zt as ManagedServiceCredentialSchema, _ as CatalogAppDetailResponseSchema, _i as normalizeDocsSearchPaths, _n as PlatformAgentSessionListResponseSchema, _r as SubmitTeamRequestRequestSchema, _t as GraphqlDiscoverResponseSchema, a as AgentSessionDetailResponseSchema, ai as WorkspaceTriggerOverviewSchema, an as PROJECT_DRAFT_DIFF_MAX_BYTES, ar as SlackAppManifestRequestSchema, at as DraftRevisionResponseSchema, b as ChannelConnectionListResponseSchema, bi as parseErrorResponse, bn as PresignCustomAppLogoRequestSchema, br as TriggerInvokeInputsSchema, bt as HeartbeatManagedDeployResponseSchema, c as AgentSummaryListResponseSchema, ci as buildAgentSlackDeeplink, cn as PROJECT_REACHABILITY_REQUEST_TIMEOUT_MS, cr as SlugAvailabilityResponseSchema, ct as DuplicateCredentialsResponseSchema, d as BindAgentSlackAppBodySchema, di as detectProjectPackageManagerFromSnapshot, dr as StartMcpOAuthConnectionInputSchema, dt as FormFieldConfigSchema, ea as CreateBillingPortalRequestSchema, ei as WorkflowSummaryDetailResponseSchema, en as OpenApiDiscoverResponseSchema, er as SkillSummaryDetailResponseSchema, et as DownloadActiveProjectArtifactResponseSchema, f as BindChannelBodySchema, fi as gitPorcelainLineTouchesManagedDraftPublishPath, fr as StartMcpOAuthConnectionResultSchema, ft as GatewayAttachmentRecordSchema, g as CatalogActionsPageResponseSchema, gn as PlatformAgentSessionDetailResponseSchema, gr as SubmitMarketingContactRequestSchema, gt as GetTemplateResponseSchema, h as CatalogActionDetailResponseSchema, hi as isIgnoredProjectSourcePath, hn as PlatformAgentPromptResponseSchema, hr as SubmitAgentFeedbackRequestSchema, ht as GetCustomAppResponseSchema, i as AgentEnvImageSnapshotResponseSchema, ii as WorkspaceTriggerListResponseSchema, in as PROJECT_DRAFT_COMMIT_REQUEST_TIMEOUT_MS, ir as SlackAppListResponseSchema, it as DraftFileContentResponseSchema, j as CreateApiKeyResponseSchema, ji as CredentialAssignmentRecordSchema, jn as ProjectGitStatusResponseSchema, jr as UpdateOrganizationRequestSchema, jt as ListApiKeysResponseSchema, k as ConnectProvidersResponseSchema, ki as CredentialAssignmentListQuerySchema, kn as ProjectGitRemoteRequestSchema, kr as UpdateOrganizationMemberRequestSchema, kt as ListAgentMemoryFilesResponseSchema, l as AgentTriggerSummaryListResponseSchema, li as buildConnectDeeplink, lr as StartKeystrokeConnectionInputSchema, lt as FinalizeCustomAppLogoRequestSchema, m as CancelManagedDeployResponseSchema, mn as PlatformAgentPromptInputSchema, mr as StartOAuthConnectionResultSchema, mt as GetCredentialResponseSchema, n as ActiveOrganizationResponseSchema, na as CreateSubscriptionCheckoutRequestSchema, ni as WorkspaceTriggerDetailSchema, nn as OrganizationSidebarBrandingSchema, nr as SlackAgentMembershipsResponseSchema, nt as DraftCommitResponseSchema, o as AgentSessionListResponseSchema, oi as WorkspaceTriggerRunListResponseSchema, or as SlackAppManifestResponseSchema, ot as DraftUpdateEventSchema, p as CancelManagedDeployRequestSchema, pi as isAcceptableInstallExit, pn as PlatformAgentCancelResponseSchema, pr as StartOAuthConnectionInputSchema, pt as GetAppCatalogEntryResponseSchema, q as CreateSlackChannelBodySchema, qi as BillingActivityResponseSchema, qn as QueuedRunResponseSchema, qr as WorkflowFormUpsertBodySchema, qt as ListProjectsResponseSchema, r as ActiveProjectSourceRevisionSchema, ra as UpdateAutoTopupRequestSchema, ri as WorkspaceTriggerFileSchema, rn as PNPM_FROZEN_INSTALL_ARGS, rr as SlackAppInstallStartResponseSchema, rt as DraftConflictResponseSchema, s as AgentSummaryDetailResponseSchema, si as WorkspaceWorkflowOverviewSchema, sn as PROJECT_PULL_STATE_RELATIVE_PATH, sr as SlackMembershipChannelBodySchema, st as DuplicateCredentialRequestSchema, t as AcceptOrganizationInvitationResponseSchema, ta as CreateCreditsCheckoutRequestSchema, ti as WorkflowSummaryListResponseSchema, tn as OrganizationSidebarBrandingPatchSchema, tr as SkillSummaryListResponseSchema, tt as DownloadActiveProjectSourceResponseSchema, u as AppSlugAvailabilityResponseSchema, ui as deriveCustomAppDisplay, ur as StartKeystrokeConnectionResultSchema, ut as FinalizeCustomAppLogoResponseSchema, v as CatalogAppsPageResponseSchema, vn as PrepareManagedDeployRequestSchema, vr as TemplateFilesResponseSchema, vt as HealthResponseSchema, w as CompleteManagedDeployArtifactResponseSchema, wi as resolveConnectAppSlug, wn as PresignProjectSourceRequestSchema, wr as TriggerRunListResponseSchema, wt as HistoryRunListResponseSchema, x as ChannelConnectionSchema, xn as PresignCustomAppLogoResponseSchema, xr as TriggerInvokeResponseSchema, xt as HistoryRunCancelResponseSchema, y as ChannelAccountListResponseSchema, yi as parseAppSlug, yn as PrepareManagedDeployResponseSchema, yr as TriggerDetailResponseSchema, yt as HeartbeatManagedDeployRequestSchema, z as CreateOrganizationRequestSchema, zn as PublicFormMetadataSchema, zr as UserAvatarPatchSchema, zt as ListOrganizationInvitationsResponseSchema } from "./dist-CnddVrzY.mjs";
-import { $ as withMcpReadClient, Q as assertPublicHttpUrl, Z as PublicHttpUrlError, _t as captureException, bt as flushTelemetry, et as artifactIndexFromModules, gt as alias, nt as mapInParallelBatches, rt as moduleBlobRefsFromModules, tt as collectArtifactModules, vt as configureTelemetry, xt as shutdownTelemetry, yt as event } from "./dist-B8ZXKNXj.mjs";
-import { a as buildApp, c as computeSafeFilteredDeploy, r as analyzeDeployableClosures, t as ANALYZER_CONTRACT_VERSION } from "./dist-C5ooQsTQ.mjs";
+import { A as resolvePlatformUrlForWebUrl, C as createCliConfig, D as getWebUrl, E as getPlatformUrl, M as ExpectedCliError, N as isExpectedCliError, O as DEFAULT_PLATFORM_URL, S as resolveCliRoot, T as getCredentialStorage, _ as isLocalSdkSpec, a as formatReleaseAgeBlockMessage, b as shouldUpdateCliVersion, c as detectManagerFromLockfile, d as installDependencies$1, f as installPlaygroundDependencies, g as ensureSdkCurrent, i as readPnpmMinimumReleaseAgeMinutes, j as parseCredentialStorage, l as buildPlaygroundWorkspace, m as resolvePackageManager, n as ensureMinimumReleaseAgeExclude, o as isReleaseAgeBlock, p as resolveGithubPackagesToken, r as computeReleaseAgeRetryAfter, s as detectCliInstall, t as runPackageManagerUpdate, u as detectPackageManager$2, v as fetchLatestCliRelease, w as getCliConfigDir, x as readCliVersion, y as resolveCliDistTag } from "./run-package-manager-update-Dvl8GJr2.mjs";
+import { $ as CreateProjectArtifactRequestSchema, $i as parseErrorResponse, $n as PresignUserAvatarRequestSchema, $r as UpdateBrainDocumentMetadataRequestSchema, $t as ListBrainFiltersResponseSchema, A as ChannelConnectionSchema, Aa as BillingUsageResponseSchema, Ai as WorkflowRunInputsSchema, An as PROJECT_DRAFT_DIFF_MAX_BYTES, Ar as SlackAgentMembershipsResponseSchema, At as GetCredentialResponseSchema, B as CreateApiKeyResponseSchema, Bi as WorkspaceWorkflowOverviewSchema, Bn as PlatformAgentPromptResponseSchema, Br as StartMcpOAuthConnectionResultSchema, Bt as HistoryRunListResponseSchema, C as CancelManagedDeployResponseSchema, Ca as PresignChatAttachmentResponseSchema, Ci as WorkflowCanvasRunSchema, Cn as ManagedServiceKindSchema, Cr as RenewManagedDeployUploadRequestSchema, Ct as FinalizeBrainUploadsRequestSchema, D as CatalogAppsPageResponseSchema, Da as BillingInvoiceUrlResponseSchema, Di as WorkflowRunDetailResponseSchema, Dn as OrganizationSidebarBrandingSchema, Dt as FormFieldConfigSchema, E as CatalogAppDetailResponseSchema, Ea as BillingActivityResponseSchema, Ei as WorkflowFormUpsertBodySchema, En as OrganizationSidebarBrandingPatchSchema, Er as SLACK_PERSONAL_APP_SLUG, Et as FinalizeCustomAppLogoResponseSchema, F as CompleteProjectArtifactResponseSchema, Fa as CreateSubscriptionCheckoutRequestSchema, Fi as WorkspaceTriggerDetailSchema, Fr as SlackMembershipChannelBodySchema, Ft as HeartbeatManagedDeployRequestSchema, G as CreateCredentialsRequestSchema, Gi as gitPorcelainLineTouchesManagedDraftPublishPath, Gn as PrepareManagedDeployRequestSchema, Gr as SubmitTeamRequestRequestSchema, Gt as ListAgentMemoryFilesResponseSchema, H as CreateBrainGrantRequestSchema, Hi as buildConnectDeeplink, Hn as PlatformAgentSessionListResponseSchema, Hr as StartOAuthConnectionResultSchema, Ht as InviteOrganizationMembersResponseSchema, I as ConnectAuthorizeUrlResponseSchema, Ia as UpdateAutoTopupRequestSchema, Ii as WorkspaceTriggerFileSchema, Ir as SlugAvailabilityResponseSchema, It as HeartbeatManagedDeployResponseSchema, J as CreateCustomAppResponseSchema, Ji as isIgnoredProjectSourcePath, Jn as PresignCustomAppLogoResponseSchema, Jr as TriggerInvokeInputsSchema, Jt as ListAppsResponseSchema, K as CreateCredentialsResponseSchema, Ki as isAcceptableInstallExit, Kn as PrepareManagedDeployResponseSchema, Kr as TemplateFilesResponseSchema, Kt as ListAgentWorkspaceFilesResponseSchema, L as ConnectManagedServiceCredentialRequestSchema, Li as WorkspaceTriggerListResponseSchema, Lr as StartKeystrokeConnectionInputSchema, Lt as HistoryRunCancelResponseSchema, M as CompleteManagedDeployArtifactRequestSchema, Ma as ConfirmCheckoutResponseSchema, Mi as WorkflowRunResponseSchema, Mn as PROJECT_PULL_STATE_RELATIVE_PATH, Mr as SlackAppListResponseSchema, Mt as GetTemplateResponseSchema, N as CompleteManagedDeployArtifactResponseSchema, Na as CreateBillingPortalRequestSchema, Ni as WorkflowSummaryDetailResponseSchema, Nn as PROJECT_REACHABILITY_REQUEST_TIMEOUT_MS, Nr as SlackAppManifestRequestSchema, Nt as GraphqlDiscoverResponseSchema, O as ChannelAccountListResponseSchema, Oa as BillingRedirectResponseSchema, Oi as WorkflowRunHooksResponseSchema, On as PNPM_FROZEN_INSTALL_ARGS, Or as SkillSummaryDetailResponseSchema, Ot as GatewayAttachmentRecordSchema, P as CompleteProjectArtifactRequestSchema, Pa as CreateCreditsCheckoutRequestSchema, Pi as WorkflowSummaryListResponseSchema, Pr as SlackAppManifestResponseSchema, Pt as HealthResponseSchema, Q as CreateOrganizationResponseSchema, Qi as parseAppSlug, Qn as PresignProjectSourceResponseSchema, Qr as TriggerRunListResponseSchema, Qt as ListBrainDocumentsResponseSchema, R as ConnectProvidersResponseSchema, Ri as WorkspaceTriggerOverviewSchema, Rn as PlatformAgentCancelResponseSchema, Rr as StartKeystrokeConnectionResultSchema, Rt as HistoryRunDetailResponseSchema, S as CancelManagedDeployRequestSchema, Sa as PresignChatAttachmentRequestSchema, Si as WorkflowCanvasCredentialBindingsSchema, Sn as ManagedServiceCredentialSchema, Sr as RecentResourceListResponseSchema, St as DuplicateCredentialsResponseSchema, T as CatalogActionsPageResponseSchema, Ta as AutoTopupSummarySchema, Ti as WorkflowFormResponseSchema, Tn as OpenApiDiscoverResponseSchema, Tt as FinalizeCustomAppLogoRequestSchema, U as CreateBrainRequestSchema, Ui as deriveCustomAppDisplay, Un as PrepareBrainUploadsRequestSchema, Ur as SubmitAgentFeedbackRequestSchema, Ut as InviteProjectMembersRequestSchema, V as CreateBrainFilterRequestSchema, Vi as buildAgentSlackDeeplink, Vn as PlatformAgentSessionDetailResponseSchema, Vr as StartOAuthConnectionInputSchema, Vt as InviteOrganizationMembersRequestSchema, W as CreateCredentialInstanceBodySchema, Wi as detectProjectPackageManagerFromSnapshot, Wn as PrepareBrainUploadsResponseSchema, Wr as SubmitMarketingContactRequestSchema, Wt as InviteProjectMembersResponseSchema, X as CreateDraftDiffCommitRequestSchema, Xi as normalizeDocsSearchPaths, Xn as PresignOrgLogoResponseSchema, Xr as TriggerListResponseSchema, Xt as ListBrainDocumentWritesResponseSchema, Y as CreateDraftCommitRequestSchema, Yn as PresignOrgLogoRequestSchema, Yr as TriggerInvokeResponseSchema, Yt as ListBrainDocumentWritesQuerySchema, Z as CreateOrganizationRequestSchema, Zn as PresignProjectSourceRequestSchema, Zr as TriggerRunDetailResponseSchema, Zt as ListBrainDocumentsQuerySchema, _ as BrainFilterExpressionSchema, _i as UpsertGatewayAttachmentBodySchema, _n as ListProjectMetricsResponseSchema, _r as PublishedFormListResponseSchema, _t as DraftConflictResponseSchema, a as AgentEnvImageSnapshotResponseSchema, aa as slugifyAppName, ai as UpdateCredentialInstanceBodySchema, an as ListCredentialsPageResponseSchema, ar as ProjectPullStateSchema, at as CreateSlackChannelBodySchema, b as BrainIndexConfigSchema, ba as ACTIVE_ORG_HEADER, bi as UserPreferencesPatchSchema, bn as MANAGED_DEPLOY_REQUEST_TIMEOUT_MS, br as QueuedRunResponseSchema, bt as DraftUpdateEventSchema, c as AgentSummaryDetailResponseSchema, ca as CredentialAssignmentListQuerySchema, ci as UpdateOrganizationMemberRequestSchema, cn as ListManagedServiceCredentialsResponseSchema, cr as ProjectSettingsResponseSchema, ct as CredentialInstanceRecordSchema, d as AppSlugAvailabilityResponseSchema, da as CredentialConsumerListQuerySchema, di as UpdateProjectMemberRequestSchema, dn as ListOrganizationMembersPageQuerySchema, dr as PromptResponseSchema, dt as DeclineOrganizationInvitationResponseSchema, ei as UpdateBrainFilterRequestSchema, en as ListBrainGrantsResponseSchema, er as PresignUserAvatarResponseSchema, et as CreateProjectArtifactResponseSchema, f as BindAgentSlackAppBodySchema, fa as CredentialConsumerListResponseSchema, fi as UpdateProjectMemberResponseSchema, fn as ListOrganizationMembersPageResponseSchema, fr as PublicFormMetadataSchema, ft as DeleteBrainDocumentsRequestSchema, gi as UploadProjectSourceResponseSchema, gn as ListProjectMembersResponseSchema, gr as PublishManagedDeployCandidateResponseSchema, gt as DraftCommitResponseSchema, h as BrainDocumentDetailSchema, hi as UploadProjectSourceManifestRequestSchema, hn as ListProjectFilesResponseSchema, hr as PublishManagedDeployCandidateRequestSchema, ht as DownloadActiveProjectSourceResponseSchema, i as AddBrainMemberRequestSchema, ia as resolveDocsMcpUrl, ii as UpdateChannelBindingBodySchema, in as ListCredentialsPageQuerySchema, ir as ProjectGitStatusResponseSchema, it as CreateSlackAppResponseSchema, j as ChannelDirectoryListResponseSchema, ja as ConfirmCheckoutRequestSchema, ji as WorkflowRunListResponseSchema, jr as SlackAppInstallStartResponseSchema, jt as GetCustomAppResponseSchema, k as ChannelConnectionListResponseSchema, ka as BillingSummaryResponseSchema, ki as WorkflowRunInputsPutBodySchema, kn as PROJECT_DRAFT_COMMIT_REQUEST_TIMEOUT_MS, kr as SkillSummaryListResponseSchema, kt as GetAppCatalogEntryResponseSchema, l as AgentSummaryListResponseSchema, la as CredentialAssignmentListResponseSchema, li as UpdateOrganizationMemberResponseSchema, ln as ListMcpAppToolsResponseSchema, lr as ProjectSlugAvailabilityResponseSchema, lt as DOCS_QUERY_TOOL, m as BrainDetailSchema, mi as UpdateProjectSettingsRequestSchema, mn as ListProjectDeploymentsResponseSchema, mr as PublicFormSubmitResponseSchema, mt as DownloadActiveProjectArtifactResponseSchema, n as ActiveOrganizationResponseSchema, ni as UpdateBrainRequestSchema, nn as ListBrainsResponseSchema, nr as ProjectGitRemoteRequestSchema, nt as CreateProjectResponseSchema, o as AgentSessionDetailResponseSchema, oi as UpdateCredentialRequestSchema, on as ListDraftFilesResponseSchema, or as ProjectReachabilityResponseSchema, ot as CreateSlackChannelResponseSchema, p as BindChannelBodySchema, pa as ExecuteKeystrokeToolRequestSchema, pi as UpdateProjectRequestSchema, pn as ListOrganizationsResponseSchema, pr as PublicFormSubmitBodySchema, pt as DeleteBrainDocumentsResponseSchema, q as CreateCustomAppRequestSchema, qn as PresignCustomAppLogoRequestSchema, qr as TriggerDetailResponseSchema, qt as ListApiKeysResponseSchema, r as ActiveProjectSourceRevisionSchema, ra as resolveConnectAppSlug, ri as UpdateBrainResponseSchema, rn as ListChannelPlatformsResponseSchema, rr as ProjectGitRemoteResponseSchema, rt as CreateSlackAppRequestSchema, s as AgentSessionListResponseSchema, sa as AssignCredentialBodySchema, si as UpdateManagedServiceCredentialRequestSchema, sn as ListEmbeddingModelsResponseSchema, sr as ProjectResponseSchema, st as CredentialInstanceListResponseSchema, t as AcceptOrganizationInvitationResponseSchema, ta as parseSlackConnectFlow, ti as UpdateBrainMemberRequestSchema, tn as ListBrainMembersResponseSchema, tt as CreateProjectRequestSchema, u as AgentTriggerSummaryListResponseSchema, ua as CredentialAssignmentRecordSchema, ui as UpdateOrganizationRequestSchema, un as ListOrganizationInvitationsResponseSchema, ur as PromptInputSchema, ut as DOCS_SEARCH_TOOL, v as BrainFilterSummarySchema, vi as UserAvatarPatchSchema, vn as ListProjectsResponseSchema, vr as PublishedFormSchema, vt as DraftFileContentResponseSchema, w as CatalogActionDetailResponseSchema, wi as WorkflowCanvasSchema, wn as McpDiscoverResponseSchema, wr as RenewManagedDeployUploadResponseSchema, wt as FinalizeBrainUploadsResponseSchema, x as BrainMemberSchema, xa as CLIENT_CHANNEL_HEADER, xi as UserPreferencesSchema, xn as ManagedDeployResourceKeySchema, xr as RebuildBrainResponseSchema, xt as DuplicateCredentialRequestSchema, y as BrainGrantSchema, yi as UserAvatarSchema, yn as ListTemplatesResponseSchema, yr as QueuedAgentPromptResponseSchema, yt as DraftRevisionResponseSchema, z as CreateApiKeyRequestSchema, zi as WorkspaceTriggerRunListResponseSchema, zn as PlatformAgentPromptInputSchema, zr as StartMcpOAuthConnectionInputSchema, zt as HistoryRunListQuerySchema } from "./dist-BUDyVVbj.mjs";
+import { $ as withMcpReadClient, Ct as stopBrowserUseSession, Dt as event, Et as configureTelemetry, Ot as flushTelemetry, Q as assertPublicHttpUrl, St as runAgentBrowser, Tt as captureException, Z as PublicHttpUrlError, _t as defaultBrowserProfilesRoot, bt as resolveBrowserContext, et as artifactIndexFromModules, gt as agentBrowserProfilePath, kt as shutdownTelemetry, nt as moduleBlobRefsFromModules, rt as mapInParallelBatches, tt as collectArtifactModules, vt as deleteBrowserUseProfile, wt as alias, xt as resolveBrowserProvider, yt as openCloudBrowserLogin } from "./dist-D2xubfXd.mjs";
+import { a as buildApp, c as computeSafeFilteredDeploy, r as analyzeDeployableClosures, t as ANALYZER_CONTRACT_VERSION } from "./dist-DRSCtW8V.mjs";
 import { createRequire } from "node:module";
 import { Command } from "commander";
 import { homedir, platform, release, tmpdir } from "node:os";
@@ -4865,6 +4865,24 @@ function createAgentsResource(http) {
 			} catch (error) {
 				throw await toPlatformError(error);
 			}
+		},
+		/** Live browser session metadata (liveUrl, recordings) for the agent session. */
+		async getBrowserSession(projectId, agentSlug, sessionId) {
+			try {
+				return await http.get(`api/projects/${encodeURIComponent(projectId)}/agents/${encodeURIComponent(agentSlug)}/browser/sessions/${encodeURIComponent(sessionId)}`).json();
+			} catch (error) {
+				const platformError = await toPlatformError(error);
+				if (platformError.status === 404) return null;
+				throw platformError;
+			}
+		},
+		/** Open a Browser Use live session for login (platform holds the API key). */
+		async openBrowserSession(projectId, agentSlug, body) {
+			try {
+				return await http.post(`api/projects/${encodeURIComponent(projectId)}/agents/${encodeURIComponent(agentSlug)}/browser/open`, { json: body ?? {} }).json();
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
 		}
 	};
 }
@@ -5996,6 +6014,254 @@ function createBillingResource(http) {
 		}
 	};
 }
+/**
+* Organization-scoped Brains resource.
+*
+* Human Brain management is served by the org-scoped platform routes under
+* `/api/brains*`; the active organization travels on the client's
+* organization header (same as `triggers` / `members`). Access is
+* membership-based: the caller must hold a Brain `owner`/`admin` membership —
+* project grants only authorize deployed project runtimes and are managed
+* here as the `/projects` sub-resource.
+*/
+function brainPath(brainSlug) {
+	const base = "/api/brains";
+	return brainSlug === void 0 ? base : `${base}/${encodeURIComponent(brainSlug)}`;
+}
+/** documentIds are relative paths (`reports/q1.pdf`): keep `/`, escape each segment. */
+function encodeDocumentPath(documentId) {
+	return documentId.split("/").map(encodeURIComponent).join("/");
+}
+function appendQueryValues(query, key, values) {
+	for (const value of values ?? []) query.append(key, value);
+}
+function documentsQueryString(input) {
+	const parsed = ListBrainDocumentsQuerySchema.parse(input);
+	const query = new URLSearchParams({ limit: String(parsed.limit) });
+	if (parsed.prefix) query.set("prefix", parsed.prefix);
+	if (parsed.search) query.set("search", parsed.search);
+	appendQueryValues(query, "source", parsed.source);
+	appendQueryValues(query, "provisionerKind", parsed.provisionerKind);
+	if (parsed.filterSlug) query.set("filterSlug", parsed.filterSlug);
+	if (parsed.cursor) query.set("cursor", parsed.cursor);
+	return query.toString();
+}
+function documentWritesQueryString(input) {
+	const parsed = ListBrainDocumentWritesQuerySchema.parse(input);
+	const query = new URLSearchParams({
+		documentId: parsed.documentId,
+		limit: String(parsed.limit)
+	});
+	if (parsed.cursor) query.set("cursor", parsed.cursor);
+	return query.toString();
+}
+function createBrainsResource(http) {
+	return {
+		/** Brains the caller owns or administers (membership, not project grants). */
+		async list() {
+			try {
+				const data = await http.get(brainPath()).json();
+				return ListBrainsResponseSchema.parse(data).brains;
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async get(brainSlug) {
+			try {
+				return BrainDetailSchema.parse(await http.get(brainPath(brainSlug)).json());
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		/** Creates a base Brain; the caller becomes its sole owner. No project is granted. */
+		async create(input) {
+			const body = CreateBrainRequestSchema.parse(input);
+			try {
+				return BrainDetailSchema.parse(await http.post(brainPath(), { json: body }).json());
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async update(brainSlug, input) {
+			const body = UpdateBrainRequestSchema.parse(input);
+			try {
+				return UpdateBrainResponseSchema.parse(await http.patch(brainPath(brainSlug), { json: body }).json());
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async delete(brainSlug) {
+			try {
+				await http.delete(brainPath(brainSlug));
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async rebuild(brainSlug) {
+			try {
+				return RebuildBrainResponseSchema.parse(await http.post(`${brainPath(brainSlug)}/rebuild`).json());
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async listMembers(brainSlug) {
+			try {
+				const data = await http.get(`${brainPath(brainSlug)}/members`).json();
+				return ListBrainMembersResponseSchema.parse(data).members;
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async addMember(brainSlug, input) {
+			const body = AddBrainMemberRequestSchema.parse(input);
+			try {
+				return BrainMemberSchema.parse(await http.post(`${brainPath(brainSlug)}/members`, { json: body }).json());
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async updateMember(brainSlug, userId, input) {
+			const body = UpdateBrainMemberRequestSchema.parse(input);
+			try {
+				return BrainMemberSchema.parse(await http.patch(`${brainPath(brainSlug)}/members/${encodeURIComponent(userId)}`, { json: body }).json());
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async removeMember(brainSlug, userId) {
+			try {
+				await http.delete(`${brainPath(brainSlug)}/members/${encodeURIComponent(userId)}`);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async listGrants(brainSlug) {
+			try {
+				const data = await http.get(`${brainPath(brainSlug)}/projects`).json();
+				return ListBrainGrantsResponseSchema.parse(data).grants;
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async createGrant(brainSlug, input) {
+			const body = CreateBrainGrantRequestSchema.parse(input);
+			try {
+				return BrainGrantSchema.parse(await http.post(`${brainPath(brainSlug)}/projects`, { json: body }).json());
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async revokeGrant(brainSlug, projectId) {
+			try {
+				await http.delete(`${brainPath(brainSlug)}/projects/${encodeURIComponent(projectId)}`);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async listFilters(brainSlug) {
+			try {
+				const data = await http.get(`${brainPath(brainSlug)}/filters`).json();
+				return ListBrainFiltersResponseSchema.parse(data).filters;
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async createFilter(brainSlug, input) {
+			const body = CreateBrainFilterRequestSchema.parse(input);
+			try {
+				return BrainFilterSummarySchema.parse(await http.post(`${brainPath(brainSlug)}/filters`, { json: body }).json());
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async updateFilter(brainSlug, filterSlug, input) {
+			const body = UpdateBrainFilterRequestSchema.parse(input);
+			try {
+				return BrainFilterSummarySchema.parse(await http.patch(`${brainPath(brainSlug)}/filters/${encodeURIComponent(filterSlug)}`, { json: body }).json());
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async deleteFilter(brainSlug, filterSlug) {
+			try {
+				await http.delete(`${brainPath(brainSlug)}/filters/${encodeURIComponent(filterSlug)}`);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async listDocuments(brainSlug, input = {}) {
+			const query = documentsQueryString(input);
+			try {
+				return ListBrainDocumentsResponseSchema.parse(await http.get(`${brainPath(brainSlug)}/documents?${query}`).json());
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async getDocument(brainSlug, documentId) {
+			try {
+				return BrainDocumentDetailSchema.parse(await http.get(`${brainPath(brainSlug)}/documents/detail/${encodeDocumentPath(documentId)}`).json());
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async listDocumentWrites(brainSlug, input) {
+			const query = documentWritesQueryString(input);
+			try {
+				return ListBrainDocumentWritesResponseSchema.parse(await http.get(`${brainPath(brainSlug)}/documents/writes?${query}`).json());
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async updateDocumentMetadata(brainSlug, documentId, metadata) {
+			const body = UpdateBrainDocumentMetadataRequestSchema.parse({ metadata });
+			try {
+				await http.patch(`${brainPath(brainSlug)}/documents/${encodeDocumentPath(documentId)}`, { json: body });
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async deleteDocuments(brainSlug, documentIds) {
+			const body = DeleteBrainDocumentsRequestSchema.parse({ documentIds });
+			try {
+				const data = await http.post(`${brainPath(brainSlug)}/documents/delete`, { json: body }).json();
+				return DeleteBrainDocumentsResponseSchema.parse(data).deletedDocumentIds;
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async prepareUploads(brainSlug, input) {
+			const body = PrepareBrainUploadsRequestSchema.parse(input);
+			try {
+				return PrepareBrainUploadsResponseSchema.parse(await http.post(`${brainPath(brainSlug)}/documents/prepare`, { json: body }).json());
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async finalizeUploads(brainSlug, versionIds) {
+			const body = FinalizeBrainUploadsRequestSchema.parse({ versionIds });
+			try {
+				return FinalizeBrainUploadsResponseSchema.parse(await http.post(`${brainPath(brainSlug)}/documents/finalize`, { json: body }).json());
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		}
+	};
+}
+/**
+* Embedding-model catalog for Brain create/update pickers. Served from the
+* platform's cached AI Gateway catalog (`GET /api/embedding-models`); any
+* returned id is a valid Brain `indexConfig.embeddingModel`.
+*/
+function createEmbeddingModelsResource(http) {
+	return { async list() {
+		try {
+			const data = await http.get("api/embedding-models").json();
+			return ListEmbeddingModelsResponseSchema.parse(data).models;
+		} catch (error) {
+			throw await toPlatformError(error);
+		}
+	} };
+}
 function createHistoryResource(http) {
 	return {
 		/** Runs across projects the current user can access in the active org. */
@@ -6413,6 +6679,8 @@ function createPlatformClient(options) {
 		apiKeys: createApiKeysResource(http),
 		managedServiceCredentials: createManagedServiceCredentialsResource(http),
 		billing: createBillingResource(http),
+		brains: createBrainsResource(http),
+		embeddingModels: createEmbeddingModelsResource(http),
 		recents: createRecentsResource(http),
 		userPreferences: createUserPreferencesResource(http),
 		userAvatar: createUserAvatarResource(http),
@@ -7583,6 +7851,146 @@ Examples:
 	}, void 0, { orgScoped: true }));
 }
 //#endregion
+//#region src/commands/agents/browser.ts
+function profilesRoot() {
+	return process.env.KEYSTROKE_BROWSER_PROFILES_ROOT?.trim() || defaultBrowserProfilesRoot();
+}
+function profileMetaPath(agentSlug) {
+	return join(agentBrowserProfilePath(profilesRoot(), agentSlug), ".keystroke-profile.json");
+}
+function readProfileMeta(agentSlug) {
+	const path = profileMetaPath(agentSlug);
+	if (!existsSync(path)) return {};
+	try {
+		return JSON.parse(readFileSync(path, "utf8"));
+	} catch (error) {
+		throw new Error(`Invalid browser profile metadata at ${path}`, { cause: error });
+	}
+}
+function writeProfileMeta(agentSlug, meta) {
+	mkdirSync(agentBrowserProfilePath(profilesRoot(), agentSlug), { recursive: true });
+	writeFileSync(profileMetaPath(agentSlug), JSON.stringify({
+		...meta,
+		updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+	}, null, 2));
+}
+function openUrl$1(url) {
+	spawn(process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open", [url], {
+		stdio: "ignore",
+		detached: true
+	}).unref();
+}
+function registerAgentBrowserCommand(agent) {
+	const browser = agent.command("browser").description("Manage the agent's durable browser profile");
+	browser.command("open").description("Open a headed / live browser on this agent's profile for login").argument("<slug>", "Agent slug").option("--url <url>", "Navigate to this URL", "about:blank").option("--no-open", "Print the live URL without opening a system browser").addHelpText("after", `
+Examples:
+  keystroke agents browser open recruiter --url https://linkedin.com/login
+  keystroke agents browser open recruiter --url https://x.com/login
+`).action((slug, options) => runProjectCliCommand("Open agent browser failed", async ({ config, apiTarget }) => {
+		const url = options.url ?? "about:blank";
+		if (apiTarget.projectId) {
+			const opened = await createCliPlatformClient(config).agents.openBrowserSession(apiTarget.projectId, slug, { url });
+			writeProfileMeta(slug, {
+				...readProfileMeta(slug),
+				cloudProfileId: opened.cloudProfileId,
+				lastBrowserUseSessionId: opened.browserUseSessionId,
+				lastLiveUrl: opened.liveUrl
+			});
+			process.stdout.write(`${JSON.stringify(opened, null, 2)}\n`);
+			if (options.open !== false && opened.liveUrl) openUrl$1(opened.liveUrl);
+			else if (opened.liveUrl) process.stdout.write(`Live view: ${opened.liveUrl}\n`);
+			return;
+		}
+		if ((resolveBrowserProvider({ ...process.env.BROWSER_USE_API_KEY ? { browserUseApiKey: process.env.BROWSER_USE_API_KEY } : {} }) === "browseruse" || Boolean(process.env.BROWSER_USE_API_KEY?.trim())) && process.env.BROWSER_USE_API_KEY) {
+			const apiKey = process.env.BROWSER_USE_API_KEY;
+			const existing = readProfileMeta(slug);
+			const opened = await openCloudBrowserLogin({
+				apiKey,
+				agentSlug: slug,
+				url,
+				...existing.cloudProfileId ? { cloudProfileId: existing.cloudProfileId } : {}
+			});
+			writeProfileMeta(slug, {
+				...existing,
+				cloudProfileId: opened.cloudProfileId,
+				lastBrowserUseSessionId: opened.browserUseSessionId,
+				lastLiveUrl: opened.liveUrl
+			});
+			process.stdout.write(`${JSON.stringify({
+				agentSlug: slug,
+				provider: "browseruse",
+				liveUrl: opened.liveUrl ?? null,
+				browserUseSessionId: opened.browserUseSessionId,
+				cloudProfileId: opened.cloudProfileId,
+				sessionId: opened.sessionId,
+				url,
+				hint: "Sign in in the live view, then close when done. Profile cookies persist."
+			}, null, 2)}\n`);
+			if (options.open !== false && opened.liveUrl) openUrl$1(opened.liveUrl);
+			else process.stdout.write(`Live view: ${opened.liveUrl ?? "(none)"}\n`);
+			return;
+		}
+		const ctx = resolveBrowserContext({
+			agentSlug: slug,
+			sessionId: `cli-${Date.now()}`,
+			profilesRoot: profilesRoot(),
+			provider: "local"
+		});
+		mkdirSync(ctx.profilePath, { recursive: true });
+		const result = await runAgentBrowser({
+			context: ctx,
+			args: [
+				"--headed",
+				"open",
+				url
+			]
+		});
+		process.stdout.write(`${JSON.stringify({
+			agentSlug: slug,
+			provider: "local",
+			profilePath: ctx.profilePath,
+			url,
+			exitCode: result.exitCode,
+			stdout: result.stdout.trim() || null,
+			stderr: result.stderr.trim() || null,
+			hint: "Sign in in the headed window. Profile cookies persist for this agent."
+		}, null, 2)}\n`);
+		if (result.exitCode !== 0) process.exitCode = result.exitCode;
+	}));
+	browser.command("reset").description("Wipe this agent's browser profile (force re-login)").argument("<slug>", "Agent slug").action((slug) => runProjectCliCommand("Reset agent browser failed", async () => {
+		const meta = readProfileMeta(slug);
+		if (meta.lastBrowserUseSessionId && process.env.BROWSER_USE_API_KEY) await stopBrowserUseSession({
+			apiKey: process.env.BROWSER_USE_API_KEY,
+			sessionId: meta.lastBrowserUseSessionId
+		});
+		if (meta.cloudProfileId && process.env.BROWSER_USE_API_KEY) await deleteBrowserUseProfile({
+			apiKey: process.env.BROWSER_USE_API_KEY,
+			profileId: meta.cloudProfileId
+		});
+		const path = agentBrowserProfilePath(profilesRoot(), slug);
+		if (existsSync(path)) rmSync(path, {
+			recursive: true,
+			force: true
+		});
+		process.stdout.write(`${JSON.stringify({
+			agentSlug: slug,
+			reset: true,
+			profilePath: path
+		}, null, 2)}\n`);
+	}));
+	browser.command("status").description("Show this agent's browser profile status").argument("<slug>", "Agent slug").action((slug) => runProjectCliCommand("Agent browser status failed", async () => {
+		const path = agentBrowserProfilePath(profilesRoot(), slug);
+		const meta = readProfileMeta(slug);
+		process.stdout.write(`${JSON.stringify({
+			agentSlug: slug,
+			profilePath: path,
+			exists: existsSync(path),
+			providerHint: resolveBrowserProvider({ ...process.env.BROWSER_USE_API_KEY ? { browserUseApiKey: process.env.BROWSER_USE_API_KEY } : {} }),
+			...meta
+		}, null, 2)}\n`);
+	}));
+}
+//#endregion
 //#region src/commands/agents/index.ts
 function registerAgentsCommand(program) {
 	const agents = program.command("agents").description("Invoke and inspect agents");
@@ -7590,6 +7998,7 @@ function registerAgentsCommand(program) {
 	registerAgentPromptCommand(agents);
 	registerAgentSessionsCommand(agents);
 	registerAgentSnapshotCommand(agents);
+	registerAgentBrowserCommand(agents);
 }
 //#endregion
 //#region src/commands/api-key/run-api-key.ts
@@ -9048,7 +9457,7 @@ function registerBuildCommand(program) {
 		try {
 			const root = resolveProjectRoot(options.dir);
 			await ensureSdkCurrent(root);
-			const { buildApp } = await import("./dist-Brtmx-yx.mjs");
+			const { buildApp } = await import("./dist-BOlrsYA4.mjs");
 			await buildApp({ root });
 			process.stdout.write(`Built ${root}\n`);
 		} catch (error) {
@@ -9059,17 +9468,207 @@ function registerBuildCommand(program) {
 	});
 }
 //#endregion
+//#region src/commands/brains/with-brains.ts
+/**
+* Brain management is organization-scoped: commands need the active
+* organization but never a linked project. Project references only appear as
+* explicit cross-references on grant commands.
+*/
+async function withBrains(label, action) {
+	await runCliCommand(label, async () => {
+		const client = createCliPlatformClient(createCliConfig());
+		const result = await action({
+			brains: client.brains,
+			projects: client.projects
+		});
+		if (result !== void 0) process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+	}, void 0, { orgScoped: true });
+}
+function collectRepeatable(value, previous) {
+	return [...previous, value];
+}
+function parseFilterExpression(value) {
+	let parsed;
+	try {
+		parsed = JSON.parse(value);
+	} catch {
+		throw new Error("--filter must be a JSON object");
+	}
+	return BrainFilterExpressionSchema.parse(parsed);
+}
+function parseGrantAccess(value) {
+	if (value !== "read" && value !== "write") throw new Error("--access must be read or write");
+	return value;
+}
+function parseMemberRole(value) {
+	if (value !== "owner" && value !== "admin") throw new Error("--role must be owner or admin");
+	return value;
+}
+/** Resolves a project slug or id cross-reference to the project id. */
+async function resolveProjectId(projects, reference) {
+	const match = (await projects.list({ admin: true })).find((project) => project.slug === reference || project.id === reference);
+	if (!match) throw new Error(`Project "${reference}" not found`);
+	return match.id;
+}
+//#endregion
+//#region src/commands/brains/documents.ts
+function parseProvisionerKinds(values) {
+	return values.map((value) => {
+		if (value !== "workflow" && value !== "manual") throw new Error("--provisioner must be workflow or manual");
+		return value;
+	});
+}
+function registerBrainDocumentsCommands(brains) {
+	const documents = brains.command("documents").description("Inspect and remove Brain documents");
+	documents.command("list <slug>").description("List documents in a Brain").option("--search <text>", "Case-insensitive substring over title and document ID").option("--source <source>", "Filter by document source (repeatable)", collectRepeatable, []).option("--provisioner <kind>", "Filter by provisioner: workflow or manual (repeatable)", collectRepeatable, []).option("--filter <filter-slug>", "Apply a saved Brain filter").option("--prefix <prefix>", "Filter document IDs by prefix").option("--cursor <cursor>", "Pagination cursor").option("--limit <count>", "Page size", "100").action((slug, options) => withBrains("List Brain documents failed", ({ brains: api }) => api.listDocuments(slug, {
+		...options.search ? { search: options.search } : {},
+		...options.source.length > 0 ? { source: options.source } : {},
+		...options.provisioner.length > 0 ? { provisionerKind: parseProvisionerKinds(options.provisioner) } : {},
+		...options.filter ? { filterSlug: options.filter } : {},
+		...options.prefix ? { prefix: options.prefix } : {},
+		...options.cursor ? { cursor: options.cursor } : {},
+		limit: Number(options.limit)
+	})));
+	documents.command("get <slug> <document-id>").description("Get a document's metadata, source, and provenance").action((slug, documentId) => withBrains("Get Brain document failed", ({ brains: api }) => api.getDocument(slug, documentId)));
+	documents.command("delete <slug> <document-ids...>").description("Delete documents from a Brain").option("-y, --yes", "Confirm deletion").action((slug, documentIds, options) => withBrains("Delete Brain documents failed", ({ brains: api }) => {
+		if (!options.yes) throw new Error("Pass --yes to confirm document deletion");
+		return api.deleteDocuments(slug, documentIds);
+	}));
+}
+//#endregion
+//#region src/commands/brains/filters.ts
+function registerBrainFiltersCommands(brains) {
+	const filters = brains.command("filters").description("Manage saved read filters, addressable as {brain-slug}:{filter-slug}");
+	filters.command("list <slug>").description("List filters on a Brain").action((slug) => withBrains("List Brain filters failed", ({ brains: api }) => api.listFilters(slug)));
+	filters.command("create <slug>").description("Create a filter on a Brain").requiredOption("--name <name>", "Filter name").requiredOption("--description <description>", "Filter description").requiredOption("--filter <json>", "Filter expression JSON (source and/or metadata)").option("--slug <filter-slug>", "Filter slug (defaults to a slugified name)").action((slug, options) => withBrains("Create Brain filter failed", ({ brains: api }) => api.createFilter(slug, {
+		name: options.name,
+		description: options.description,
+		filter: parseFilterExpression(options.filter),
+		...options.slug ? { slug: options.slug } : {}
+	})));
+	filters.command("update <slug> <filter-slug>").description("Update a filter's name, description, or expression").option("--name <name>", "Filter name").option("--description <description>", "Filter description").option("--filter <json>", "Replacement filter expression JSON").action((slug, filterSlug, options) => withBrains("Update Brain filter failed", ({ brains: api }) => {
+		const input = {
+			...options.name ? { name: options.name } : {},
+			...options.description !== void 0 ? { description: options.description } : {},
+			...options.filter ? { filter: parseFilterExpression(options.filter) } : {}
+		};
+		if (Object.keys(input).length === 0) throw new Error("At least one update option is required");
+		return api.updateFilter(slug, filterSlug, input);
+	}));
+	filters.command("delete <slug> <filter-slug>").description("Delete a filter (documents and grants are unaffected)").action((slug, filterSlug) => withBrains("Delete Brain filter failed", async ({ brains: api }) => {
+		await api.deleteFilter(slug, filterSlug);
+		return { deleted: filterSlug };
+	}));
+}
+//#endregion
+//#region src/commands/brains/members.ts
+function registerBrainMembersCommands(brains) {
+	const members = brains.command("members").description("Manage Brain owner/admin memberships (owner-only)");
+	members.command("list <slug>").description("List members of a Brain").action((slug) => withBrains("List Brain members failed", ({ brains: api }) => api.listMembers(slug)));
+	members.command("create <slug> <user-id>").description("Add a Brain member").option("--role <role>", "owner or admin", "admin").action((slug, userId, options) => withBrains("Add Brain member failed", ({ brains: api }) => api.addMember(slug, {
+		userId,
+		role: parseMemberRole(options.role)
+	})));
+	members.command("update <slug> <user-id>").description("Change a Brain member's role (promote to owner to transfer ownership)").requiredOption("--role <role>", "owner or admin").action((slug, userId, options) => withBrains("Update Brain member failed", ({ brains: api }) => api.updateMember(slug, userId, { role: parseMemberRole(options.role) })));
+	members.command("delete <slug> <user-id>").description("Remove a Brain member").action((slug, userId) => withBrains("Remove Brain member failed", async ({ brains: api }) => {
+		await api.removeMember(slug, userId);
+		return { deleted: userId };
+	}));
+}
+//#endregion
+//#region src/commands/brains/projects.ts
+function registerBrainProjectsCommands(brains) {
+	const projects = brains.command("projects").description("Share a Brain with project runtimes (read/write grants)");
+	projects.command("list <slug>").description("List project grants for a Brain").action((slug) => withBrains("List Brain project grants failed", ({ brains: api }) => api.listGrants(slug)));
+	projects.command("create <slug> <project>").description("Grant a project's runtime access to a Brain (upserts existing grants)").option("--access <access>", "read or write (write implies read)", "read").action((slug, projectRef, options) => withBrains("Create Brain project grant failed", async ({ brains: api, projects: refs }) => api.createGrant(slug, {
+		projectId: await resolveProjectId(refs, projectRef),
+		access: parseGrantAccess(options.access)
+	})));
+	projects.command("delete <slug> <project>").description("Revoke a project's grant on a Brain").action((slug, projectRef) => withBrains("Revoke Brain project grant failed", async ({ brains: api, projects: refs }) => {
+		const projectId = await resolveProjectId(refs, projectRef);
+		await api.revokeGrant(slug, projectId);
+		return { deleted: projectId };
+	}));
+}
+//#endregion
+//#region src/commands/brains/index.ts
+function parseOptionalInteger(value, flag) {
+	if (value === void 0) return;
+	const parsed = Number(value);
+	if (!Number.isInteger(parsed)) throw new Error(`${flag} must be an integer`);
+	return parsed;
+}
+function hasIndexOptions(options) {
+	return options.embeddingModel !== void 0 || options.language !== void 0 || options.maxCharacters !== void 0 || options.overlapCharacters !== void 0 || options.separator !== void 0;
+}
+function indexConfigFromOptions(options, base) {
+	if (!hasIndexOptions(options)) return;
+	const maxCharacters = parseOptionalInteger(options.maxCharacters, "--max-characters");
+	const overlapCharacters = parseOptionalInteger(options.overlapCharacters, "--overlap-characters");
+	return BrainIndexConfigSchema.parse({
+		...base ?? {},
+		...options.embeddingModel ? { embeddingModel: options.embeddingModel } : {},
+		...options.language ? { language: options.language } : {},
+		chunking: {
+			...base?.chunking ?? {},
+			...maxCharacters !== void 0 ? { maxCharacters } : {},
+			...overlapCharacters !== void 0 ? { overlapCharacters } : {},
+			...options.separator !== void 0 ? { separator: options.separator } : {}
+		}
+	});
+}
+function addIndexOptions(command) {
+	return command.option("--embedding-model <model>", "Embedding model (validated against the live catalog)").option("--language <language>", "Full-text search language").option("--max-characters <count>", "Maximum characters per chunk").option("--overlap-characters <count>", "Character overlap between adjacent chunks").option("--separator <text>", "Exact preferred chunk separator");
+}
+function registerBrainsCommand(program) {
+	const brains = program.command("brains").description("Create, inspect, share, and rebuild hosted Brains (organization-scoped)");
+	brains.command("list").description("List Brains you own or administer").action(() => withBrains("List Brains failed", ({ brains: api }) => api.list()));
+	brains.command("get <slug>").description("Get a Brain").action((slug) => withBrains("Get Brain failed", ({ brains: api }) => api.get(slug)));
+	addIndexOptions(brains.command("create").description("Create a Brain; you become its sole owner").requiredOption("--name <name>", "Brain name").requiredOption("--description <description>", "Brain description").option("--slug <slug>", "Brain slug")).action((options) => withBrains("Create Brain failed", ({ brains: api }) => {
+		const indexConfig = indexConfigFromOptions(options);
+		return api.create({
+			name: options.name,
+			description: options.description,
+			...options.slug ? { slug: options.slug } : {},
+			...indexConfig ? { indexConfig } : {}
+		});
+	}));
+	addIndexOptions(brains.command("update <slug>").description("Update Brain metadata or index configuration (index changes rebuild)").option("--name <name>", "Brain name").option("--description <description>", "Brain description")).action((slug, options) => withBrains("Update Brain failed", async ({ brains: api }) => {
+		const indexConfig = indexConfigFromOptions(options, (hasIndexOptions(options) ? await api.get(slug) : void 0)?.indexConfig);
+		const input = {
+			...options.name ? { name: options.name } : {},
+			...options.description !== void 0 ? { description: options.description } : {},
+			...indexConfig ? { indexConfig } : {}
+		};
+		if (Object.keys(input).length === 0) throw new Error("At least one update option is required");
+		return api.update(slug, input);
+	}));
+	brains.command("delete <slug>").description("Delete a Brain and all of its indexed data (owner-only)").option("-y, --yes", "Confirm deletion").action((slug, options) => withBrains("Delete Brain failed", async ({ brains: api }) => {
+		if (!options.yes) throw new Error("Pass --yes to confirm Brain deletion");
+		await api.delete(slug);
+		return { deleted: slug };
+	}));
+	brains.command("rebuild <slug>").description("Rebuild a Brain's index from stored documents").action((slug) => withBrains("Rebuild Brain failed", ({ brains: api }) => api.rebuild(slug)));
+	registerBrainMembersCommands(brains);
+	registerBrainProjectsCommands(brains);
+	registerBrainFiltersCommands(brains);
+	registerBrainDocumentsCommands(brains);
+}
+//#endregion
 //#region src/deploy/assert-portable-dependencies.ts
 const LINK_SPEC = /^link:/i;
+const WORKSPACE_SPEC = /^workspace:/i;
+const FILE_SPEC = /^file:(?:\.\.?(?:\/|$)|\/|[A-Za-z]:\\|~)/i;
 const NONPORTABLE_SPEC = /^(?:link:|workspace:|file:(?:\.\.?(?:\/|$)|\/|[A-Za-z]:\\|~))/i;
 /**
 * Reject tracked dependency specs that cannot resolve in disposable/server
 * checkouts (absolute/local link:, external file:, unresolved workspace:).
 *
 * `KEYSTROKE_ALLOW_NONPORTABLE_DEPS=1` (local packs / soak deploys) permits
-* `link:` only — `file:` and unresolved `workspace:` still fail the gate.
+* `link:` only. Explicit options allow `workspace:`, `link:`, and local `file:`
+* specs when deploy deliberately builds from the current checkout.
 */
-async function assertPortableProjectDependencies(projectRoot) {
+async function assertPortableProjectDependencies(projectRoot, options = {}) {
 	const allowLinkDeps = process.env.KEYSTROKE_ALLOW_NONPORTABLE_DEPS === "1";
 	const packageJsonPath = join(projectRoot, "package.json");
 	let raw;
@@ -9099,7 +9698,7 @@ async function assertPortableProjectDependencies(projectRoot) {
 		for (const [name, spec] of Object.entries(deps)) {
 			if (typeof spec !== "string") continue;
 			const trimmed = spec.trim();
-			if (allowLinkDeps && LINK_SPEC.test(trimmed)) continue;
+			if ((allowLinkDeps || options.allowLink) && LINK_SPEC.test(trimmed) || options.allowWorkspace && WORKSPACE_SPEC.test(trimmed) || options.allowFile && FILE_SPEC.test(trimmed)) continue;
 			if (NONPORTABLE_SPEC.test(trimmed)) offenders.push(`${name}@${spec}`);
 		}
 	}
@@ -11019,6 +11618,25 @@ async function buildExactCandidate(input) {
 	const depsRoot = input.depsRoot ?? input.cwd;
 	const cleanEnv = worktreeGitEnv();
 	const skipVerify = input.skipVerify === true;
+	if (input.buildFromWorkspace) {
+		await rm(join(input.cwd, "dist"), {
+			recursive: true,
+			force: true
+		});
+		await buildInRoot({
+			buildRoot: input.cwd,
+			env: cleanEnv,
+			skipVerify,
+			manager: await detectPackageManager(input.cwd),
+			needInstall: false
+		});
+		const modules = collectArtifactModules(input.cwd);
+		return {
+			modules,
+			index: artifactIndexFromModules(modules),
+			blobs: moduleBlobRefsFromModules(modules)
+		};
+	}
 	if (input.allowInPlace) {
 		const head = await runGit(["rev-parse", "HEAD"], {
 			cwd: input.cwd,
@@ -11515,7 +12133,13 @@ async function pollProjectActive(client, projectId, options = {}) {
 async function runManagedDeploy(client, config, options) {
 	const deployStarted = Date.now();
 	const root = resolveProjectRoot(options.dir);
-	await assertPortableProjectDependencies(root);
+	if (options.buildFromWorkspace && process.env["KEYSTROKE_DEPLOY_GIT_MODE"] === "checkout") throw new ExpectedCliError("--build-from-workspace is only available from a local monorepo checkout");
+	await assertPortableProjectDependencies(root, {
+		allowWorkspace: options.buildFromWorkspace === true,
+		allowFile: options.buildFromWorkspace === true,
+		allowLink: options.buildFromWorkspace === true
+	});
+	if (options.buildFromWorkspace) process.stderr.write("Warning: --build-from-workspace builds with local workspace dependencies that are not captured in Keystroke's managed source. Use published dependencies for reproducible deploys.\n");
 	const verbose = options.verbose === true;
 	const phase = (label, started) => {
 		if (!verbose) return;
@@ -11563,6 +12187,10 @@ async function runManagedDeploy(client, config, options) {
 		env: gitContext.env,
 		...filter ? { filter } : {}
 	});
+	if (options.buildFromWorkspace && plan.mode === "no_op") plan = {
+		...plan,
+		mode: "full"
+	};
 	phase("plan", planStarted);
 	writePlan(plan);
 	if (plan.mode === "no_op") {
@@ -11707,7 +12335,8 @@ async function runManagedDeploy(client, config, options) {
 							candidateSha: composed.candidateSha,
 							depsRoot: root,
 							skipVerify: verifyOutside,
-							allowInPlace: hostedCheckout && prepared.mode === "full"
+							allowInPlace: hostedCheckout && prepared.mode === "full",
+							buildFromWorkspace: options.buildFromWorkspace === true
 						});
 						buildMs = Date.now() - buildStarted;
 						return result;
@@ -11744,7 +12373,8 @@ async function runManagedDeploy(client, config, options) {
 								candidateSha: publishedCandidateSha,
 								depsRoot: root,
 								skipVerify: verifyOutside,
-								allowInPlace: false
+								allowInPlace: false,
+								buildFromWorkspace: options.buildFromWorkspace === true
 							});
 							buildMs += Date.now() - rebuildStarted;
 						}
@@ -11817,6 +12447,10 @@ async function runManagedDeploy(client, config, options) {
 			env: gitContext.env,
 			...filter ? { filter } : {}
 		});
+		if (options.buildFromWorkspace && plan.mode === "no_op") plan = {
+			...plan,
+			mode: "full"
+		};
 		writePlan(plan);
 		if (plan.mode === "no_op") {
 			process.stdout.write("Nothing to deploy — draft matches main.\n");
@@ -11870,6 +12504,7 @@ async function resolveTrustedDeployGitEnv(input) {
 }
 async function runDeploy(options) {
 	if (options.acceptImpact && !options.filter?.length) throw new ExpectedCliError("--accept-impact requires at least one --filter");
+	if (options.buildFromWorkspace && options.filter?.length) throw new ExpectedCliError("--build-from-workspace cannot be combined with --filter");
 	const root = resolveProjectRoot(options.dir);
 	await ensureSdkCurrent(root);
 	const config = createCliConfig();
@@ -11879,7 +12514,7 @@ async function runDeploy(options) {
 	await runManagedDeploy(client, config, options);
 }
 function registerDeployCommand(program) {
-	program.command("deploy").description("Deploy the project via managed Git (draft sync, local analyze/build, cutover)").option("--dir <path>", "Project directory", process.cwd()).option("--filter <entry>", "Deploy only matching workflow/agent keys (repeatable; e.g. workflows/ping)", (value, previous) => [...previous, value], []).option("--accept-impact", "Accept the current filtered deploy impact (required for non-TTY expansion)").option("--verbose", "Show phase timings, pin SHAs, and deploy detail").action(async (options) => {
+	program.command("deploy").description("Deploy the project via managed Git (draft sync, local analyze/build, cutover)").option("--dir <path>", "Project directory", process.cwd()).option("--filter <entry>", "Deploy only matching workflow/agent keys (repeatable; e.g. workflows/ping)", (value, previous) => [...previous, value], []).option("--accept-impact", "Accept the current filtered deploy impact (required for non-TTY expansion)").option("--build-from-workspace", "Build from the current monorepo checkout (full deploys only; non-reproducible)").option("--verbose", "Show phase timings, pin SHAs, and deploy detail").action(async (options) => {
 		let config;
 		try {
 			config = createCliConfig();
@@ -11891,6 +12526,7 @@ function registerDeployCommand(program) {
 				projectId,
 				filter: options.filter.length > 0 ? options.filter : void 0,
 				acceptImpact: options.acceptImpact === true,
+				buildFromWorkspace: options.buildFromWorkspace === true,
 				verbose: options.verbose === true
 			});
 			await trackCliEvent("cli:deploy", { projectId });
@@ -14307,6 +14943,7 @@ function createProgram() {
 	registerApiKeyCommand(program);
 	registerManagedServicesCommand(program);
 	registerProjectsCommand(program);
+	registerBrainsCommand(program);
 	registerHistoryCommand(program);
 	registerCredentialsCommand(program);
 	registerHealthCommand(program);
@@ -14331,7 +14968,7 @@ function createProgram() {
 async function runCli(argv) {
 	initCliTelemetry();
 	try {
-		const { maybeAutoUpdate } = await import("./maybe-auto-update-28IpqxhP.mjs");
+		const { maybeAutoUpdate } = await import("./maybe-auto-update-Dmcj8aoh.mjs");
 		await maybeAutoUpdate(argv);
 		await createProgram().parseAsync(argv);
 	} finally {
@@ -14341,4 +14978,4 @@ async function runCli(argv) {
 //#endregion
 export { runCli };
 
-//# sourceMappingURL=program-Ckl_ELbL.mjs.map
+//# sourceMappingURL=program-DO7ZQHjx.mjs.map