@keystrokehq/cli 0.1.4 → 0.1.6

package/dist/skills-bundle/skills/keystroke-apps/references/cli-and-catalog.md

@@ -0,0 +1,66 @@
+# CLI, catalog, connect
+
+## Log in once
+
+```bash
+keystroke auth login
+keystroke auth status
+```
+
+Token is stored in the OS keychain and reused for **cloud** CLI commands. Switching local ↔ cloud does not require re-auth. See [cli skill](.agents/skills/keystroke-cli/SKILL.md).
+
+## keystroke app commands
+
+All org-scoped; output is JSON.
+
+| Command | Purpose |
+| ------- | ------- |
+| `app list` | Apps registered/connectable in your org |
+| `app search <query>` | Search live Composio catalog (`--category`, `--limit`, `--cursor`) |
+| `app show <slug>` | Single catalog app details |
+| `app actions [slug]` | List actions for an app, or global search with `--search` (no slug) |
+| `app action <tool-slug>` | Full input/output JSON schema for one action |
+| `app create` | Create custom org `api_key` app (`--name`, `--slug`, `--description`, `--field`) |
+| `app sync <slug>` | Write `src/apps/<name>/app.ts` from platform template (`--dir`) |
+
+`--field` syntax: `key`, `key:secret`, `key:optional`, or `key:secret:optional` (repeatable).
+
+## Connect an app
+
+`keystroke connect <slug>` attaches secrets to an app via the dashboard connect flow:
+
+```bash
+keystroke connect google          # official OAuth
+keystroke connect slack
+keystroke connect exa             # official API key
+keystroke connect acme/internal-api   # custom app (sync first)
+keystroke connect <slug> --print-url  # deeplink without opening browser
+```
+
+- **Official integrations** — always prefer `keystroke connect <slug>`
+- **Custom apps** — `keystroke app sync <slug>` first, then `keystroke connect <slug>`
+- Slug must exist in your org registry (`app list`)
+- Connect once per **target** (local dev server vs cloud deployed project)
+- Dashboard at `:3000` → **Apps** offers the same flow
+
+## Scopes
+
+When you connect an app, the connection is stored at one scope:
+
+| Scope | When |
+| ----- | ---- |
+| `project` (default) | Tie to one project — use unless told otherwise |
+| `org` | Share with every user and project — only on explicit request |
+| `user` | Single user's personal connection |
+
+At runtime resolution is **org first, then project**. Get the active project id from `keystroke config show`.
+
+## `.env` vs connected apps
+
+| Holds | `.env` | Connected apps (via connect) |
+| ----- | ------ | ------------------------------ |
+| Model keys (`ANTHROPIC_API_KEY`), DB URL, OAuth **provider** config (`SLACK_CLIENT_ID`, `GOOGLE_*`) | yes — local boot only | — |
+| Integration secrets resolved at runtime | — | yes |
+| Reaches the cloud? | no | yes, when connected on cloud target |
+
+App secrets are **not** read from `.env` — connect the app with `keystroke connect`. Connections follow the active target (local while `keystroke dev` runs; cloud after deploy). Re-connect on the cloud target after deploy.

package/dist/skills-bundle/skills/keystroke-cli/SKILL.md

@@ -13,7 +13,7 @@ The CLI is the primary interface for keystroke projects. Most commands hit an **
 
 | Target    | Use for                                                                                                | Default URL                           |
 | --------- | ------------------------------------------------------------------------------------------------------ | ------------------------------------- |
-| **Local** | Development and testing — iterate on `src/`, run workflows/agents against your machine, debug sessions | `serverUrl` → `http://localhost:3001` |
+| **Local** | Development and testing — iterate on `src/`, run workflows/agents against your machine, debug sessions | `PUBLIC_PLATFORM_URL` in project `.env` (dev session when `keystroke dev` is running) |
 | **Cloud** | Invoking, listing, and operating a **deployed** project — production runs, trigger URLs, remote audit  | `{platformUrl}/api/projects/{id}`     |
 
 **Rule of thumb:** while you are building or validating changes, use **local**. After deploy, use **cloud** to invoke and inspect what is live.
@@ -111,7 +111,7 @@ Full detail: [api-targets.md](references/api-targets.md).
 | `dev`, `start`, `build`                                            | Local project only                                         |
 | `project list`, `project create`                                   | Platform control plane (org-scoped)                        |
 | `deploy`                                                           | Platform (sets `activeProjectId` + `apiTarget=platform`)   |
-| `workflow`, `agent`, `trigger`, `credentials`, `connect`, `health` | Follows resolved target                                    |
+| `workflow`, `agent`, `trigger`, `app`, `connect`, `health` | Follows resolved target                                    |
 | `auth login`                                                       | Web dashboard (`webUrl`); token reused for cloud API calls |
 
 ## Audit & debug
@@ -129,4 +129,4 @@ keystroke trigger list --endpoint shared-hub
 keystroke trigger url incoming-message
 ```
 
-Related: [deploy](.agents/skills/keystroke-deploy/SKILL.md), [credentials](.agents/skills/keystroke-credentials/SKILL.md), [workflows](.agents/skills/keystroke-workflows/SKILL.md), [agents](.agents/skills/keystroke-agents/SKILL.md), [triggers](.agents/skills/keystroke-triggers/SKILL.md).
+Related: [deploy](.agents/skills/keystroke-deploy/SKILL.md), [apps](.agents/skills/keystroke-apps/SKILL.md), [workflows](.agents/skills/keystroke-workflows/SKILL.md), [agents](.agents/skills/keystroke-agents/SKILL.md), [triggers](.agents/skills/keystroke-triggers/SKILL.md).

package/dist/skills-bundle/skills/keystroke-cli/references/api-targets.md

@@ -1,6 +1,6 @@
 # API target routing
 
-The CLI resolves a `baseUrl` before runtime commands (`workflow`, `agent`, `trigger`, `credentials`, `connect`, `health`). Implementation: `apps/cli/src/resolve-api-target.ts`.
+The CLI resolves a `baseUrl` before runtime commands (`workflow`, `agent`, `trigger`, `app`, `connect`, `health`). Implementation: `apps/cli/src/resolve-api-target.ts`.
 
 ## Mental model
 
@@ -13,12 +13,13 @@ Auth is independent of target. `keystroke auth login` stores a bearer token in t
 
 | Key               | Default                    | Role                             |
 | ----------------- | -------------------------- | -------------------------------- |
-| `serverUrl`       | `http://localhost:3001`    | Local keystroke server API       |
 | `platformUrl`     | `https://api.keystroke.ai` | Keystroke platform control plane |
-| `webUrl`          | `https://app.keystroke.ai` | Dashboard + device login         |
+| `webUrl`          | `https://keystroke.ai` | Dashboard + device login         |
 | `activeProjectId` | unset                      | Deployed project id (persistent) |
 | `apiTarget`       | inferred                   | `local` or `platform`            |
 
+Local commands use `PUBLIC_PLATFORM_URL` from the project `.env` (dev default `http://localhost:3002` when unset). They do not read `platformUrl` when `apiTarget=local`, so cloud login does not redirect local workflow runs to production.
+
 If `apiTarget` is unset and `activeProjectId` exists, effective target is **platform** (backward compatible). Explicit `apiTarget=local` overrides that without clearing `activeProjectId`.
 
 `keystroke config show` prints effective `apiTarget` and any active dev session.
@@ -28,7 +29,7 @@ If `apiTarget` is unset and `activeProjectId` exists, effective target is **plat
 ```bash
 keystroke deploy --project proj_abc     # activeProjectId=proj_abc, apiTarget=platform
 keystroke config use local              # apiTarget=local; proj_abc unchanged
-keystroke workflow run foo --input '{}' # → localhost:3001
+keystroke workflow run foo --input '{}' # → localhost:3002
 keystroke config use cloud              # apiTarget=platform; same proj_abc
 keystroke trigger list                  # → platform runtime
 ```
@@ -55,7 +56,7 @@ keystroke --project proj_xyz workflow runs list my-workflow
 
 | Flag             | Effect                                                                     |
 | ---------------- | -------------------------------------------------------------------------- |
-| `--local`        | Force local `serverUrl` for this command                                   |
+| `--local`        | Force local API (`PUBLIC_PLATFORM_URL` / project `.env`) for this command                  |
 | `--project <id>` | Force platform runtime for that project; does not update `activeProjectId` |
 
 ## Platform projects

package/dist/skills-bundle/skills/keystroke-deploy/SKILL.md

@@ -78,7 +78,7 @@ Detail: [build-and-full-deploy.md](references/build-and-full-deploy.md).
 - **First deploy with `--filter`** — fails; run full deploy once.
 - **Wrong `--dir`** — builds a different tree than you edited.
 - **Expecting full refresh with `--filter`** — only matched modules rebuild; rest comes from active prod.
-- **Cloud creds in `.env`** — deploy never uploads `.env`; set credentials on the cloud target. See [credentials skill](../keystroke-credentials/SKILL.md).
+- **Connected apps aren't in `.env`** — deploy never uploads `.env`; connect apps on the cloud target. See [apps skill](../keystroke-apps/SKILL.md).
 
 ## Audit deployed runtime
 
@@ -89,4 +89,4 @@ keystroke workflow run morning-check --input '{}'
 keystroke trigger list
 ```
 
-Related: [cli skill](../keystroke-cli/SKILL.md), [credentials skill](../keystroke-credentials/SKILL.md).
+Related: [cli skill](../keystroke-cli/SKILL.md), [apps skill](../keystroke-apps/SKILL.md).

package/dist/skills-bundle/skills/keystroke-files/SKILL.md

@@ -1,13 +1,13 @@
 ---
 name: keystroke-files
-description: Add static files to agent workspaces from src/files/ — product docs, instructions, context. Use with defineAgent files option.
+description: Add static files to agent workspaces from src/files/ — product docs, instructions, context. Use with defineSandbox on defineAgent.
 metadata:
   keystroke-domain: files
 ---
 
 # Files
 
-Files under `src/files/` mount into the agent sandbox at `/workspace/`.
+Files under `src/files/` mount into the agent sandbox at `/workspace/agent/`.
 
 ## Layout
 
@@ -19,15 +19,16 @@ src/files/support/
 
 ```ts
 import { defineAgent } from "@keystrokehq/agent";
+import { defineSandbox } from "@keystrokehq/sandbox";
 
 export default defineAgent({
   slug: "support",
-  systemPrompt: "Read /workspace/product-guide.md before answering.",
-  files: true, // uses agent key → src/files/support/
+  systemPrompt: "Read /workspace/agent/product-guide.md before answering.",
+  sandbox: defineSandbox({ files: true }), // uses agent slug → src/files/support/
 });
 ```
 
-Use `files: "shared"` to mount `src/files/shared/` instead.
+Use `defineSandbox({ files: "shared" })` to mount `src/files/shared/` instead.
 
 Point the agent at paths in `systemPrompt`. After `keystroke start`, verify behavior with `keystroke agent prompt support --message "…"`.
 

package/dist/skills-bundle/skills/keystroke-gateways/SKILL.md

@@ -11,7 +11,7 @@ Gateways route **Slack (and similar) messages** to an agent — users chat in-ch
 
 ## Setup (Slack)
 
-1. Set Slack app env vars in `.env` (see credentials skill)
+1. Set Slack app env vars in `.env` (see apps skill)
 2. `keystroke start` — open dashboard at `:3000`
 3. Complete Slack OAuth install
 4. **Gateways → Slack → Attach** — pick an agent key + channel
@@ -40,4 +40,4 @@ keystroke agent sessions get <agent-key> <session-id> --include messages,trace
 
 - [slack-setup.md](references/slack-setup.md) — env vars, attach flow
 
-Related: [agents](.agents/skills/keystroke-agents/SKILL.md), [credentials](.agents/skills/keystroke-credentials/SKILL.md).
+Related: [agents](.agents/skills/keystroke-agents/SKILL.md), [apps](.agents/skills/keystroke-apps/SKILL.md).

package/dist/skills-bundle/skills/keystroke-gateways/references/slack-setup.md

@@ -2,7 +2,7 @@
 
 ## .env
 
-Set Slack app credentials per `@keystrokehq/slack` docs (client id, secret, signing secret).
+Set Slack OAuth provider env vars in `.env` (client id, secret, signing secret) — then connect the Slack app with `keystroke connect slack`.
 
 ## Install & bind
 

package/dist/skills-bundle/skills/keystroke-skills/SKILL.md

@@ -24,7 +24,7 @@ defineAgent({
 });
 ```
 
-At runtime → `.agents/skills/support/` in the workspace.
+At runtime → `/workspace/agent/skills/support/`.
 
 ## SKILL.md
 

package/dist/skills-bundle/skills/keystroke-workflows/SKILL.md

@@ -56,7 +56,7 @@ Unit-test through `executeWorkflow` from `@keystrokehq/workflow` — never call
 
 ## Next references
 
-- [authoring.md](references/authoring.md) — agents in actions, credentials, composition
+- [authoring.md](references/authoring.md) — agents in actions, app connections, composition
 - [testing.md](references/testing.md) — unit tests, stubbing actions, run/trace debugging
 
 Related: [actions](.agents/skills/keystroke-actions/SKILL.md), [triggers](.agents/skills/keystroke-triggers/SKILL.md), [agents](.agents/skills/keystroke-agents/SKILL.md).

package/dist/skills-bundle/skills/keystroke-workflows/references/authoring.md

@@ -32,9 +32,9 @@ Use a wrapper action only when the agent call should also be an agent tool, or w
 
 When an action must call an agent (e.g. the action is reused as an agent tool), call `.prompt()` inside the action's `run`. That prompt is not a separate workflow step — the action is.
 
-## Credentials
+## Connecting apps
 
-Actions that call Slack, Google, etc. declare `credentials: [slackCredential]` or use integration actions that handle resolution. Run `keystroke connect slack` before testing.
+Sync the app into `src/apps/`, author with `app.action()`, then `keystroke connect <slug>` before testing. Catalog integration actions from npm packages work once the app is connected.
 
 ## Keys
 

package/dist/templates/hello-world/.env.example

@@ -1,18 +1,4 @@
-PUBLIC_SERVER_URL=http://localhost:3001
-
-# Required for agent prompts
 ANTHROPIC_API_KEY=
-
-# Better Auth (required for /api/auth/* and web login)
 BETTER_AUTH_SECRET=dev-better-auth-secret-min-32-chars!!
 PUBLIC_WEB_URL=http://localhost:3000
-
-# Optional — defaults to sqlite at ./data/dev.db
-# DATABASE_URL=file:./data/dev.db
-#
-# Postgres:
-# POSTGRES_HOST=localhost
-# POSTGRES_PORT=5432
-# POSTGRES_DB=keystroke
-# POSTGRES_USER=keystroke
-# POSTGRES_PASSWORD=keystroke
+PUBLIC_PLATFORM_URL=http://localhost:3002

package/dist/templates/hello-world/README.md

@@ -7,7 +7,7 @@ Keystroke project — agents, workflows, actions, and triggers under `src/`. See
 ```bash
 pnpm install   # @keystrokehq/* from GitHub Packages (see .npmrc)
 # .env is created from .env.example on init — set ANTHROPIC_API_KEY and integration keys
-keystroke start   # API :3001, dashboard :3000
+keystroke start   # API :3002, dashboard :3000
 ```
 
 Login at `http://localhost:3000` (`admin@example.com` / `adminadmin` by default).

package/dist/templates/hello-world/package.json

@@ -13,7 +13,7 @@
     "test:int": "vitest run --project integration"
   },
   "dependencies": {
-    "@keystrokehq/keystroke": "{{version}}",
+    "@keystrokehq/keystroke": "{{keystrokeVersion}}",
     "zod": "{{catalog:zod}}"
   },
   "devDependencies": {

package/dist/{version-Dxl3y5p6.mjs → version-CiPDVUdk.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { en as originFromPublicUrl } from "./dist-C47GdlWY.mjs";
+import { Mn as originFromPublicUrl, at as LOCAL_PLATFORM_ORIGIN } from "./dist-H53GUsol.mjs";
 import Conf from "conf";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
@@ -7,17 +7,16 @@ import { existsSync, readFileSync } from "node:fs";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 //#region src/resolve-platform-url.ts
-const DEFAULT_WEB_URL = "https://app.keystroke.ai";
+const DEFAULT_WEB_URL = "https://keystroke.ai";
 const DEFAULT_PLATFORM_URL = "https://api.keystroke.ai";
-const LOCAL_PLATFORM_URL = "http://localhost:3002";
 function webOriginFromUrl(webUrl) {
 	return originFromPublicUrl(webUrl, webUrl.replace(/\/+$/, ""));
 }
 /** Known web origins with a fixed platform API — undefined for custom/staging URLs. */
 function knownPlatformUrlForWebUrl(webUrl) {
 	const webOrigin = webOriginFromUrl(webUrl);
-	if (webOrigin === "http://localhost:3000" || webOrigin === "http://127.0.0.1:3000") return LOCAL_PLATFORM_URL;
-	if (webOrigin === "https://app.keystroke.ai") return DEFAULT_PLATFORM_URL;
+	if (webOrigin === "http://localhost:3000" || webOrigin === "http://127.0.0.1:3000") return LOCAL_PLATFORM_ORIGIN;
+	if (webOrigin === "https://keystroke.ai") return DEFAULT_PLATFORM_URL;
 }
 function resolvePlatformUrlForWebUrl(webUrl, options = {}) {
 	const explicit = options.platformUrl?.trim();
@@ -37,6 +36,7 @@ function getConfigDir(config) {
 function getEffectiveApiTarget(config) {
 	const explicit = config.get("apiTarget");
 	if (explicit === "local" || explicit === "platform") return explicit;
+	if (process.env.KEYSTROKE_API_KEY?.trim()) return "platform";
 	return "local";
 }
 function syncPlatformUrlWithWebUrl(config) {
@@ -49,10 +49,6 @@ function createCliConfig(cwd = getCliConfigDir()) {
 		projectName: "keystroke",
 		cwd,
 		schema: {
-			serverUrl: {
-				type: "string",
-				default: "http://localhost:3001"
-			},
 			webUrl: {
 				type: "string",
 				default: DEFAULT_WEB_URL
@@ -72,13 +68,13 @@ function createCliConfig(cwd = getCliConfigDir()) {
 	syncPlatformUrlWithWebUrl(config);
 	return config;
 }
-function getServerUrl(config) {
-	return config.get("serverUrl");
-}
 function getWebUrl(config) {
 	return config.get("webUrl");
 }
 function getPlatformUrl(config) {
+	const apiKey = process.env.KEYSTROKE_API_KEY?.trim();
+	const fromEnv = process.env.KEYSTROKE_PLATFORM_URL?.trim();
+	if (apiKey && fromEnv) return fromEnv.replace(/\/+$/, "");
 	return resolvePlatformUrlForWebUrl(getWebUrl(config), { fallback: config.get("platformUrl") });
 }
 //#endregion
@@ -168,6 +164,6 @@ function readCliVersion() {
 	return JSON.parse(readFileSync(packageJsonPath, "utf8")).version ?? "0.0.0";
 }
 //#endregion
-export { resolvePlatformUrlForWebUrl as _, installPlaygroundDependencies as a, createCliConfig as c, getEffectiveApiTarget as d, getPlatformUrl as f, DEFAULT_WEB_URL as g, DEFAULT_PLATFORM_URL as h, installDependencies as i, getCliConfigDir as l, getWebUrl as m, buildPlaygroundWorkspace as n, resolvePackageManager as o, getServerUrl as p, detectPackageManager as r, resolveCliRoot as s, readCliVersion as t, getConfigDir as u };
+export { installPlaygroundDependencies as a, createCliConfig as c, getEffectiveApiTarget as d, getPlatformUrl as f, resolvePlatformUrlForWebUrl as g, DEFAULT_WEB_URL as h, installDependencies as i, getCliConfigDir as l, DEFAULT_PLATFORM_URL as m, buildPlaygroundWorkspace as n, resolvePackageManager as o, getWebUrl as p, detectPackageManager as r, resolveCliRoot as s, readCliVersion as t, getConfigDir as u };
 
-//# sourceMappingURL=version-Dxl3y5p6.mjs.map
+//# sourceMappingURL=version-CiPDVUdk.mjs.map

package/dist/version-CiPDVUdk.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-CiPDVUdk.mjs","names":[],"sources":["../src/resolve-platform-url.ts","../src/config.ts","../src/project/resolve-cli-root.ts","../src/init/package-manager.ts","../src/version.ts"],"sourcesContent":["import { LOCAL_PLATFORM_ORIGIN, originFromPublicUrl } from \"@keystrokehq/shared\";\n\nexport const DEFAULT_WEB_URL = \"https://keystroke.ai\";\nexport const DEFAULT_PLATFORM_URL = \"https://api.keystroke.ai\";\nexport const LOCAL_WEB_URL = \"http://localhost:3000\";\n\nexport type ResolvePlatformUrlOptions = {\n  platformUrl?: string;\n  /** Used when webUrl does not match a known deployment. */\n  fallback?: string;\n};\n\nfunction webOriginFromUrl(webUrl: string): string {\n  return originFromPublicUrl(webUrl, webUrl.replace(/\\/+$/, \"\"));\n}\n\n/** Known web origins with a fixed platform API — undefined for custom/staging URLs. */\nexport function knownPlatformUrlForWebUrl(webUrl: string): string | undefined {\n  const webOrigin = webOriginFromUrl(webUrl);\n\n  if (webOrigin === LOCAL_WEB_URL || webOrigin === \"http://127.0.0.1:3000\") {\n    return LOCAL_PLATFORM_ORIGIN;\n  }\n\n  if (webOrigin === DEFAULT_WEB_URL) {\n    return DEFAULT_PLATFORM_URL;\n  }\n\n  return undefined;\n}\n\nexport function resolvePlatformUrlForWebUrl(\n  webUrl: string,\n  options: ResolvePlatformUrlOptions = {},\n): string {\n  const explicit = options.platformUrl?.trim();\n  if (explicit) {\n    return explicit.replace(/\\/+$/, \"\");\n  }\n\n  const known = knownPlatformUrlForWebUrl(webUrl);\n  if (known) {\n    return known;\n  }\n\n  const fallback = options.fallback?.trim() || DEFAULT_PLATFORM_URL;\n  return fallback.replace(/\\/+$/, \"\");\n}\n","import Conf from \"conf\";\nimport { homedir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\n\nimport {\n  DEFAULT_PLATFORM_URL,\n  DEFAULT_WEB_URL,\n  knownPlatformUrlForWebUrl,\n  resolvePlatformUrlForWebUrl,\n} from \"./resolve-platform-url\";\n\nexport type ApiTargetMode = \"local\" | \"platform\";\n\nexport type CliConfig = {\n  webUrl: string;\n  platformUrl: string;\n  activeOrganizationId?: string;\n  activeProjectId?: string;\n  apiTarget?: ApiTargetMode;\n};\n\nexport function getCliConfigDir(cwd = join(homedir(), \".keystroke\")): string {\n  return cwd;\n}\n\nexport function getConfigDir(config: Conf<CliConfig>): string {\n  return dirname(config.path);\n}\n\nexport function getEffectiveApiTarget(config: Conf<CliConfig>): ApiTargetMode {\n  const explicit = config.get(\"apiTarget\");\n  if (explicit === \"local\" || explicit === \"platform\") {\n    return explicit;\n  }\n\n  if (process.env.KEYSTROKE_API_KEY?.trim()) {\n    return \"platform\";\n  }\n\n  return \"local\";\n}\n\nfunction syncPlatformUrlWithWebUrl(config: Conf<CliConfig>): void {\n  const webUrl = config.get(\"webUrl\");\n  const known = knownPlatformUrlForWebUrl(webUrl);\n  if (!known) {\n    return;\n  }\n\n  const stored = config.get(\"platformUrl\");\n  if (stored !== known) {\n    config.set(\"platformUrl\", known);\n  }\n}\n\nexport function createCliConfig(cwd = getCliConfigDir()): Conf<CliConfig> {\n  const config = new Conf<CliConfig>({\n    projectName: \"keystroke\",\n    cwd,\n    schema: {\n      webUrl: {\n        type: \"string\",\n        default: DEFAULT_WEB_URL,\n      },\n      platformUrl: {\n        type: \"string\",\n        default: DEFAULT_PLATFORM_URL,\n      },\n      activeOrganizationId: {\n        type: \"string\",\n      },\n      activeProjectId: {\n        type: \"string\",\n      },\n      apiTarget: {\n        type: \"string\",\n        enum: [\"local\", \"platform\"],\n      },\n    },\n  });\n\n  syncPlatformUrlWithWebUrl(config);\n  return config;\n}\n\nexport function getWebUrl(config: Conf<CliConfig>): string {\n  return config.get(\"webUrl\");\n}\n\nexport function getPlatformUrl(config: Conf<CliConfig>): string {\n  const apiKey = process.env.KEYSTROKE_API_KEY?.trim();\n  const fromEnv = process.env.KEYSTROKE_PLATFORM_URL?.trim();\n  if (apiKey && fromEnv) {\n    return fromEnv.replace(/\\/+$/, \"\");\n  }\n  return resolvePlatformUrlForWebUrl(getWebUrl(config), {\n    fallback: config.get(\"platformUrl\"),\n  });\n}\n","import { existsSync, readFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\nfunction isCliPackage(dir: string): boolean {\n  const packageJsonPath = join(dir, \"package.json\");\n  if (!existsSync(packageJsonPath)) {\n    return false;\n  }\n\n  const pkg = JSON.parse(readFileSync(packageJsonPath, \"utf8\")) as { name?: string };\n  return pkg.name === \"@keystrokehq/cli\";\n}\n\nexport function resolveCliRoot(fromModuleUrl: string): string {\n  let dir = dirname(fileURLToPath(fromModuleUrl));\n\n  while (dir !== dirname(dir)) {\n    if (isCliPackage(dir)) {\n      return dir;\n    }\n\n    dir = dirname(dir);\n  }\n\n  throw new Error(\"Could not resolve keystroke CLI package root\");\n}\n","import { spawnSync } from \"node:child_process\";\n\nexport type PackageManager = \"npm\" | \"pnpm\" | \"yarn\" | \"bun\";\n\nconst MANAGERS: PackageManager[] = [\"pnpm\", \"npm\", \"yarn\", \"bun\"];\n\nexport function detectPackageManager(): PackageManager {\n  const userAgent = process.env.npm_config_user_agent ?? \"\";\n\n  for (const manager of MANAGERS) {\n    if (userAgent.startsWith(manager)) {\n      return manager;\n    }\n  }\n\n  if (process.env.PNPM_HOME) {\n    return \"pnpm\";\n  }\n\n  return \"npm\";\n}\n\nexport function resolvePackageManager(explicit?: string): PackageManager {\n  if (!explicit) {\n    return detectPackageManager();\n  }\n\n  const normalized = explicit.trim().toLowerCase();\n  if (!MANAGERS.includes(normalized as PackageManager)) {\n    throw new Error(`Unsupported package manager \"${explicit}\". Use npm, pnpm, yarn, or bun.`);\n  }\n\n  return normalized as PackageManager;\n}\n\n/** Resolve GitHub Packages auth for @keystrokehq/* when NODE_AUTH_TOKEN is unset. */\nexport function resolveGithubPackagesToken(): string | undefined {\n  if (process.env.NODE_AUTH_TOKEN) {\n    return process.env.NODE_AUTH_TOKEN;\n  }\n\n  for (const key of [\"GITHUB_TOKEN\", \"GH_TOKEN\"] as const) {\n    const value = process.env[key];\n    if (value) {\n      return value;\n    }\n  }\n\n  const gh = spawnSync(\"gh\", [\"auth\", \"token\"], { encoding: \"utf8\" });\n  if (gh.status === 0) {\n    const token = gh.stdout.trim();\n    if (token) {\n      return token;\n    }\n  }\n\n  return undefined;\n}\n\nexport function installDependencies(cwd: string, manager: PackageManager): void {\n  const token = resolveGithubPackagesToken();\n  const env = token ? { ...process.env, NODE_AUTH_TOKEN: token } : process.env;\n\n  const result = spawnSync(manager, [\"install\"], {\n    cwd,\n    stdio: \"inherit\",\n    env,\n  });\n\n  if (result.status !== 0) {\n    throw new Error(`${manager} install failed`);\n  }\n}\n\nexport function installPlaygroundDependencies(cwd: string): void {\n  const result = spawnSync(\"pnpm\", [\"install\", \"--ignore-workspace\"], {\n    cwd,\n    stdio: \"inherit\",\n    env: process.env,\n  });\n\n  if (result.status !== 0) {\n    throw new Error(\"pnpm install failed\");\n  }\n}\n\n/**\n * Build every workspace package so the playground's `link:` deps resolve to\n * compiled `dist/`. Without this, `keystroke dev` fails with\n * `ERR_MODULE_NOT_FOUND` against whichever package was never built. Turbo\n * caches, so this is only slow on the first run.\n */\nexport function buildPlaygroundWorkspace(monorepoRoot: string): void {\n  // Build with a clean Node env: the `keystroke-dev` wrapper sets\n  // NODE_OPTIONS=--conditions=development, which would make tsdown/turbo resolve\n  // their own deps to src/ and fail. Dropping NODE_OPTIONS builds to dist/ normally.\n  const { NODE_OPTIONS: _drop, ...buildEnv } = process.env;\n  const result = spawnSync(\"pnpm\", [\"run\", \"build\"], {\n    cwd: monorepoRoot,\n    stdio: \"inherit\",\n    env: buildEnv,\n  });\n\n  if (result.status !== 0) {\n    throw new Error(\"workspace build failed (pnpm run build)\");\n  }\n}\n","import { readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { resolveCliRoot } from \"./project/resolve-cli-root\";\n\nexport function readCliVersion(): string {\n  const packageJsonPath = join(resolveCliRoot(import.meta.url), \"package.json\");\n  const pkg = JSON.parse(readFileSync(packageJsonPath, \"utf8\")) as { version?: string };\n  return pkg.version ?? \"0.0.0\";\n}\n"],"mappings":";;;;;;;;;AAEA,MAAa,kBAAkB;AAC/B,MAAa,uBAAuB;AASpC,SAAS,iBAAiB,QAAwB;CAChD,OAAO,oBAAoB,QAAQ,OAAO,QAAQ,QAAQ,EAAE,CAAC;AAC/D;;AAGA,SAAgB,0BAA0B,QAAoC;CAC5E,MAAM,YAAY,iBAAiB,MAAM;CAEzC,IAAI,cAAA,2BAA+B,cAAc,yBAC/C,OAAO;CAGT,IAAI,cAAA,wBACF,OAAO;AAIX;AAEA,SAAgB,4BACd,QACA,UAAqC,CAAC,GAC9B;CACR,MAAM,WAAW,QAAQ,aAAa,KAAK;CAC3C,IAAI,UACF,OAAO,SAAS,QAAQ,QAAQ,EAAE;CAGpC,MAAM,QAAQ,0BAA0B,MAAM;CAC9C,IAAI,OACF,OAAO;CAIT,QADiB,QAAQ,UAAU,KAAK,KAAA,4BACxB,QAAQ,QAAQ,EAAE;AACpC;;;AC1BA,SAAgB,gBAAgB,MAAM,KAAK,QAAQ,GAAG,YAAY,GAAW;CAC3E,OAAO;AACT;AAEA,SAAgB,aAAa,QAAiC;CAC5D,OAAO,QAAQ,OAAO,IAAI;AAC5B;AAEA,SAAgB,sBAAsB,QAAwC;CAC5E,MAAM,WAAW,OAAO,IAAI,WAAW;CACvC,IAAI,aAAa,WAAW,aAAa,YACvC,OAAO;CAGT,IAAI,QAAQ,IAAI,mBAAmB,KAAK,GACtC,OAAO;CAGT,OAAO;AACT;AAEA,SAAS,0BAA0B,QAA+B;CAEhE,MAAM,QAAQ,0BADC,OAAO,IAAI,QACmB,CAAC;CAC9C,IAAI,CAAC,OACH;CAIF,IADe,OAAO,IAAI,aACjB,MAAM,OACb,OAAO,IAAI,eAAe,KAAK;AAEnC;AAEA,SAAgB,gBAAgB,MAAM,gBAAgB,GAAoB;CACxE,MAAM,SAAS,IAAI,KAAgB;EACjC,aAAa;EACb;EACA,QAAQ;GACN,QAAQ;IACN,MAAM;IACN,SAAS;GACX;GACA,aAAa;IACX,MAAM;IACN,SAAS;GACX;GACA,sBAAsB,EACpB,MAAM,SACR;GACA,iBAAiB,EACf,MAAM,SACR;GACA,WAAW;IACT,MAAM;IACN,MAAM,CAAC,SAAS,UAAU;GAC5B;EACF;CACF,CAAC;CAED,0BAA0B,MAAM;CAChC,OAAO;AACT;AAEA,SAAgB,UAAU,QAAiC;CACzD,OAAO,OAAO,IAAI,QAAQ;AAC5B;AAEA,SAAgB,eAAe,QAAiC;CAC9D,MAAM,SAAS,QAAQ,IAAI,mBAAmB,KAAK;CACnD,MAAM,UAAU,QAAQ,IAAI,wBAAwB,KAAK;CACzD,IAAI,UAAU,SACZ,OAAO,QAAQ,QAAQ,QAAQ,EAAE;CAEnC,OAAO,4BAA4B,UAAU,MAAM,GAAG,EACpD,UAAU,OAAO,IAAI,aAAa,EACpC,CAAC;AACH;;;AC9FA,SAAS,aAAa,KAAsB;CAC1C,MAAM,kBAAkB,KAAK,KAAK,cAAc;CAChD,IAAI,CAAC,WAAW,eAAe,GAC7B,OAAO;CAIT,OADY,KAAK,MAAM,aAAa,iBAAiB,MAAM,CAClD,EAAE,SAAS;AACtB;AAEA,SAAgB,eAAe,eAA+B;CAC5D,IAAI,MAAM,QAAQ,cAAc,aAAa,CAAC;CAE9C,OAAO,QAAQ,QAAQ,GAAG,GAAG;EAC3B,IAAI,aAAa,GAAG,GAClB,OAAO;EAGT,MAAM,QAAQ,GAAG;CACnB;CAEA,MAAM,IAAI,MAAM,8CAA8C;AAChE;;;ACtBA,MAAM,WAA6B;CAAC;CAAQ;CAAO;CAAQ;AAAK;AAEhE,SAAgB,uBAAuC;CACrD,MAAM,YAAY,QAAQ,IAAI,yBAAyB;CAEvD,KAAK,MAAM,WAAW,UACpB,IAAI,UAAU,WAAW,OAAO,GAC9B,OAAO;CAIX,IAAI,QAAQ,IAAI,WACd,OAAO;CAGT,OAAO;AACT;AAEA,SAAgB,sBAAsB,UAAmC;CACvE,IAAI,CAAC,UACH,OAAO,qBAAqB;CAG9B,MAAM,aAAa,SAAS,KAAK,EAAE,YAAY;CAC/C,IAAI,CAAC,SAAS,SAAS,UAA4B,GACjD,MAAM,IAAI,MAAM,gCAAgC,SAAS,gCAAgC;CAG3F,OAAO;AACT;;AAGA,SAAgB,6BAAiD;CAC/D,IAAI,QAAQ,IAAI,iBACd,OAAO,QAAQ,IAAI;CAGrB,KAAK,MAAM,OAAO,CAAC,gBAAgB,UAAU,GAAY;EACvD,MAAM,QAAQ,QAAQ,IAAI;EAC1B,IAAI,OACF,OAAO;CAEX;CAEA,MAAM,KAAK,UAAU,MAAM,CAAC,QAAQ,OAAO,GAAG,EAAE,UAAU,OAAO,CAAC;CAClE,IAAI,GAAG,WAAW,GAAG;EACnB,MAAM,QAAQ,GAAG,OAAO,KAAK;EAC7B,IAAI,OACF,OAAO;CAEX;AAGF;AAEA,SAAgB,oBAAoB,KAAa,SAA+B;CAC9E,MAAM,QAAQ,2BAA2B;CASzC,IANe,UAAU,SAAS,CAAC,SAAS,GAAG;EAC7C;EACA,OAAO;EACP,KALU,QAAQ;GAAE,GAAG,QAAQ;GAAK,iBAAiB;EAAM,IAAI,QAAQ;CAMzE,CAES,EAAE,WAAW,GACpB,MAAM,IAAI,MAAM,GAAG,QAAQ,gBAAgB;AAE/C;AAEA,SAAgB,8BAA8B,KAAmB;CAO/D,IANe,UAAU,QAAQ,CAAC,WAAW,oBAAoB,GAAG;EAClE;EACA,OAAO;EACP,KAAK,QAAQ;CACf,CAES,EAAE,WAAW,GACpB,MAAM,IAAI,MAAM,qBAAqB;AAEzC;;;;;;;AAQA,SAAgB,yBAAyB,cAA4B;CAInE,MAAM,EAAE,cAAc,OAAO,GAAG,aAAa,QAAQ;CAOrD,IANe,UAAU,QAAQ,CAAC,OAAO,OAAO,GAAG;EACjD,KAAK;EACL,OAAO;EACP,KAAK;CACP,CAES,EAAE,WAAW,GACpB,MAAM,IAAI,MAAM,yCAAyC;AAE7D;;;ACtGA,SAAgB,iBAAyB;CACvC,MAAM,kBAAkB,KAAK,eAAe,OAAO,KAAK,GAAG,GAAG,cAAc;CAE5E,OADY,KAAK,MAAM,aAAa,iBAAiB,MAAM,CAClD,EAAE,WAAW;AACxB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@keystrokehq/cli",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/keystrokehq/keystroke.git",
@@ -19,17 +19,22 @@
     "registry": "https://registry.npmjs.org"
   },
   "dependencies": {
+    "@aws-sdk/client-s3": "^3.1070.0",
+    "@aws-sdk/s3-request-presigner": "^3.1070.0",
     "@inquirer/prompts": "^8.4.3",
     "@napi-rs/keyring": "^1.3.0",
-    "better-sqlite3": "^12.0.0",
+    "@parcel/watcher": "^2.5.6",
+    "better-sqlite3": "^12.10.0",
     "commander": "^14.0.3",
     "conf": "^15.1.0",
+    "drizzle-orm": "^0.45.2",
     "picomatch": "^4.0.4",
     "tsdown": "^0.22.0"
   },
   "devDependencies": {
     "@types/node": "^25.9.1",
     "better-auth": "^1.6.11",
+    "es-module-lexer": "^2.1.0",
     "oxlint": "^1.66.0",
     "tsdown": "^0.22.0",
     "tsx": "^4.22.3",
@@ -44,6 +49,7 @@
     "build": "tsx scripts/generate-catalog-versions.ts && tsdown && node scripts/copy-templates.mjs && node scripts/copy-skills-bundle.mjs",
     "generate:catalog-versions": "tsx scripts/generate-catalog-versions.ts",
     "pack:portable": "node scripts/pack.mjs",
+    "verify:package": "node scripts/verify-package.mjs",
     "link-dev": "bash scripts/link-dev.sh",
     "dev": "tsx src/index.ts",
     "lint": "oxlint .",