@keystrokehq/cli 0.1.4 → 0.1.6

package/dist/index.mjs

@@ -1,16 +1,17 @@
 #!/usr/bin/env node
-import { $ as ListProjectsResponseSchema, A as DownloadActiveProjectArtifactResponseSchema, At as TriggerRunListResponseSchema, B as InviteOrganizationMembersResponseSchema, Bt as UpdateProjectSettingsRequestSchema, C as CreateOrganizationResponseSchema, Ct as StartOAuthConnectionInputSchema, D as CredentialInstanceListResponseSchema, Dt as TriggerDetailResponseSchema, E as CreateProjectResponseSchema, Et as SubmitTeamRequestRequestSchema, F as HistoryRunCancelResponseSchema, Ft as UpdateOrganizationMemberResponseSchema, G as ListCredentialsResponseSchema, Gt as UserAvatarSchema, H as InviteProjectMembersResponseSchema, Ht as UploadProjectSourceResponseSchema, I as HistoryRunDetailResponseSchema, It as UpdateOrganizationRequestSchema, J as ListOrganizationsResponseSchema, Jt as WorkflowRunDetailResponseSchema, K as ListOrganizationInvitationsResponseSchema, Kt as UserPreferencesPatchSchema, L as HistoryRunListQuerySchema, Lt as UpdateProjectMemberRequestSchema, M as GatewayAttachmentRecordSchema, Mt as UpdateCredentialInstanceBodySchema, N as GetCredentialResponseSchema, Nt as UpdateCredentialRequestSchema, O as CredentialInstanceRecordSchema, Ot as TriggerListResponseSchema, P as HealthResponseSchema, Pt as UpdateOrganizationMemberRequestSchema, Q as ListProjectMetricsResponseSchema, Qt as listenPortFromPublicUrl, R as HistoryRunListResponseSchema, Rt as UpdateProjectMemberResponseSchema, S as CreateOrganizationRequestSchema, St as SlugAvailabilityResponseSchema, T as CreateProjectRequestSchema, Tt as StoredRouteManifestSchema, U as ListApiKeysResponseSchema, Ut as UpsertGatewayAttachmentBodySchema, V as InviteProjectMembersRequestSchema, Vt as UploadProjectSourceManifestRequestSchema, W as ListAppsResponseSchema, Wt as UserAvatarPatchSchema, X as ListProjectFilesResponseSchema, Xt as WorkflowSummaryDetailResponseSchema, Y as ListProjectDeploymentsResponseSchema, Yt as WorkflowRunListResponseSchema, Z as ListProjectMembersResponseSchema, Zt as WorkflowSummaryListResponseSchema, _ as CreateApiKeyRequestSchema, _t as QueuedRunResponseSchema, a as AgentSessionListResponseSchema, at as PresignOrgLogoResponseSchema, b as CreateCredentialsRequestSchema, bt as SkillSummaryDetailResponseSchema, c as BindChannelBodySchema, ct as PresignUserAvatarRequestSchema, d as ChannelConnectionSchema, dt as ProjectResponseSchema, et as OrganizationSidebarBrandingPatchSchema, f as ChannelDirectoryListResponseSchema, ft as ProjectSettingsResponseSchema, g as ConnectProvidersResponseSchema, gt as QueuedAgentPromptResponseSchema, h as ConnectAuthorizeUrlResponseSchema, ht as PromptResponseSchema, i as AgentSessionDetailResponseSchema, it as PresignOrgLogoRequestSchema, j as ErrorResponseSchema, jt as UpdateChannelBindingBodySchema, k as DeclineOrganizationInvitationResponseSchema, kt as TriggerRunDetailResponseSchema, l as ChannelAccountListResponseSchema, lt as PresignUserAvatarResponseSchema, m as CompleteProjectArtifactResponseSchema, mt as PromptInputSchema, n as AcceptOrganizationInvitationResponseSchema, nt as PROJECT_REACHABILITY_REQUEST_TIMEOUT_MS, o as AgentSummaryDetailResponseSchema, ot as PresignProjectSourceRequestSchema, p as ChannelPlatformSchema, pt as ProjectSlugAvailabilityResponseSchema, q as ListOrganizationMembersResponseSchema, qt as UserPreferencesSchema, r as ActiveOrganizationResponseSchema, rt as PollRunResponseSchema, s as AgentSummaryListResponseSchema, st as PresignProjectSourceResponseSchema, t as ACTIVE_ORG_HEADER, tn as parseErrorResponse, tt as OrganizationSidebarBrandingSchema, u as ChannelConnectionListResponseSchema, ut as ProjectReachabilityResponseSchema, v as CreateApiKeyResponseSchema, vt as ROUTE_MANIFEST_REL_PATH, w as CreateProjectArtifactResponseSchema, wt as StartOAuthConnectionResultSchema, x as CreateCredentialsResponseSchema, xt as SkillSummaryListResponseSchema, y as CreateCredentialInstanceBodySchema, yt as RecentResourceListResponseSchema, z as InviteOrganizationMembersRequestSchema, zt as UpdateProjectRequestSchema } from "./dist-C47GdlWY.mjs";
-import { _ as resolvePlatformUrlForWebUrl, a as installPlaygroundDependencies, c as createCliConfig, d as getEffectiveApiTarget, f as getPlatformUrl, h as DEFAULT_PLATFORM_URL, i as installDependencies, l as getCliConfigDir, m as getWebUrl, n as buildPlaygroundWorkspace, o as resolvePackageManager, p as getServerUrl, s as resolveCliRoot, t as readCliVersion, u as getConfigDir } from "./version-Dxl3y5p6.mjs";
+import { $ as HistoryRunListQuerySchema, $t as TriggerListResponseSchema, A as CreateCustomAppRequestSchema, An as listenPortFromPublicUrl, At as PresignUserAvatarResponseSchema, B as CredentialConsumerListQuerySchema, Bt as RecentResourceListResponseSchema, C as ConnectAuthorizeUrlResponseSchema, Cn as WorkspaceTriggerDetailSchema, Ct as PROJECT_REACHABILITY_REQUEST_TIMEOUT_MS, D as CreateCredentialInstanceBodySchema, Dn as WorkspaceTriggerRunListResponseSchema, Dt as PresignProjectSourceRequestSchema, E as CreateApiKeyResponseSchema, En as WorkspaceTriggerOverviewSchema, Et as PresignOrgLogoResponseSchema, F as CreateProjectRequestSchema, Ft as PromptInputSchema, G as DownloadActiveProjectArtifactResponseSchema, Gt as StartKeystrokeConnectionResultSchema, H as CredentialInstanceListResponseSchema, Ht as SkillSummaryListResponseSchema, I as CreateProjectResponseSchema, In as resolvePublicPlatformOrigin, It as PromptResponseSchema, J as GetCredentialResponseSchema, Jt as StartOAuthConnectionInputSchema, K as ErrorResponseSchema, Kt as StartMcpOAuthConnectionInputSchema, L as CredentialAssignmentListQuerySchema, Ln as slugifyAppName, Lt as QueuedAgentPromptResponseSchema, M as CreateOrganizationRequestSchema, Mt as ProjectResponseSchema, N as CreateOrganizationResponseSchema, Nn as parseAppSlug, Nt as ProjectSettingsResponseSchema, O as CreateCredentialsRequestSchema, On as buildConnectDeeplink, Ot as PresignProjectSourceResponseSchema, P as CreateProjectArtifactResponseSchema, Pn as parseErrorResponse, Pt as ProjectSlugAvailabilityResponseSchema, Q as HistoryRunDetailResponseSchema, Qt as TriggerDetailResponseSchema, R as CredentialAssignmentListResponseSchema, Rt as QueuedRunResponseSchema, S as CompleteProjectArtifactResponseSchema, Sn as WorkflowSummaryListResponseSchema, St as OrganizationSidebarBrandingSchema, T as CreateApiKeyRequestSchema, Tn as WorkspaceTriggerListResponseSchema, Tt as PresignOrgLogoRequestSchema, U as CredentialInstanceRecordSchema, Ut as SlugAvailabilityResponseSchema, V as CredentialConsumerListResponseSchema, Vt as SkillSummaryDetailResponseSchema, W as DeclineOrganizationInvitationResponseSchema, Wt as StartKeystrokeConnectionInputSchema, X as HealthResponseSchema, Xt as SubmitMarketingContactRequestSchema, Y as GetCustomAppResponseSchema, Yt as StartOAuthConnectionResultSchema, Z as HistoryRunCancelResponseSchema, Zt as SubmitTeamRequestRequestSchema, _ as ChannelAccountListResponseSchema, _n as UserPreferencesPatchSchema, _t as ListProjectMetricsResponseSchema, a as AgentSessionDetailResponseSchema, an as UpdateOrganizationMemberRequestSchema, b as ChannelDirectoryListResponseSchema, bn as WorkflowRunListResponseSchema, bt as OpenApiDiscoverResponseSchema, c as AgentSummaryListResponseSchema, cn as UpdateProjectMemberRequestSchema, ct as ListApiKeysResponseSchema, d as AssignCredentialBodySchema, dn as UpdateProjectSettingsRequestSchema, dt as ListOrganizationInvitationsResponseSchema, en as TriggerRunDetailResponseSchema, et as HistoryRunListResponseSchema, f as BindChannelBodySchema, fn as UploadProjectSourceManifestRequestSchema, ft as ListOrganizationMembersResponseSchema, g as CatalogAppsPageResponseSchema, gn as UserAvatarSchema, gt as ListProjectMembersResponseSchema, h as CatalogAppDetailResponseSchema, hn as UserAvatarPatchSchema, ht as ListProjectFilesResponseSchema, i as AgentSessionChatStateResponseSchema, in as UpdateCredentialRequestSchema, it as InviteProjectMembersResponseSchema, j as CreateCustomAppResponseSchema, jt as ProjectReachabilityResponseSchema, k as CreateCredentialsResponseSchema, kt as PresignUserAvatarRequestSchema, l as AgentTriggerSummaryListResponseSchema, ln as UpdateProjectMemberResponseSchema, lt as ListAppsResponseSchema, m as CatalogActionsPageResponseSchema, mn as UpsertGatewayAttachmentBodySchema, mt as ListProjectDeploymentsResponseSchema, n as AcceptOrganizationInvitationResponseSchema, nn as UpdateChannelBindingBodySchema, nt as InviteOrganizationMembersResponseSchema, o as AgentSessionListResponseSchema, on as UpdateOrganizationMemberResponseSchema, ot as ListAgentMemoryFilesResponseSchema, p as CatalogActionDetailResponseSchema, pn as UploadProjectSourceResponseSchema, pt as ListOrganizationsResponseSchema, q as GatewayAttachmentRecordSchema, qt as StartMcpOAuthConnectionResultSchema, r as ActiveOrganizationResponseSchema, rn as UpdateCredentialInstanceBodySchema, rt as InviteProjectMembersRequestSchema, s as AgentSummaryDetailResponseSchema, sn as UpdateOrganizationRequestSchema, st as ListAgentWorkspaceFilesResponseSchema, t as ACTIVE_ORG_HEADER, tn as TriggerRunListResponseSchema, tt as InviteOrganizationMembersRequestSchema, u as AppSlugAvailabilityResponseSchema, un as UpdateProjectRequestSchema, ut as ListCredentialsResponseSchema, v as ChannelConnectionListResponseSchema, vn as UserPreferencesSchema, vt as ListProjectsResponseSchema, w as ConnectProvidersResponseSchema, wn as WorkspaceTriggerFileSchema, wt as PollRunResponseSchema, x as ChannelPlatformSchema, xn as WorkflowSummaryDetailResponseSchema, xt as OrganizationSidebarBrandingPatchSchema, y as ChannelConnectionSchema, yn as WorkflowRunDetailResponseSchema, yt as McpDiscoverResponseSchema, z as CredentialAssignmentRecordSchema } from "./dist-H53GUsol.mjs";
+import { a as installPlaygroundDependencies, c as createCliConfig, d as getEffectiveApiTarget, f as getPlatformUrl, g as resolvePlatformUrlForWebUrl, i as installDependencies, l as getCliConfigDir, m as DEFAULT_PLATFORM_URL, n as buildPlaygroundWorkspace, o as resolvePackageManager, p as getWebUrl, s as resolveCliRoot, t as readCliVersion, u as getConfigDir } from "./version-CiPDVUdk.mjs";
+import { n as packProjectArtifact, t as mergeFilteredArtifact } from "./pack-artifact-DVnIKrsg-CETr40a-.mjs";
 import { createRequire } from "node:module";
 import { Command } from "commander";
-import { platform, tmpdir } from "node:os";
+import { platform } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { Entry } from "@napi-rs/keyring";
 import { confirm, input, select } from "@inquirer/prompts";
-import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
+import { existsSync, lstatSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { access, copyFile, cp, lstat, mkdir, readFile, readdir, rm, stat, symlink, unlink, writeFile } from "node:fs/promises";
 import { spawn, spawnSync } from "node:child_process";
 import { pathToFileURL } from "node:url";
-import { access, copyFile, cp, lstat, mkdir, readFile, readdir, rm, stat, symlink, unlink, writeFile } from "node:fs/promises";
 //#region ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/errors/KyError.js
 /**
 Base class for all Ky-specific errors. `HTTPError`, `NetworkError`, `TimeoutError`, and `ForceRetryError` extend this class.
@@ -1433,6 +1434,40 @@ function createCredentialsResource$1(http) {
 			} catch (error) {
 				throw await toKeystrokeError(error);
 			}
+		},
+		async listAssignments(query) {
+			try {
+				const params = CredentialAssignmentListQuerySchema.parse(query);
+				const data = await http.get("credentials/assignments", { searchParams: params }).json();
+				return CredentialAssignmentListResponseSchema.parse(data);
+			} catch (error) {
+				throw await toKeystrokeError(error);
+			}
+		},
+		async assignCredential(body) {
+			try {
+				const payload = AssignCredentialBodySchema.parse(body);
+				const data = await http.put("credentials/assignments", { json: payload }).json();
+				return CredentialAssignmentRecordSchema.parse(data);
+			} catch (error) {
+				throw await toKeystrokeError(error);
+			}
+		},
+		async unassignCredential(id) {
+			try {
+				await http.delete(`credentials/assignments/${id}`);
+			} catch (error) {
+				throw await toKeystrokeError(error);
+			}
+		},
+		async listConsumers(query) {
+			try {
+				const params = CredentialConsumerListQuerySchema.parse(query);
+				const data = await http.get("credentials/consumers", { searchParams: params }).json();
+				return CredentialConsumerListResponseSchema.parse(data);
+			} catch (error) {
+				throw await toKeystrokeError(error);
+			}
 		}
 	};
 }
@@ -1474,7 +1509,7 @@ function detailSearchParams$1(query) {
 	if (!query?.include) return {};
 	return { include: query.include };
 }
-function createTriggersResource(http) {
+function createTriggersResource$1(http) {
 	return {
 		async list(query) {
 			try {
@@ -1552,7 +1587,7 @@ function createTriggersResource(http) {
 function isQueuedRunResponse(value) {
 	return QueuedRunResponseSchema.safeParse(value).success;
 }
-function listRunsSearchParams(query) {
+function listRunsSearchParams$2(query) {
 	if (!query) return {};
 	const params = {};
 	if (query.limit !== void 0) params.limit = String(query.limit);
@@ -1579,7 +1614,7 @@ function createWorkflowsResource$1(http) {
 		},
 		async listRuns(workflowId, query) {
 			try {
-				const data = await http.get(`workflows/${workflowId}/runs`, { searchParams: listRunsSearchParams(query) }).json();
+				const data = await http.get(`workflows/${workflowId}/runs`, { searchParams: listRunsSearchParams$2(query) }).json();
 				return WorkflowRunListResponseSchema.parse(data);
 			} catch (error) {
 				throw await toKeystrokeError(error);
@@ -1616,7 +1651,7 @@ function createKeystrokeClient(options) {
 		openapi: createOpenApiResource(http),
 		agents: createAgentsResource$1(http),
 		workflows: createWorkflowsResource$1(http),
-		triggers: createTriggersResource(http)
+		triggers: createTriggersResource$1(http)
 	};
 }
 //#endregion
@@ -1700,7 +1735,7 @@ function createJwtTokenCache(mint) {
 	};
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._648f7a3b727ed48c95c8caf5024eaef9/node_modules/better-auth/dist/version.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._775c78039924a67af81d79c1d7be3379/node_modules/better-auth/dist/version.mjs
 const PACKAGE_VERSION = "1.6.11";
 //#endregion
 //#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.4.3/node_modules/better-call/dist/error.mjs
@@ -1825,7 +1860,7 @@ var BetterAuthError = class extends Error {
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._648f7a3b727ed48c95c8caf5024eaef9/node_modules/better-auth/dist/plugins/device-authorization/client.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._775c78039924a67af81d79c1d7be3379/node_modules/better-auth/dist/plugins/device-authorization/client.mjs
 const deviceAuthorizationClient = () => {
 	return {
 		id: "device-authorization",
@@ -1970,7 +2005,7 @@ let onMount = ($store, initialize) => {
 	});
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._648f7a3b727ed48c95c8caf5024eaef9/node_modules/better-auth/dist/client/query.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._775c78039924a67af81d79c1d7be3379/node_modules/better-auth/dist/client/query.mjs
 const isServer = () => typeof window === "undefined";
 const useAuthQuery = (initializedAtom, path, $fetch, options) => {
 	const value = /* @__PURE__ */ atom({
@@ -2064,7 +2099,7 @@ const useAuthQuery = (initializedAtom, path, $fetch, options) => {
 	return value;
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._648f7a3b727ed48c95c8caf5024eaef9/node_modules/better-auth/dist/client/broadcast-channel.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._775c78039924a67af81d79c1d7be3379/node_modules/better-auth/dist/client/broadcast-channel.mjs
 const kBroadcastChannel = Symbol.for("better-auth:broadcast-channel");
 const now$1 = () => Math.floor(Date.now() / 1e3);
 var WindowBroadcastChannel = class {
@@ -2107,7 +2142,7 @@ function getGlobalBroadcastChannel(name = "better-auth.message") {
 	return globalThis[kBroadcastChannel];
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._648f7a3b727ed48c95c8caf5024eaef9/node_modules/better-auth/dist/client/focus-manager.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._775c78039924a67af81d79c1d7be3379/node_modules/better-auth/dist/client/focus-manager.mjs
 const kFocusManager = Symbol.for("better-auth:focus-manager");
 var WindowFocusManager = class {
 	listeners = /* @__PURE__ */ new Set();
@@ -2136,7 +2171,7 @@ function getGlobalFocusManager() {
 	return globalThis[kFocusManager];
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._648f7a3b727ed48c95c8caf5024eaef9/node_modules/better-auth/dist/client/online-manager.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._775c78039924a67af81d79c1d7be3379/node_modules/better-auth/dist/client/online-manager.mjs
 const kOnlineManager = Symbol.for("better-auth:online-manager");
 var WindowOnlineManager = class {
 	listeners = /* @__PURE__ */ new Set();
@@ -2168,7 +2203,7 @@ function getGlobalOnlineManager() {
 	return globalThis[kOnlineManager];
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._648f7a3b727ed48c95c8caf5024eaef9/node_modules/better-auth/dist/client/parser.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._775c78039924a67af81d79c1d7be3379/node_modules/better-auth/dist/client/parser.mjs
 const PROTO_POLLUTION_PATTERNS = {
 	proto: /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/,
 	constructor: /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/,
@@ -2238,7 +2273,7 @@ function parseJSON(value, options = { strict: true }) {
 	return betterJSONParse(value, options);
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._648f7a3b727ed48c95c8caf5024eaef9/node_modules/better-auth/dist/client/session-refresh.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._775c78039924a67af81d79c1d7be3379/node_modules/better-auth/dist/client/session-refresh.mjs
 const now = () => Math.floor(Date.now() / 1e3);
 /**
 * Normalize $fetch response: `throw: true` returns data directly, otherwise `{ data, error }`.
@@ -2436,7 +2471,7 @@ Object.freeze({
 	}
 });
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._648f7a3b727ed48c95c8caf5024eaef9/node_modules/better-auth/dist/utils/url.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._775c78039924a67af81d79c1d7be3379/node_modules/better-auth/dist/utils/url.mjs
 function checkHasPath(url) {
 	try {
 		return (new URL(url).pathname.replace(/\/+$/, "") || "/") !== "/";
@@ -2508,7 +2543,7 @@ function getOrigin(url) {
 	}
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._648f7a3b727ed48c95c8caf5024eaef9/node_modules/better-auth/dist/client/fetch-plugins.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._775c78039924a67af81d79c1d7be3379/node_modules/better-auth/dist/client/fetch-plugins.mjs
 const redirectPlugin = {
 	id: "redirect",
 	name: "Redirect",
@@ -2523,7 +2558,7 @@ const redirectPlugin = {
 	} }
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._648f7a3b727ed48c95c8caf5024eaef9/node_modules/better-auth/dist/client/session-atom.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._775c78039924a67af81d79c1d7be3379/node_modules/better-auth/dist/client/session-atom.mjs
 function getSessionAtom($fetch, options) {
 	const $signal = /* @__PURE__ */ atom(false);
 	const session = useAuthQuery($signal, "/get-session", $fetch, { method: "GET" });
@@ -3010,7 +3045,7 @@ var betterFetch = async (url, options) => {
 	};
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._648f7a3b727ed48c95c8caf5024eaef9/node_modules/better-auth/dist/client/config.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._775c78039924a67af81d79c1d7be3379/node_modules/better-auth/dist/client/config.mjs
 const resolvePublicAuthUrl = (basePath) => {
 	if (typeof process === "undefined") return void 0;
 	const path = basePath ?? "/api/auth";
@@ -3108,12 +3143,12 @@ const getClientConfig = (options, loadEnv) => {
 	};
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._648f7a3b727ed48c95c8caf5024eaef9/node_modules/better-auth/dist/utils/is-atom.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._775c78039924a67af81d79c1d7be3379/node_modules/better-auth/dist/utils/is-atom.mjs
 function isAtom(value) {
 	return typeof value === "object" && value !== null && "get" in value && typeof value.get === "function" && "lc" in value && typeof value.lc === "number";
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._648f7a3b727ed48c95c8caf5024eaef9/node_modules/better-auth/dist/client/proxy.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._775c78039924a67af81d79c1d7be3379/node_modules/better-auth/dist/client/proxy.mjs
 function getMethod(path, knownPathMethods, args) {
 	const method = knownPathMethods[path];
 	const { fetchOptions, query: _query, ...body } = args || {};
@@ -3193,7 +3228,7 @@ function capitalizeFirstLetter(str) {
 	return str.charAt(0).toUpperCase() + str.slice(1);
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._648f7a3b727ed48c95c8caf5024eaef9/node_modules/better-auth/dist/client/vanilla.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._775c78039924a67af81d79c1d7be3379/node_modules/better-auth/dist/client/vanilla.mjs
 function createAuthClient(options) {
 	const { pluginPathMethods, pluginsActions, pluginsAtoms, $fetch, atomListeners, $store } = getClientConfig(options);
 	const resolvedHooks = {};
@@ -3303,8 +3338,13 @@ async function getCliJwt(platformUrl, force = false) {
 }
 //#endregion
 //#region src/auth/resolve-cli-auth.ts
-/** Returns JWT bearer auth when a session refresh token is stored; otherwise none. */
+/** Returns API key, JWT bearer, or none auth for platform requests. */
 function resolveCliAuth(config) {
+	const apiKey = process.env.KEYSTROKE_API_KEY?.trim();
+	if (apiKey) return {
+		type: "apiKey",
+		getKey: () => apiKey
+	};
 	const platformUrl = getPlatformUrl(config);
 	if (!getAccessToken(platformUrl)) return { type: "none" };
 	return {
@@ -3351,6 +3391,7 @@ var PlatformError = class extends Error {
 	}
 };
 async function toPlatformError(error) {
+	if (error instanceof PlatformError) return error;
 	if (!isHTTPError(error)) return new PlatformError(error instanceof Error ? error.message : "Request failed", 0, null);
 	const status = error.response.status;
 	const body = error.data ?? null;
@@ -3421,7 +3462,7 @@ function createDeploymentsResource(http) {
 	return { async listForProject(projectId) {
 		try {
 			const data = await http.get(`/api/projects/${encodeURIComponent(projectId)}/deployments`).json();
-			return ListProjectDeploymentsResponseSchema.parse(data).deployments;
+			return ListProjectDeploymentsResponseSchema.parse(data);
 		} catch (error) {
 			throw await toPlatformError(error);
 		}
@@ -3474,7 +3515,7 @@ function createOrganizationsResource(http, options = {}) {
 	async function get(organizationId) {
 		try {
 			const data = await http.get(`/api/organizations/${organizationId}`).json();
-			const organization = ActiveOrganizationResponseSchema.parse(data).organization;
+			const organization = ActiveOrganizationResponseSchema.parse(data);
 			if (!organization) throw new Error("Organization was not returned");
 			return organization;
 		} catch (error) {
@@ -3487,7 +3528,7 @@ function createOrganizationsResource(http, options = {}) {
 		if (!organizationId) throw new Error("No active organization");
 		try {
 			const data = await http.patch(`/api/organizations/${organizationId}`, { json: body }).json();
-			const organization = ActiveOrganizationResponseSchema.parse(data).organization;
+			const organization = ActiveOrganizationResponseSchema.parse(data);
 			if (!organization) throw new Error("Active organization was not returned");
 			return organization;
 		} catch (error) {
@@ -3498,7 +3539,7 @@ function createOrganizationsResource(http, options = {}) {
 		async list() {
 			try {
 				const data = await http.get("/api/organizations").json();
-				return ListOrganizationsResponseSchema.parse(data).organizations;
+				return ListOrganizationsResponseSchema.parse(data);
 			} catch (error) {
 				throw await toPlatformError(error);
 			}
@@ -3530,7 +3571,7 @@ function createOrganizationsResource(http, options = {}) {
 			const body = CreateOrganizationRequestSchema.parse(input);
 			try {
 				const data = await http.post("/api/organizations", { json: body }).json();
-				return CreateOrganizationResponseSchema.parse(data).organization;
+				return CreateOrganizationResponseSchema.parse(data);
 			} catch (error) {
 				throw await toPlatformError(error);
 			}
@@ -3581,6 +3622,88 @@ function createAgentsResource(http) {
 			} catch (error) {
 				throw await toPlatformError(error);
 			}
+		},
+		/**
+		* Prompting goes through the project-scoped runtime route
+		* (`POST /api/projects/:projectId/agents/:slug`) so it reuses the runtime's
+		* `requireProject` + `requireProjectMembership` auth — a user must belong to
+		* the project to prompt its agents.
+		*/
+		async prompt(projectId, agentSlug, input) {
+			try {
+				const payload = PromptInputSchema.parse(input);
+				const data = await (await http.post(`api/projects/${encodeURIComponent(projectId)}/agents/${encodeURIComponent(agentSlug)}`, { json: payload })).json();
+				return QueuedAgentPromptResponseSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async getSessionState(projectId, sessionId, options) {
+			try {
+				const sinceSeq = options?.sinceSeq;
+				const searchParams = sinceSeq != null && sinceSeq > 0 ? { sinceSeq: String(sinceSeq) } : void 0;
+				const data = await http.get(`api/projects/${encodeURIComponent(projectId)}/sessions/${encodeURIComponent(sessionId)}/state`, { searchParams }).json();
+				if (data == null) return null;
+				return AgentSessionChatStateResponseSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async listSessions(projectId, agentSlug) {
+			try {
+				const data = await http.get(`api/projects/${encodeURIComponent(projectId)}/agents/${encodeURIComponent(agentSlug)}/sessions`).json();
+				return AgentSessionListResponseSchema.parse(data).items;
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async listTriggers(projectId, agentSlug) {
+			try {
+				const data = await http.get(`api/projects/${encodeURIComponent(projectId)}/agents/${encodeURIComponent(agentSlug)}/triggers`).json();
+				return AgentTriggerSummaryListResponseSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		/** Deletes an agent-owned ephemeral trigger; throws if it is not deletable (404). */
+		async deleteTrigger(projectId, agentSlug, triggerId) {
+			try {
+				await http.delete(`api/projects/${encodeURIComponent(projectId)}/agents/${encodeURIComponent(agentSlug)}/triggers/${encodeURIComponent(triggerId)}`);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async listMemoryFiles(agentId) {
+			try {
+				const data = await http.get(`api/agents/${encodeURIComponent(agentId)}/memory/files`).json();
+				return ListAgentMemoryFilesResponseSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async getMemoryFileContent(agentId, path) {
+			try {
+				return await http.get(`api/agents/${encodeURIComponent(agentId)}/memory/files/content`, { searchParams: { path } }).text();
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		/** Persistent agent workspace files under `/workspace/agent`. */
+		async listWorkspaceFiles(agentId) {
+			try {
+				const data = await http.get(`api/agents/${encodeURIComponent(agentId)}/workspace/files`).json();
+				return ListAgentWorkspaceFilesResponseSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		/** Content for a path from {@link listWorkspaceFiles}. */
+		async getWorkspaceFileContent(agentId, path) {
+			try {
+				return await http.get(`api/agents/${encodeURIComponent(agentId)}/workspace/files/content`, { searchParams: { path } }).text();
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
 		}
 	};
 }
@@ -3589,7 +3712,7 @@ function createProjectsResource(http) {
 		async list(options) {
 			try {
 				const data = await http.get("/api/projects", { searchParams: listSearchParams(options) }).json();
-				return ListProjectsResponseSchema.parse(data).projects;
+				return ListProjectsResponseSchema.parse(data);
 			} catch (error) {
 				throw await toPlatformError(error);
 			}
@@ -3598,7 +3721,7 @@ function createProjectsResource(http) {
 			const body = CreateProjectRequestSchema.parse(input);
 			try {
 				const data = await http.post("/api/projects", { json: body }).json();
-				return CreateProjectResponseSchema.parse(data).project;
+				return CreateProjectResponseSchema.parse(data);
 			} catch (error) {
 				throw await toPlatformError(error);
 			}
@@ -3606,7 +3729,7 @@ function createProjectsResource(http) {
 		async get(projectId) {
 			try {
 				const data = await http.get(`/api/projects/${encodeURIComponent(projectId)}`).json();
-				return ProjectResponseSchema.parse(data).project;
+				return ProjectResponseSchema.parse(data);
 			} catch (error) {
 				throw await toPlatformError(error);
 			}
@@ -3615,7 +3738,7 @@ function createProjectsResource(http) {
 			const body = UpdateProjectRequestSchema.parse(patch);
 			try {
 				const data = await http.patch(`/api/projects/${encodeURIComponent(projectId)}`, { json: body }).json();
-				return ProjectResponseSchema.parse(data).project;
+				return ProjectResponseSchema.parse(data);
 			} catch (error) {
 				throw await toPlatformError(error);
 			}
@@ -3651,7 +3774,7 @@ function createProjectMetricsResource(http) {
 	return { async list(options) {
 		try {
 			const data = await http.get("/api/projects/metrics", { searchParams: listSearchParams(options) }).json();
-			return ListProjectMetricsResponseSchema.parse(data).metrics;
+			return ListProjectMetricsResponseSchema.parse(data);
 		} catch (error) {
 			throw await toPlatformError(error);
 		}
@@ -3707,6 +3830,74 @@ function createSkillsResource(http) {
 		}
 	};
 }
+function listRunsSearchParams(query) {
+	if (!query) return {};
+	const params = {};
+	if (query.limit !== void 0) params.limit = String(query.limit);
+	if (query.cursor) params.cursor = query.cursor;
+	if (query.triggerType) params.triggerType = query.triggerType;
+	return params;
+}
+function createTriggersResource(http) {
+	return {
+		/** Triggers across the projects the caller can access in the active org. */
+		async list() {
+			try {
+				const data = await http.get("api/triggers").json();
+				return WorkspaceTriggerListResponseSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async get(triggerId) {
+			try {
+				const data = await http.get(`api/triggers/${encodeURIComponent(triggerId)}`).json();
+				return WorkspaceTriggerDetailSchema.parse(data);
+			} catch (error) {
+				const platformError = await toPlatformError(error);
+				if (platformError.status === 404) return null;
+				throw platformError;
+			}
+		},
+		/** LLM-generated markdown overview of the trigger (generated lazily on the worker). */
+		async getOverview(triggerId) {
+			try {
+				const data = await http.get(`api/triggers/${encodeURIComponent(triggerId)}/overview`).json();
+				return WorkspaceTriggerOverviewSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		/** The trigger source file. */
+		async getFile(triggerId) {
+			try {
+				const data = await http.get(`api/triggers/${encodeURIComponent(triggerId)}/file`).json();
+				return WorkspaceTriggerFileSchema.parse(data);
+			} catch (error) {
+				const platformError = await toPlatformError(error);
+				if (platformError.status === 404) return null;
+				throw platformError;
+			}
+		},
+		/** Every fire of the trigger (poll/webhook/cron), dispatched or not. */
+		async listRuns(triggerId, query) {
+			try {
+				const data = await http.get(`api/triggers/${encodeURIComponent(triggerId)}/runs`, { searchParams: listRunsSearchParams(query) }).json();
+				return WorkspaceTriggerRunListResponseSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async updateAttachment(triggerId, attachmentId, body) {
+			try {
+				const data = await http.patch(`api/triggers/${encodeURIComponent(triggerId)}/attachments/${encodeURIComponent(attachmentId)}`, { json: body }).json();
+				return WorkspaceTriggerDetailSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		}
+	};
+}
 function createTeamRequestsResource(http) {
 	return { async submit(input) {
 		const body = SubmitTeamRequestRequestSchema.parse(input);
@@ -3717,6 +3908,16 @@ function createTeamRequestsResource(http) {
 		}
 	} };
 }
+function createMarketingContactResource(http) {
+	return { async submit(input) {
+		const body = SubmitMarketingContactRequestSchema.parse(input);
+		try {
+			await http.post("/api/public/contact", { json: body }).json();
+		} catch (error) {
+			throw await toPlatformError(error);
+		}
+	} };
+}
 function createRecentsResource(http) {
 	return { 
 	/** Always the viewer's own recents, scoped to their project memberships. */
@@ -3737,6 +3938,10 @@ function buildOAuthAuthorizeSearchParams(input) {
 	if (projectIds.length > 0) params.projects = projectIds.join(",");
 	if (input.createOrganizationCredential) params.org = "true";
 	if (input.createUserProvidedCredential) params.user = "true";
+	const label = input.label?.trim();
+	if (label) params.label = label;
+	const credentialInstanceId = input.credentialInstanceId?.trim();
+	if (credentialInstanceId) params.credentialInstanceId = credentialInstanceId;
 	return params;
 }
 function createCredentialsResource(http) {
@@ -3744,7 +3949,7 @@ function createCredentialsResource(http) {
 		async list() {
 			try {
 				const data = await http.get("/api/credentials").json();
-				return ListCredentialsResponseSchema.parse(data).credentials;
+				return ListCredentialsResponseSchema.parse(data);
 			} catch (error) {
 				throw await toPlatformError(error);
 			}
@@ -3752,7 +3957,7 @@ function createCredentialsResource(http) {
 		async get(credentialId) {
 			try {
 				const data = await http.get(`/api/credentials/${encodeURIComponent(credentialId)}`).json();
-				return GetCredentialResponseSchema.parse(data).credential;
+				return GetCredentialResponseSchema.parse(data);
 			} catch (error) {
 				throw await toPlatformError(error);
 			}
@@ -3761,7 +3966,7 @@ function createCredentialsResource(http) {
 			const body = CreateCredentialsRequestSchema.parse(input);
 			try {
 				const data = await http.post("/api/credentials", { json: body }).json();
-				return CreateCredentialsResponseSchema.parse(data).credentials;
+				return CreateCredentialsResponseSchema.parse(data);
 			} catch (error) {
 				throw await toPlatformError(error);
 			}
@@ -3770,7 +3975,7 @@ function createCredentialsResource(http) {
 			const body = UpdateCredentialRequestSchema.parse(patch);
 			try {
 				const data = await http.patch(`/api/credentials/${encodeURIComponent(credentialId)}`, { json: body }).json();
-				return GetCredentialResponseSchema.parse(data).credential;
+				return GetCredentialResponseSchema.parse(data);
 			} catch (error) {
 				throw await toPlatformError(error);
 			}
@@ -3794,25 +3999,156 @@ function createCredentialsResource(http) {
 			} catch (error) {
 				throw await toPlatformError(error);
 			}
+		},
+		async startKeystrokeConnection(input) {
+			const body = StartKeystrokeConnectionInputSchema.parse(input);
+			try {
+				const data = await http.post("/mcp/connections", { json: body }).json();
+				return StartKeystrokeConnectionResultSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
 		}
 	};
 }
+function parseCatalogData(schema, data) {
+	const parsed = schema.safeParse(data);
+	if (parsed.success) return parsed.data;
+	throw new PlatformError(`Invalid catalog response: ${parsed.error.message}`, 502, data);
+}
+function catalogSearchParams(params) {
+	const searchParams = new URLSearchParams();
+	for (const [key, value] of Object.entries(params)) {
+		if (value === void 0 || value === "") continue;
+		searchParams.set(key, String(value));
+	}
+	return searchParams;
+}
 function createAppsResource(http) {
-	return { async listCatalog() {
-		try {
-			const data = await http.get("/api/apps").json();
-			return ListAppsResponseSchema.parse(data).apps;
-		} catch (error) {
-			throw await toPlatformError(error);
+	return {
+		async listCatalog() {
+			try {
+				const data = await http.get("/api/apps").json();
+				return ListAppsResponseSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async searchCatalog(options) {
+			try {
+				const searchParams = catalogSearchParams({
+					search: options.search,
+					category: options.category,
+					sort_by: options.sortBy,
+					limit: options.limit,
+					cursor: options.cursor
+				});
+				return parseCatalogData(CatalogAppsPageResponseSchema, await http.get(`/mcp/catalog/apps?${searchParams}`).json());
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async getCatalogApp(slug) {
+			try {
+				return parseCatalogData(CatalogAppDetailResponseSchema, await http.get(`/mcp/catalog/apps/${encodeURIComponent(slug)}`).json());
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async listCatalogActions(slug, options) {
+			try {
+				const searchParams = catalogSearchParams({
+					search: options?.search,
+					limit: options?.limit,
+					cursor: options?.cursor
+				});
+				const query = searchParams.size > 0 ? `?${searchParams}` : "";
+				return parseCatalogData(CatalogActionsPageResponseSchema, await http.get(`/mcp/catalog/apps/${encodeURIComponent(slug)}/actions${query}`).json());
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async searchCatalogActions(options) {
+			try {
+				const searchParams = catalogSearchParams({
+					search: options.search,
+					limit: options.limit,
+					cursor: options.cursor
+				});
+				return parseCatalogData(CatalogActionsPageResponseSchema, await http.get(`/mcp/catalog/actions?${searchParams}`).json());
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async getCatalogAction(toolSlug) {
+			try {
+				return parseCatalogData(CatalogActionDetailResponseSchema, await http.get(`/mcp/catalog/actions/${encodeURIComponent(toolSlug)}`).json());
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async checkSlug(slug) {
+			try {
+				const searchParams = new URLSearchParams({ slug });
+				const data = await http.get(`/api/apps/slug-available?${searchParams}`).json();
+				return AppSlugAvailabilityResponseSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async create(input) {
+			try {
+				const body = CreateCustomAppRequestSchema.parse(input);
+				const data = await http.post("/api/apps", { json: body }).json();
+				return CreateCustomAppResponseSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async get(slug) {
+			try {
+				const data = await http.get(`/api/apps/${encodeURIComponent(slug)}`).json();
+				return GetCustomAppResponseSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async discoverMcp(input) {
+			try {
+				const data = await http.post("/api/apps/discover", { json: input }).json();
+				return McpDiscoverResponseSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async discoverOpenApi(input) {
+			try {
+				const data = await http.post("/api/apps/discover-openapi", { json: input }).json();
+				return OpenApiDiscoverResponseSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async startMcpOAuthConnection(slug, input) {
+			try {
+				const body = StartMcpOAuthConnectionInputSchema.parse({
+					...input,
+					appSlug: slug
+				});
+				const data = await http.post(`/api/apps/${encodeURIComponent(slug)}/mcp/oauth/connections`, { json: body }).json();
+				return StartMcpOAuthConnectionResultSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
 		}
-	} };
+	};
 }
 function createMembersResource(http) {
 	return {
 		async listOrganizationMembers() {
 			try {
 				const data = await http.get("/api/members").json();
-				return ListOrganizationMembersResponseSchema.parse(data).members;
+				return ListOrganizationMembersResponseSchema.parse(data);
 			} catch (error) {
 				throw await toPlatformError(error);
 			}
@@ -3830,7 +4166,7 @@ function createMembersResource(http) {
 			const body = UpdateOrganizationMemberRequestSchema.parse(input);
 			try {
 				const data = await http.patch(`/api/members/${encodeURIComponent(userId)}`, { json: body }).json();
-				return UpdateOrganizationMemberResponseSchema.parse(data).member;
+				return UpdateOrganizationMemberResponseSchema.parse(data);
 			} catch (error) {
 				throw await toPlatformError(error);
 			}
@@ -3845,7 +4181,7 @@ function createMembersResource(http) {
 		async listForProject(projectId) {
 			try {
 				const data = await http.get(`/api/projects/${encodeURIComponent(projectId)}/members`).json();
-				return ListProjectMembersResponseSchema.parse(data).members;
+				return ListProjectMembersResponseSchema.parse(data);
 			} catch (error) {
 				throw await toPlatformError(error);
 			}
@@ -3866,7 +4202,7 @@ function createMembersResource(http) {
 			const body = UpdateProjectMemberRequestSchema.parse(input);
 			try {
 				const data = await http.patch(`/api/projects/${encodeURIComponent(projectId)}/members/${encodeURIComponent(userId)}`, { json: body }).json();
-				return UpdateProjectMemberResponseSchema.parse(data).member;
+				return UpdateProjectMemberResponseSchema.parse(data);
 			} catch (error) {
 				throw await toPlatformError(error);
 			}
@@ -3892,7 +4228,7 @@ function createProjectSettingsResource(http) {
 		async get(projectId) {
 			try {
 				const data = await http.get(`/api/projects/${encodeURIComponent(projectId)}/settings`).json();
-				return ProjectSettingsResponseSchema.parse(data).settings;
+				return ProjectSettingsResponseSchema.parse(data);
 			} catch (error) {
 				throw await toPlatformError(error);
 			}
@@ -3901,7 +4237,7 @@ function createProjectSettingsResource(http) {
 			const body = UpdateProjectSettingsRequestSchema.parse(patch);
 			try {
 				const data = await http.patch(`/api/projects/${encodeURIComponent(projectId)}/settings`, { json: body }).json();
-				return ProjectSettingsResponseSchema.parse(data).settings;
+				return ProjectSettingsResponseSchema.parse(data);
 			} catch (error) {
 				throw await toPlatformError(error);
 			}
@@ -3913,7 +4249,7 @@ function createInvitationsResource(http) {
 		async list() {
 			try {
 				const data = await http.get("/api/invitations").json();
-				return ListOrganizationInvitationsResponseSchema.parse(data).invitations;
+				return ListOrganizationInvitationsResponseSchema.parse(data);
 			} catch (error) {
 				throw await toPlatformError(error);
 			}
@@ -3921,7 +4257,7 @@ function createInvitationsResource(http) {
 		async accept(invitationId) {
 			try {
 				const data = await http.post(`/api/invitations/${encodeURIComponent(invitationId)}/accept`).json();
-				return AcceptOrganizationInvitationResponseSchema.parse(data).organization;
+				return AcceptOrganizationInvitationResponseSchema.parse(data);
 			} catch (error) {
 				throw await toPlatformError(error);
 			}
@@ -3941,7 +4277,7 @@ function createApiKeysResource(http) {
 		async list() {
 			try {
 				const data = await http.get("/api/api-keys").json();
-				return ListApiKeysResponseSchema.parse(data).apiKeys;
+				return ListApiKeysResponseSchema.parse(data);
 			} catch (error) {
 				throw await toPlatformError(error);
 			}
@@ -4140,6 +4476,7 @@ function projectChannelPlatform(app) {
 		resourceNoun: app.gateway.resourceNoun,
 		webhookPathHint: app.gateway.webhookPathHint,
 		supportsChannelDirectory: app.gateway.supportsChannelDirectory,
+		...app.gateway.connectAppId ? { connectAppId: app.gateway.connectAppId } : {},
 		docsUrl: app.gateway.docsUrl
 	});
 }
@@ -4148,7 +4485,7 @@ function createChannelsResource(http) {
 	async function listGatewayPlatforms() {
 		try {
 			const data = await http.get("/api/apps").json();
-			return ListAppsResponseSchema.parse(data).apps.filter((app) => app.gateway).map((app) => projectChannelPlatform(app));
+			return ListAppsResponseSchema.parse(data).filter((app) => app.gateway).map((app) => projectChannelPlatform(app));
 		} catch (error) {
 			throw await toPlatformError(error);
 		}
@@ -4160,7 +4497,7 @@ function createChannelsResource(http) {
 		async listAccounts(projectId, platform) {
 			try {
 				const data = await http.get(`${projectPrefix(projectId)}/channels/${encodeURIComponent(platform)}/accounts`).json();
-				return ChannelAccountListResponseSchema.parse(data).accounts;
+				return ChannelAccountListResponseSchema.parse(data);
 			} catch (error) {
 				throw await toPlatformError(error);
 			}
@@ -4168,7 +4505,7 @@ function createChannelsResource(http) {
 		async listForAgent(projectId, agentId) {
 			try {
 				const data = await http.get(`${projectPrefix(projectId)}/agents/${encodeURIComponent(agentId)}/channels`).json();
-				return ChannelConnectionListResponseSchema.parse(data).connections;
+				return ChannelConnectionListResponseSchema.parse(data);
 			} catch (error) {
 				throw await toPlatformError(error);
 			}
@@ -4176,7 +4513,7 @@ function createChannelsResource(http) {
 		async listChannels(projectId, platform, accountId) {
 			try {
 				const data = await http.get(`${projectPrefix(projectId)}/channels/${encodeURIComponent(platform)}/directory`, { searchParams: { accountId } }).json();
-				return ChannelDirectoryListResponseSchema.parse(data).channels;
+				return ChannelDirectoryListResponseSchema.parse(data);
 			} catch (error) {
 				throw await toPlatformError(error);
 			}
@@ -4256,6 +4593,7 @@ function createPlatformClient(options) {
 		agents: createAgentsResource(http),
 		workflows: createWorkflowsResource(http),
 		skills: createSkillsResource(http),
+		triggers: createTriggersResource(http),
 		apps: createAppsResource(http),
 		credentials: createCredentialsResource(http),
 		history: createHistoryResource(http),
@@ -4272,6 +4610,7 @@ function createPlatformClient(options) {
 		userAvatar: createUserAvatarResource(http),
 		organizationSidebarBranding: createOrganizationSidebarBrandingResource(http, { getActiveOrganizationId: () => activeOrganizationId }),
 		teamRequests: createTeamRequestsResource(http),
+		marketingContact: createMarketingContactResource(http),
 		getActiveOrganizationId: () => activeOrganizationId,
 		setActiveOrganizationId
 	};
@@ -4394,6 +4733,49 @@ async function ensureActiveOrganization(config) {
 	throw new Error("No active organization. Run `keystroke auth login` or `keystroke config use org`.");
 }
 //#endregion
+//#region src/project/resolve-project-root.ts
+function hasProjectLayout(dir) {
+	return existsSync(join(dir, "package.json")) && existsSync(join(dir, "src", "agents"));
+}
+function resolveProjectRoot(fromDir = process.cwd()) {
+	let dir = resolve(fromDir);
+	while (dir !== dirname(dir)) {
+		if (hasProjectLayout(dir)) return dir;
+		dir = dirname(dir);
+	}
+	if (hasProjectLayout(dir)) return dir;
+	throw new Error("Could not find keystroke project root (expected package.json and src/agents/)");
+}
+//#endregion
+//#region src/project/load-project-env.ts
+let loaded = false;
+function parseEnvFile(contents) {
+	const values = {};
+	for (const line of contents.split("\n")) {
+		const trimmed = line.trim();
+		if (!trimmed || trimmed.startsWith("#")) continue;
+		const eq = trimmed.indexOf("=");
+		if (eq === -1) continue;
+		const key = trimmed.slice(0, eq).trim();
+		let value = trimmed.slice(eq + 1).trim();
+		if (value.startsWith("\"") && value.endsWith("\"") || value.startsWith("'") && value.endsWith("'")) value = value.slice(1, -1);
+		values[key] = value;
+	}
+	return values;
+}
+function loadProjectEnv(fromDir = process.cwd()) {
+	if (loaded) return;
+	loaded = true;
+	let envPath;
+	try {
+		envPath = join(resolveProjectRoot(fromDir), ".env");
+	} catch {
+		return;
+	}
+	if (!existsSync(envPath)) return;
+	for (const [key, value] of Object.entries(parseEnvFile(readFileSync(envPath, "utf8")))) if (process.env[key] === void 0) process.env[key] = value;
+}
+//#endregion
 //#region src/dev-session.ts
 function getDevSessionPath(configDir = getCliConfigDir()) {
 	return join(configDir, "dev-session.json");
@@ -4432,13 +4814,30 @@ function readDevSession(configDir = getCliConfigDir()) {
 }
 //#endregion
 //#region src/resolve-api-target.ts
+/** Standalone local server default project id — keep in sync with @keystrokehq/database. */
+const DEFAULT_LOCAL_PROJECT_ID = "default";
 const projectScopedTarget = { projectScoped: true };
-function resolveLocalTarget(config) {
+function resolveLocalTargetFromOrigin(origin, options = {}) {
+	const base = origin.replace(/\/+$/, "");
+	if (!options.projectScoped) return {
+		baseUrl: base,
+		mode: "local"
+	};
+	const projectPathMatch = base.match(/^(.*\/api\/projects\/([^/]+))$/);
+	if (projectPathMatch) return {
+		baseUrl: projectPathMatch[1],
+		projectId: projectPathMatch[2],
+		mode: "local"
+	};
 	return {
-		baseUrl: getServerUrl(config),
+		baseUrl: `${base}/api/projects/${DEFAULT_LOCAL_PROJECT_ID}`,
+		projectId: DEFAULT_LOCAL_PROJECT_ID,
 		mode: "local"
 	};
 }
+function resolveLocalTarget(options = {}) {
+	return resolveLocalTargetFromOrigin(resolvePublicPlatformOrigin(process.env), options);
+}
 function resolveOrgPlatformTarget(config) {
 	return {
 		baseUrl: `${getPlatformUrl(config).replace(/\/+$/, "")}/api`,
@@ -4462,18 +4861,16 @@ async function resolvePlatformTarget(config, projectRef) {
 	};
 }
 async function resolveApiTarget(config, options = {}) {
-	if (options.local) return resolveLocalTarget(config);
+	loadProjectEnv(process.cwd());
+	if (options.local) return resolveLocalTarget(options);
 	const devSession = readDevSession(getConfigDir(config));
-	if (devSession && getEffectiveApiTarget(config) !== "platform") return {
-		baseUrl: devSession.serverUrl,
-		mode: "local"
-	};
+	if (devSession && getEffectiveApiTarget(config) !== "platform") return resolveLocalTargetFromOrigin(devSession.serverUrl, options);
 	if (options.orgScoped || options.projectScoped === false) {
-		if (getEffectiveApiTarget(config) === "local") return resolveLocalTarget(config);
+		if (getEffectiveApiTarget(config) === "local") return resolveLocalTarget(options);
 		return resolveOrgPlatformTarget(config);
 	}
 	if (options.projectId) return resolvePlatformTarget(config, options.projectId);
-	if (getEffectiveApiTarget(config) === "local") return resolveLocalTarget(config);
+	if (getEffectiveApiTarget(config) === "local") return resolveLocalTarget(options);
 	if (!options.projectScoped) return resolveOrgPlatformTarget(config);
 	const projectRef = options.projectId ?? config.get("activeProjectId");
 	if (!projectRef) throw new Error("No project selected. Pass `--project <slug>` or run `keystroke config use project <slug>`.");
@@ -4560,7 +4957,13 @@ function formatHttpClientError(error, context) {
 		if (origin && !getAccessToken(origin)) return "Not logged in. Run `keystroke auth login` first.";
 		return "Authentication failed. Run `keystroke auth login` again.";
 	}
-	if (error.status === 0) return unreachableServerMessage(unreachableTarget(context));
+	if (error.status === 403) {
+		if (parseErrorResponse(error.body)?.code === "org_unverified") return "This organization is pending verification. Request access in the Keystroke dashboard.";
+	}
+	if (error.status === 0) {
+		if (error.message && !isUnreachableServerError(error)) return error.message;
+		return unreachableServerMessage(unreachableTarget(context));
+	}
 	const parsed = parseErrorResponse(error.body);
 	if (parsed) return formatApiErrorMessage(parsed, error.message, context);
 	return error.message;
@@ -4845,13 +5248,128 @@ function registerApiKeyCommand(program) {
 	});
 }
 //#endregion
-//#region src/commands/app/run-app-list.ts
-async function runAppList(client) {
-	return client.apps.listCatalog();
+//#region src/commands/app/run-app-catalog.ts
+async function runAppSearch(client, query, options) {
+	const trimmed = query.trim();
+	if (!trimmed) throw new Error("Search query is required");
+	return client.apps.searchCatalog({
+		search: trimmed,
+		category: options?.category,
+		limit: options?.limit,
+		cursor: options?.cursor
+	});
 }
-//#endregion
-//#region src/commands/app/list.ts
-function registerAppListCommand(app) {
+async function runAppShow(client, slug) {
+	const trimmed = slug.trim();
+	if (!trimmed) throw new Error("App slug is required");
+	return client.apps.getCatalogApp(trimmed);
+}
+async function runAppActions(client, options) {
+	const slug = options.slug?.trim();
+	const search = options.search?.trim();
+	if (slug) return client.apps.listCatalogActions(slug, {
+		search,
+		limit: options.limit,
+		cursor: options.cursor
+	});
+	if (!search) throw new Error("App slug or --search is required");
+	return client.apps.searchCatalogActions({
+		search,
+		limit: options.limit,
+		cursor: options.cursor
+	});
+}
+async function runAppAction(client, toolSlug) {
+	const trimmed = toolSlug.trim();
+	if (!trimmed) throw new Error("Tool slug is required");
+	return client.apps.getCatalogAction(trimmed);
+}
+//#endregion
+//#region src/commands/app/action.ts
+function registerAppActionCommand(app) {
+	app.command("action").description("Show a Composio action schema from the live catalog").argument("<tool-slug>", "Composio tool slug (e.g. GITHUB_CREATE_ISSUE)").action((toolSlug) => runCliCommand("App action failed", async () => {
+		const config = createCliConfig();
+		const client = createCliPlatformClient(config);
+		await ensureActiveOrganization(config);
+		const result = await runAppAction(client, toolSlug);
+		process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+	}, void 0, { orgScoped: true }));
+}
+//#endregion
+//#region src/commands/app/actions.ts
+function registerAppActionsCommand(app) {
+	app.command("actions [slug]").description("List or search Composio actions (per app or globally with --search)").option("--search <query>", "Search actions within the app or across all apps").option("--limit <n>", "Page size", (value) => Number.parseInt(value, 10)).option("--cursor <cursor>", "Pagination cursor").action((slug, options) => runCliCommand("App actions failed", async () => {
+		const config = createCliConfig();
+		const client = createCliPlatformClient(config);
+		await ensureActiveOrganization(config);
+		const result = await runAppActions(client, {
+			slug,
+			...options
+		});
+		process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+	}, void 0, { orgScoped: true }));
+}
+//#endregion
+//#region src/commands/app/parse-custom-app-fields.ts
+function parseCustomAppFieldFlag(value) {
+	const parts = value.split(":").map((part) => part.trim()).filter(Boolean);
+	const key = parts[0];
+	if (!key || !/^[a-zA-Z][a-zA-Z0-9_]*$/.test(key)) throw new Error(`Invalid field key in --field ${JSON.stringify(value)}`);
+	const optional = parts.includes("optional");
+	return {
+		key,
+		secret: parts.includes("public") ? false : parts.includes("secret") || !optional,
+		optional
+	};
+}
+function parseCustomAppFields(flags) {
+	const fields = {};
+	for (const flag of flags) {
+		const parsed = parseCustomAppFieldFlag(flag);
+		fields[parsed.key] = {
+			...parsed.secret ? { secret: true } : {},
+			...parsed.optional ? { optional: true } : {}
+		};
+	}
+	if (Object.keys(fields).length === 0) throw new Error("At least one --field is required");
+	if (!Object.values(fields).some((field) => field.optional !== true)) return fields;
+	if (!Object.values(fields).some((field) => field.optional !== true)) throw new Error("At least one --field must be required (omit :optional)");
+	return fields;
+}
+function collectValues$1(value, previous) {
+	return [...previous, value];
+}
+//#endregion
+//#region src/commands/app/run-app-create.ts
+async function runAppCreate(client, input) {
+	return client.apps.create(input);
+}
+//#endregion
+//#region src/commands/app/create.ts
+function registerAppCreateCommand(app) {
+	app.command("create").description("Create a custom org api_key app").requiredOption("--name <name>", "App display name").option("--slug <slug>", "App slug segment (defaults from name)").requiredOption("--description <description>", "App description").option("--field <field>", "Credential field as key, key:secret, key:optional, or key:secret:optional (repeatable)", collectValues$1, []).action((options) => runCliCommand("Create app failed", async () => {
+		const config = createCliConfig();
+		const client = createCliPlatformClient(config);
+		await ensureActiveOrganization(config);
+		const slug = options.slug?.trim() || slugifyAppName(options.name);
+		const created = await runAppCreate(client, {
+			name: options.name.trim(),
+			slug,
+			description: options.description,
+			source: "custom",
+			fields: parseCustomAppFields(options.field)
+		});
+		process.stdout.write(`${JSON.stringify(created, null, 2)}\n`);
+	}, void 0, { orgScoped: true }));
+}
+//#endregion
+//#region src/commands/app/run-app-list.ts
+async function runAppList(client) {
+	return client.apps.listCatalog();
+}
+//#endregion
+//#region src/commands/app/list.ts
+function registerAppListCommand(app) {
 	app.command("list").description("List connectable apps in the active organization").action(() => runCliCommand("List apps failed", async () => {
 		const config = createCliConfig();
 		const client = createCliPlatformClient(config);
@@ -4861,26 +5379,111 @@ function registerAppListCommand(app) {
 	}, void 0, { orgScoped: true }));
 }
 //#endregion
-//#region src/commands/app/index.ts
-function registerAppCommand(program) {
-	registerAppListCommand(program.command("app").description("Browse connectable integrations"));
+//#region src/commands/app/search.ts
+function registerAppSearchCommand(app) {
+	app.command("search").description("Search the Composio app catalog (live)").argument("<query>", "Search query").option("--category <category>", "Filter by category").option("--limit <n>", "Page size", (value) => Number.parseInt(value, 10)).option("--cursor <cursor>", "Pagination cursor").action((query, options) => runCliCommand("App search failed", async () => {
+		const config = createCliConfig();
+		const client = createCliPlatformClient(config);
+		await ensureActiveOrganization(config);
+		const result = await runAppSearch(client, query, options);
+		process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+	}, void 0, { orgScoped: true }));
 }
 //#endregion
-//#region src/commands/connect/parse-connect-scopes.ts
-function parseConnectScopes(scopes, projectSlugs) {
-	const normalized = scopes.length > 0 ? scopes : ["org"];
-	for (const scope of normalized) if (scope !== "org" && scope !== "user" && scope !== "project") throw new Error(`Unknown scope "${scope}". Expected org, user, or project.`);
-	const createOrganizationCredential = normalized.includes("org");
-	const createUserProvidedCredential = normalized.includes("user");
-	const includesProject = normalized.includes("project");
-	const selectedProjects = includesProject ? projectSlugs : [];
-	if (includesProject && selectedProjects.length === 0) throw new Error("--project-slug is required when scope includes project");
-	if (!createOrganizationCredential && !createUserProvidedCredential && selectedProjects.length === 0) throw new Error("At least one scope is required via --scope and/or --project-slug");
-	return {
-		createOrganizationCredential,
-		createUserProvidedCredential,
-		projects: selectedProjects
-	};
+//#region src/commands/app/show.ts
+function registerAppShowCommand(app) {
+	app.command("show").description("Show a Composio app from the live catalog").argument("<slug>", "App slug").action((slug) => runCliCommand("App show failed", async () => {
+		const config = createCliConfig();
+		const client = createCliPlatformClient(config);
+		await ensureActiveOrganization(config);
+		const result = await runAppShow(client, slug);
+		process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+	}, void 0, { orgScoped: true }));
+}
+//#endregion
+//#region src/project/resolve-keystroke-config-root.ts
+const KEYSTROKE_CONFIG = "keystroke.config.ts";
+/** Walk up from `fromDir` and return the directory containing `keystroke.config.ts`, if any. */
+function resolveKeystrokeConfigRoot(fromDir = process.cwd()) {
+	let dir = resolve(fromDir);
+	while (dir !== dirname(dir)) {
+		if (existsSync(join(dir, KEYSTROKE_CONFIG))) return dir;
+		dir = dirname(dir);
+	}
+	if (existsSync(join(dir, KEYSTROKE_CONFIG))) return dir;
+	return null;
+}
+//#endregion
+//#region src/commands/app/generate-app-stub.ts
+function slugPartToExportName(part) {
+	return part.split(/[-_]+/).filter(Boolean).map((segment, index) => index === 0 ? segment.charAt(0).toLowerCase() + segment.slice(1) : segment.charAt(0).toUpperCase() + segment.slice(1)).join("");
+}
+function resolveSyncedAppExportName(slug) {
+	const parsed = parseAppSlug(slug);
+	const exportName = slugPartToExportName(parsed.kind === "org" ? parsed.name : parsed.slug);
+	if (!exportName) throw new Error(`Cannot derive export name from app slug: ${slug}`);
+	return exportName;
+}
+function resolveSyncedAppDirName(slug) {
+	const parsed = parseAppSlug(slug);
+	return parsed.kind === "org" ? parsed.name : parsed.slug;
+}
+function generateAppStub(app) {
+	const exportName = resolveSyncedAppExportName(app.slug);
+	const credentialLines = Object.entries(app.credentialFields ?? {}).map(([key, field]) => {
+		return `    ${key}: ${field.optional ? "z.string().optional()" : "z.string()"},`;
+	}).join("\n");
+	return `import { defineApp } from "@keystrokehq/keystroke/app";
+import { z } from "zod";
+
+/** Synced from platform app \`${app.slug}\`. Re-run \`keystroke app sync ${app.slug}\` after template changes. */
+export const ${exportName} = defineApp({
+  slug: ${JSON.stringify(app.slug)},
+  auth: "api_key",
+  credential: {
+${credentialLines}
+  },
+});
+`;
+}
+//#endregion
+//#region src/commands/app/run-app-sync.ts
+async function runAppSync(options) {
+	const projectRoot = resolveKeystrokeConfigRoot(options.dir ?? process.cwd());
+	if (!projectRoot) throw new Error("Not in a keystroke project (keystroke.config.ts not found)");
+	const app = await options.client.apps.get(options.slug);
+	const appDir = join(projectRoot, "src", "apps", resolveSyncedAppDirName(app.slug));
+	const outputPath = join(appDir, "app.ts");
+	await mkdir(appDir, { recursive: true });
+	await writeFile(outputPath, generateAppStub(app), "utf8");
+	return { outputPath };
+}
+//#endregion
+//#region src/commands/app/sync.ts
+function registerAppSyncCommand(app) {
+	app.command("sync").description("Sync a custom app credential template into src/apps/<name>/app.ts").argument("<slug>", "App slug, e.g. acme/internal-api").option("--dir <dir>", "Project root (defaults to cwd)").action((slug, options) => runCliCommand("Sync app failed", async () => {
+		const config = createCliConfig();
+		const client = createCliPlatformClient(config);
+		await ensureActiveOrganization(config);
+		const result = await runAppSync({
+			client,
+			slug,
+			...options.dir !== void 0 ? { dir: options.dir } : {}
+		});
+		process.stdout.write(`Wrote ${result.outputPath}\n`);
+	}, void 0, { orgScoped: true }));
+}
+//#endregion
+//#region src/commands/app/index.ts
+function registerAppCommand(program) {
+	const app = program.command("app").description("Browse connectable integrations");
+	registerAppListCommand(app);
+	registerAppSearchCommand(app);
+	registerAppShowCommand(app);
+	registerAppActionsCommand(app);
+	registerAppActionCommand(app);
+	registerAppCreateCommand(app);
+	registerAppSyncCommand(app);
 }
 //#endregion
 //#region src/auth/open-url.ts
@@ -4893,101 +5496,138 @@ function openUrl(url) {
 }
 //#endregion
 //#region src/commands/connect/run-connect.ts
-function providerLabel(key) {
-	return key.charAt(0).toUpperCase() + key.slice(1);
-}
-async function runConnect(options) {
-	const { client, platform, provider, serverUrl, printUrl, oauthScopes = [], credentialScopes } = options;
-	const label = providerLabel(provider.key);
-	if (provider.mode === "browser-redirect") {
-		const url = `${serverUrl}${provider.path}`;
-		if (printUrl) {
-			process.stdout.write(`${url}\n`);
-			return;
-		}
-		openUrl(url);
-		process.stdout.write(`Complete ${label} sign-in in your browser.\n`);
-		return;
-	}
-	if (platform) {
-		const scopes = credentialScopes ?? parseConnectScopes([], []);
-		const result = await platform.credentials.startOAuthConnection({
-			appId: provider.key,
-			scopes: oauthScopes,
-			permissionMode: "default",
-			projects: scopes.projects,
-			createOrganizationCredential: scopes.createOrganizationCredential,
-			createUserProvidedCredential: scopes.createUserProvidedCredential
-		});
-		if (!result.authorizeUrl) throw new Error("OAuth provider did not return an authorize URL");
-		if (oauthScopes.length > 0) {
-			process.stdout.write("Requested OAuth scopes:\n");
-			for (const scope of oauthScopes) process.stdout.write(`  - ${scope}\n`);
-			process.stdout.write("\n");
-		}
-		if (printUrl) {
-			process.stdout.write(`${result.authorizeUrl}\n`);
-			return;
-		}
-		openUrl(result.authorizeUrl);
-		process.stdout.write(`Complete ${label} sign-in in your browser.\n`);
-		return;
+function resolveConnectAppSlug(slug, apps) {
+	const trimmed = slug.trim();
+	if (!trimmed) throw new Error("App slug is required");
+	try {
+		parseAppSlug(trimmed);
+	} catch {
+		throw new Error(`Invalid app slug: ${slug}`);
 	}
-	const payload = await client.connect.getAuthorizeUrl(provider.path);
-	const scopes = new URL(payload.url).searchParams.get("scope")?.split(" ").filter(Boolean) ?? [];
-	if (scopes.length > 0) {
-		process.stdout.write("Requested scopes:\n");
-		for (const scope of scopes) process.stdout.write(`  - ${scope}\n`);
-		process.stdout.write("\n");
+	const match = apps.find((app) => app.id === trimmed);
+	if (!match) {
+		const available = apps.map((app) => app.id).join(", ") || "(none)";
+		throw new Error(`Unknown app "${trimmed}". Available: ${available}`);
 	}
-	if (printUrl) {
-		process.stdout.write(`${payload.url}\n`);
+	return match;
+}
+async function runConnect(options) {
+	const apps = await options.platform.apps.listCatalog();
+	const app = resolveConnectAppSlug(options.slug, apps);
+	const url = buildConnectDeeplink({
+		webUrl: options.webUrl,
+		orgSlug: options.orgSlug,
+		appSlug: app.id
+	});
+	if (options.printUrl) {
+		process.stdout.write(`${url}\n`);
 		return;
 	}
-	openUrl(payload.url);
-	process.stdout.write(`Complete ${label} sign-in in your browser.\n`);
+	openUrl(url);
+	process.stdout.write(`Opening ${app.name} connect flow in your browser.\n`);
 }
 //#endregion
 //#region src/commands/connect/index.ts
-function resolveConnectTargetOptions() {
-	const { local } = getCliTargetOptions();
-	if (local) return { local: true };
-	return { orgScoped: true };
-}
-function collectValues$1(value, previous) {
-	return previous.concat([value]);
-}
 function registerConnectCommand(program) {
-	program.command("connect [provider]").description("Connect third-party accounts (uses apiTarget; --local for local server)").option("--oauth-scope <scope>", "OAuth permission scope to request (repeatable)", collectValues$1, []).option("--scope <scope>", "Credential scope: org, user, or project (repeatable)", collectValues$1, []).option("--project-slug <slug>", "Project slug when scope includes project (repeatable)", collectValues$1, []).option("--print-url", "Print the authorize URL and exit without opening the browser").action((provider, options) => runCliCommand("Could not fetch connect providers", async (ctx) => {
-		const providers = await ctx.client.connect.listProviders();
-		if (!provider) {
-			if (providers.length === 0) {
-				process.stdout.write("No connect providers available on this server.\n");
-				return;
-			}
-			process.stdout.write("Available providers:\n");
-			for (const entry of providers) process.stdout.write(`  ${entry.key}\n`);
-			return;
-		}
-		const match = providers.find((entry) => entry.key === provider);
-		if (!match) {
-			const available = providers.map((entry) => entry.key).join(", ") || "(none)";
-			throw new Error(`Unknown provider "${provider}". Available: ${available}`);
-		}
-		const hasScopeFlags = options.scope.length > 0 || options.projectSlug.length > 0;
-		if (ctx.apiTarget.mode === "local" && hasScopeFlags) throw new Error("--scope and --project-slug are only supported against the platform API (omit --local)");
-		const credentialScopes = ctx.apiTarget.mode === "platform" ? parseConnectScopes(options.scope, options.projectSlug) : void 0;
-		const platform = ctx.apiTarget.mode === "platform" ? createCliPlatformClient(createCliConfig()) : void 0;
+	program.command("connect <slug>").description("Open the web app to connect an integration by catalog slug").option("--print-url", "Print the connect URL and exit without opening the browser").action((slug, options) => runCliCommand("Connect failed", async () => {
+		const config = createCliConfig();
+		await ensureActiveOrganization(config);
+		const organizations = await listOrganizations(config);
+		const activeOrganizationId = config.get("activeOrganizationId");
+		const activeOrg = organizations.find((entry) => entry.organization.id === activeOrganizationId);
+		if (!activeOrg) throw new Error("No active organization. Run `keystroke auth login` or `keystroke config use org`.");
 		await runConnect({
-			client: ctx.client,
-			platform,
-			provider: match,
-			serverUrl: ctx.serverUrl,
-			printUrl: options.printUrl,
-			oauthScopes: options.oauthScope,
-			credentialScopes
+			platform: createCliPlatformClient(config),
+			webUrl: getWebUrl(config),
+			orgSlug: activeOrg.organization.slug,
+			slug,
+			printUrl: options.printUrl
+		});
+	}, void 0, { orgScoped: true }));
+}
+//#endregion
+//#region src/commands/credentials/parse-assignment-target.ts
+function parseAssignmentTarget(options) {
+	const agent = options.agent?.trim();
+	const workflow = options.workflow?.trim();
+	if (agent && workflow) throw new Error("Exactly one of --agent or --workflow is required");
+	if (agent) return {
+		targetType: "agent",
+		targetKey: agent
+	};
+	if (workflow) return {
+		targetType: "workflow",
+		targetKey: workflow
+	};
+	throw new Error("Exactly one of --agent or --workflow is required");
+}
+//#endregion
+//#region src/commands/credentials/assignments/assign.ts
+function registerCredentialsAssignmentsAssignCommand(assignments) {
+	assignments.command("assign").description("Assign a credential instance to a workflow step or agent tool").option("--agent <key>", "Agent slug").option("--workflow <key>", "Workflow slug").requiredOption("--credential <slug>", "Credential instance slug (e.g. work, org/work, linear/work)").option("--consumer <id>", "Consumer id (step correlation id or tool slug); omit for wildcard (*)").addHelpText("after", `
+Examples:
+  ${cliBinaryName()} credentials assignments assign --workflow sync --credential work
+  ${cliBinaryName()} credentials assignments assign --workflow sync --credential org/work --consumer step:fetch-gmail#0
+  ${cliBinaryName()} credentials assignments assign --agent support --credential vault-prod --consumer vault-lookup
+  ${cliBinaryName()} credentials assignments assign --agent pm --credential linear/work
+`).action((options) => runProjectCliCommand("Assign credential failed", async ({ client }) => {
+		const target = parseAssignmentTarget(options);
+		const assignment = await client.credentials.assignCredential({
+			targetType: target.targetType,
+			targetKey: target.targetKey,
+			credential: options.credential,
+			...options.consumer ? { consumerId: options.consumer } : {}
+		});
+		process.stdout.write(`${JSON.stringify(assignment, null, 2)}\n`);
+	}));
+}
+//#endregion
+//#region src/commands/credentials/assignments/list.ts
+function registerCredentialsAssignmentsListCommand(assignments) {
+	assignments.command("list").description("List credential assignments for a workflow or agent").option("--agent <key>", "Agent slug").option("--workflow <key>", "Workflow slug").action((options) => runProjectCliCommand("List credential assignments failed", async ({ client }) => {
+		const target = parseAssignmentTarget(options);
+		const result = await client.credentials.listAssignments({
+			targetType: target.targetType,
+			targetKey: target.targetKey
+		});
+		process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+	}));
+}
+//#endregion
+//#region src/commands/credentials/assignments/unassign.ts
+function registerCredentialsAssignmentsUnassignCommand(assignments) {
+	assignments.command("unassign").description("Remove a credential assignment by id").argument("<id>", "Credential assignment id").action((id) => runProjectCliCommand("Unassign credential failed", async ({ client }) => {
+		await client.credentials.unassignCredential(id);
+	}));
+}
+//#endregion
+//#region src/commands/credentials/assignments/index.ts
+function registerCredentialsAssignmentsCommands(credentials) {
+	const assignments = credentials.command("assignments").description("Assign credential instances to workflow steps or agent tools");
+	registerCredentialsAssignmentsListCommand(assignments);
+	registerCredentialsAssignmentsAssignCommand(assignments);
+	registerCredentialsAssignmentsUnassignCommand(assignments);
+}
+//#endregion
+//#region src/commands/credentials/consumers/list.ts
+function registerCredentialsConsumersListCommand(consumers) {
+	consumers.command("list").description("List bindable consumers for a workflow or agent").option("--agent <key>", "Agent slug").option("--workflow <key>", "Workflow slug").addHelpText("after", `
+Workflow consumers come from recent step_completed events (e.g. step:fetch-gmail#0).
+Agent consumers include known tool slugs when available, plus any from existing assignments.
+Use consumer id "*" (wildcard) or omit --consumer on assignments assign to bind all consumers.
+`).action((options) => runProjectCliCommand("List credential consumers failed", async ({ client }) => {
+		const target = parseAssignmentTarget(options);
+		const result = await client.credentials.listConsumers({
+			targetType: target.targetType,
+			targetKey: target.targetKey
 		});
-	}, void 0, resolveConnectTargetOptions()));
+		process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+	}));
+}
+//#endregion
+//#region src/commands/credentials/consumers/index.ts
+function registerCredentialsConsumersCommands(credentials) {
+	registerCredentialsConsumersListCommand(credentials.command("consumers").description("Discover workflow step and agent tool consumer ids for assignment"));
 }
 //#endregion
 //#region src/commands/credentials/target-options.ts
@@ -5066,13 +5706,13 @@ function buildPlatformUpdatePatch(args) {
 //#endregion
 //#region src/commands/credentials/delete.ts
 function registerCredentialsDeleteCommand(credentials) {
-	credentials.command("delete").description("Delete a credential instance").argument("<id>", "Credential instance id").action((id) => runCredentialsCommand("Delete credential failed", async ({ platform, local }) => {
+	credentials.command("delete").description("Delete a credential instance").argument("<ref>", "Credential slug or id").action((ref) => runCredentialsCommand("Delete credential failed", async ({ platform, local }) => {
 		if (local) {
 			const { client } = await createLocalCredentialsClient();
-			await client.credentials.deleteInstance(id);
+			await client.credentials.deleteInstance(ref);
 			return;
 		}
-		await platform.credentials.delete(id);
+		await platform.credentials.delete(ref);
 	}));
 }
 //#endregion
@@ -5114,49 +5754,6 @@ function envRefName(raw) {
 	return raw.slice(5);
 }
 //#endregion
-//#region src/project/resolve-project-root.ts
-function hasProjectLayout(dir) {
-	return existsSync(join(dir, "package.json")) && existsSync(join(dir, "src", "agents"));
-}
-function resolveProjectRoot(fromDir = process.cwd()) {
-	let dir = resolve(fromDir);
-	while (dir !== dirname(dir)) {
-		if (hasProjectLayout(dir)) return dir;
-		dir = dirname(dir);
-	}
-	if (hasProjectLayout(dir)) return dir;
-	throw new Error("Could not find keystroke project root (expected package.json and src/agents/)");
-}
-//#endregion
-//#region src/project/load-project-env.ts
-let loaded = false;
-function parseEnvFile(contents) {
-	const values = {};
-	for (const line of contents.split("\n")) {
-		const trimmed = line.trim();
-		if (!trimmed || trimmed.startsWith("#")) continue;
-		const eq = trimmed.indexOf("=");
-		if (eq === -1) continue;
-		const key = trimmed.slice(0, eq).trim();
-		let value = trimmed.slice(eq + 1).trim();
-		if (value.startsWith("\"") && value.endsWith("\"") || value.startsWith("'") && value.endsWith("'")) value = value.slice(1, -1);
-		values[key] = value;
-	}
-	return values;
-}
-function loadProjectEnv(fromDir = process.cwd()) {
-	if (loaded) return;
-	loaded = true;
-	let envPath;
-	try {
-		envPath = join(resolveProjectRoot(fromDir), ".env");
-	} catch {
-		return;
-	}
-	if (!existsSync(envPath)) return;
-	for (const [key, value] of Object.entries(parseEnvFile(readFileSync(envPath, "utf8")))) if (process.env[key] === void 0) process.env[key] = value;
-}
-//#endregion
 //#region src/commands/credentials/parse-value.ts
 function parseCredentialValueFields(fields) {
 	const value = {};
@@ -5202,8 +5799,7 @@ function collectSetValues$2(value, previous) {
 //#region src/commands/credentials/format-set-conflict-error.ts
 function describeInstance(instance) {
 	const defaultStatus = instance.isDefault ? "default" : "not default";
-	const labelStatus = instance.label ? `label: ${instance.label}` : "no label";
-	return `id: ${instance.id}, ${defaultStatus}, ${labelStatus}`;
+	return `${instance.name ? `name: ${instance.name}` : `slug: ${instance.slug}`}, ${defaultStatus}`;
 }
 function formatSetFields(setFields) {
 	return setFields.map((field) => `--set ${field}`).join(" ");
@@ -5212,10 +5808,10 @@ function formatSetConflictError(args) {
 	const binary = cliBinaryName();
 	const setArgs = formatSetFields(args.setFields);
 	const listCmd = `${binary} credentials list --key ${args.key}`;
-	const addSecondCmd = `${binary} credentials set ${args.key} --scope ${args.scope} --label <name> ${setArgs}`;
+	const addSecondCmd = `${binary} credentials set ${args.key} --scope ${args.scope} --slug <slug> ${setArgs}`;
 	if (args.matching.length === 1) {
 		const instance = args.matching[0];
-		const updateCmd = `${binary} credentials update ${instance.id} ${setArgs}`;
+		const updateCmd = `${binary} credentials update ${instance.slug} ${setArgs}`;
 		return [
 			`An ${args.key} credential already exists in ${args.scope} scope (${describeInstance(instance)}).`,
 			"credentials set creates a new instance — it does not update an existing one.",
@@ -5228,7 +5824,7 @@ function formatSetConflictError(args) {
 	}
 	const instanceLines = args.matching.map((instance) => `  • ${describeInstance(instance)}`);
 	return [
-		`Multiple ${args.key} credentials already exist in ${args.scope} scope. --label is required to add another:`,
+		`Multiple ${args.key} credentials already exist in ${args.scope} scope. Pass --slug to add another:`,
 		...instanceLines,
 		"To add another credential in the same scope:",
 		`  ${addSecondCmd}`,
@@ -5236,7 +5832,7 @@ function formatSetConflictError(args) {
 	].join("\n");
 }
 async function assertNoSetConflict(client, args) {
-	if (args.label) return;
+	if (args.slug) return;
 	const { instances } = await client.credentials.listInstances({ key: args.key });
 	const matching = instances.filter((instance) => instance.scopeType === args.scopeType && (args.scopeType !== "project" || instance.scopeId === args.projectId));
 	if (matching.length === 0) return;
@@ -5248,6 +5844,23 @@ async function assertNoSetConflict(client, args) {
 	}));
 }
 //#endregion
+//#region src/commands/connect/parse-connect-scopes.ts
+function parseConnectScopes(scopes, projectSlugs) {
+	const normalized = scopes.length > 0 ? scopes : ["org"];
+	for (const scope of normalized) if (scope !== "org" && scope !== "user" && scope !== "project") throw new Error(`Unknown scope "${scope}". Expected org, user, or project.`);
+	const createOrganizationCredential = normalized.includes("org");
+	const createUserProvidedCredential = normalized.includes("user");
+	const includesProject = normalized.includes("project");
+	const selectedProjects = includesProject ? projectSlugs : [];
+	if (includesProject && selectedProjects.length === 0) throw new Error("--project-slug is required when scope includes project");
+	if (!createOrganizationCredential && !createUserProvidedCredential && selectedProjects.length === 0) throw new Error("At least one scope is required via --scope and/or --project-slug");
+	return {
+		createOrganizationCredential,
+		createUserProvidedCredential,
+		projects: selectedProjects
+	};
+}
+//#endregion
 //#region src/commands/credentials/parse-set-scopes.ts
 function parseCredentialSetScopes(scopes, projectSlugs) {
 	return parseConnectScopes(scopes, projectSlugs);
@@ -5255,7 +5868,7 @@ function parseCredentialSetScopes(scopes, projectSlugs) {
 //#endregion
 //#region src/commands/credentials/set.ts
 function registerCredentialsSetCommand(credentials) {
-	credentials.command("set").description("Create a new api_key credential instance").argument("<key>", "Credential key or app id, e.g. exa").option("--scope <scope>", "org, user, or project (repeatable)", collectValues, []).option("--project-slug <slug>", "Project slug when scope includes project (repeatable)", collectValues, []).option("--label <label>", "Human-readable label within the scope").option("--default", "Mark as default for this scope").option("--set <field>", "Credential field as key=value or key=@env:VAR (falls back to project .env when unset in shell)", collectSetValues$1, []).action((key, options) => runCredentialsCommand("Set credential failed", async ({ platform, local }) => {
+	credentials.command("set").description("Create a new api_key credential instance").argument("<key>", "Credential key or app id, e.g. exa").option("--scope <scope>", "org, user, or project (repeatable)", collectValues, []).option("--project-slug <slug>", "Project slug when scope includes project (repeatable)", collectValues, []).option("--slug <slug>", "Friendly credential slug within the scope").option("--name <name>", "Display name (used to derive slug when --slug is omitted)").option("--label <label>", "Alias for --name").option("--default", "Mark as default for this scope").option("--set <field>", "Credential field as key=value or key=@env:VAR (falls back to project .env when unset in shell)", collectSetValues$1, []).action((key, options) => runCredentialsCommand("Set credential failed", async ({ platform, local }) => {
 		const value = parseCredentialValueFields(options.set);
 		const parsedScopes = parseCredentialSetScopes(options.scope, options.projectSlug);
 		if (local) {
@@ -5263,19 +5876,21 @@ function registerCredentialsSetCommand(credentials) {
 			const targets = expandLocalCredentialTargets(parsedScopes);
 			const instances = [];
 			for (const target of targets) {
+				const displayName = options.name ?? options.label;
 				await assertNoSetConflict(client, {
 					key,
 					scope: target.scope,
 					scopeType: target.scopeType,
 					projectId: target.projectSlug,
-					label: options.label,
+					slug: options.slug,
 					setFields: options.set
 				});
 				instances.push(await client.credentials.createInstance({
 					key,
 					scopeType: target.scopeType,
 					scopeId: target.projectSlug,
-					label: options.label,
+					...options.slug !== void 0 ? { slug: options.slug } : {},
+					...displayName !== void 0 ? { name: displayName } : {},
 					isDefault: options.default,
 					value
 				}));
@@ -5331,12 +5946,14 @@ function expandLocalCredentialTargets(targets) {
 //#endregion
 //#region src/commands/credentials/update.ts
 function registerCredentialsUpdateCommand(credentials) {
-	credentials.command("update").description("Update a credential instance").argument("<id>", "Credential instance id").option("--label <label>", "Human-readable label within the scope").option("--default", "Mark as default for this scope").option("--set <field>", "Credential field as key=value or key=@env:VAR", collectSetValues, []).action((id, options) => runCredentialsCommand("Update credential failed", async ({ platform, local }) => {
+	credentials.command("update").description("Update a credential instance").argument("<ref>", "Credential slug or id").option("--slug <slug>", "Update friendly slug").option("--name <name>", "Update display name").option("--label <label>", "Alias for --name").option("--default", "Mark as default for this scope").option("--set <field>", "Credential field as key=value or key=@env:VAR", collectSetValues, []).action((ref, options) => runCredentialsCommand("Update credential failed", async ({ platform, local }) => {
 		const value = options.set.length > 0 ? parseCredentialValueFields(options.set) : void 0;
+		const displayName = options.name ?? options.label;
 		if (local) {
 			const { client } = await createLocalCredentialsClient();
-			const result = await client.credentials.updateInstance(id, {
-				...options.label !== void 0 ? { label: options.label } : {},
+			const result = await client.credentials.updateInstance(ref, {
+				...options.slug !== void 0 ? { slug: options.slug } : {},
+				...displayName !== void 0 ? { name: displayName } : {},
 				...options.default !== void 0 ? { isDefault: options.default } : {},
 				...value ? { value } : {}
 			});
@@ -5344,11 +5961,11 @@ function registerCredentialsUpdateCommand(credentials) {
 			return;
 		}
 		const patch = buildPlatformUpdatePatch({
-			...options.label !== void 0 ? { label: options.label } : {},
+			...displayName !== void 0 ? { label: displayName } : {},
 			...options.default !== void 0 ? { isDefault: options.default } : {},
 			...value ? { value } : {}
 		});
-		const credential = await platform.credentials.update(id, patch);
+		const credential = await platform.credentials.update(ref, patch);
 		process.stdout.write(`${JSON.stringify({ credential }, null, 2)}\n`);
 	}));
 }
@@ -5365,11 +5982,13 @@ function registerCredentialsCommand(program) {
 	registerCredentialsUpdateCommand(credentials);
 	registerCredentialsRotateKeyCommand(credentials);
 	registerCredentialsDeleteCommand(credentials);
+	registerCredentialsAssignmentsCommands(credentials);
+	registerCredentialsConsumersCommands(credentials);
 }
 //#endregion
 //#region src/auth/resolve-login-targets.ts
 function resolveAuthLoginTargets(options, config) {
-	const webUrl = options.webUrl ?? "https://app.keystroke.ai";
+	const webUrl = options.webUrl ?? "https://keystroke.ai";
 	return {
 		webUrl,
 		platformUrl: resolvePlatformUrlForWebUrl(webUrl, {
@@ -5476,7 +6095,7 @@ function registerBuildCommand(program) {
 	program.command("build").description("Build the keystroke project for production").option("--dir <path>", "Project directory", process.cwd()).action(async (options) => {
 		try {
 			const root = resolveProjectRoot(options.dir);
-			const { buildApp } = await import("./dist-CJL2zYbP.mjs");
+			const { buildApp } = await import("./dist-jchdNGBU.mjs");
 			await buildApp({ root });
 			process.stdout.write(`Built ${root}\n`);
 		} catch (error) {
@@ -5487,109 +6106,6 @@ function registerBuildCommand(program) {
 	});
 }
 //#endregion
-//#region ../../packages/storage/dist/pack-artifact-NGxvGcXq.mjs
-/**
-* Pack a directory tree that contains a `dist/` folder into a gzip tarball
-* suitable for project-server extraction.
-*/
-function packDistTree(rootContainingDist) {
-	const tempDir = mkdtempSync(join(tmpdir(), "keystroke-artifact-pack-"));
-	const archivePath = join(tempDir, "artifact.tgz");
-	try {
-		const result = spawnSync("tar", [
-			"-czf",
-			archivePath,
-			"--exclude=._*",
-			"--exclude=.DS_Store",
-			"-C",
-			rootContainingDist,
-			"dist"
-		], {
-			encoding: "utf8",
-			env: {
-				...process.env,
-				COPYFILE_DISABLE: "1"
-			}
-		});
-		if (result.status !== 0) throw new Error(result.stderr?.trim() || "Failed to pack project artifact");
-		return readFileSync(archivePath);
-	} finally {
-		rmSync(tempDir, {
-			recursive: true,
-			force: true
-		});
-	}
-}
-/** Extract a packed project artifact tarball into `destDir` (creates `destDir/dist/`). */
-function extractProjectArtifact(archive, destDir) {
-	const tempDir = mkdtempSync(join(tmpdir(), "keystroke-artifact-extract-"));
-	const archivePath = join(tempDir, "artifact.tgz");
-	try {
-		writeFileSync(archivePath, archive);
-		const result = spawnSync("tar", [
-			"-xzf",
-			archivePath,
-			"-C",
-			destDir
-		], {
-			encoding: "utf8",
-			env: {
-				...process.env,
-				COPYFILE_DISABLE: "1"
-			}
-		});
-		if (result.status !== 0) throw new Error(result.stderr?.trim() || "Failed to extract project artifact");
-	} finally {
-		rmSync(tempDir, {
-			recursive: true,
-			force: true
-		});
-	}
-}
-function moduleFileOf(entry) {
-	return "moduleFile" in entry && typeof entry.moduleFile === "string" ? entry.moduleFile : void 0;
-}
-/** Replace manifest rows for rebuilt modules while keeping untouched routes and metadata. */
-function mergeStoredRouteManifest(base, rebuiltEntries) {
-	const rebuiltModuleFiles = new Set(rebuiltEntries.map(moduleFileOf).filter((value) => Boolean(value)));
-	const keptEntries = base.entries.filter((entry) => {
-		const moduleFile = moduleFileOf(entry);
-		if (!moduleFile) return true;
-		return !rebuiltModuleFiles.has(moduleFile);
-	});
-	const filteredRebuilt = rebuiltEntries.filter((entry) => entry.kind !== "health");
-	return {
-		...base,
-		entries: [...keptEntries, ...filteredRebuilt]
-	};
-}
-async function mergeFilteredArtifact(input) {
-	const mergeRoot = mkdtempSync(join(tmpdir(), "keystroke-artifact-merge-"));
-	try {
-		extractProjectArtifact(input.baseArchive, mergeRoot);
-		const manifestPath = join(mergeRoot, ROUTE_MANIFEST_REL_PATH);
-		const mergedManifest = mergeStoredRouteManifest(StoredRouteManifestSchema.parse(JSON.parse(readFileSync(manifestPath, "utf8"))), input.filtered.manifestEntries);
-		writeFileSync(manifestPath, `${JSON.stringify(mergedManifest, null, 2)}\n`);
-		for (const file of input.filtered.files) {
-			const destination = join(mergeRoot, "dist", file.relativePath);
-			mkdirSync(dirname(destination), { recursive: true });
-			writeFileSync(destination, file.contents);
-			if (file.sourceMap) writeFileSync(`${destination}.map`, file.sourceMap);
-		}
-		return packDistTree(mergeRoot);
-	} finally {
-		rmSync(mergeRoot, {
-			recursive: true,
-			force: true
-		});
-	}
-}
-/** Pack `dist/` into a gzip tarball suitable for `/app` extraction in the project server image. */
-function packProjectArtifact(projectRoot) {
-	if (!existsSync(join(projectRoot, "dist"))) throw new Error("dist/ not found — run keystroke build first");
-	return packDistTree(projectRoot);
-}
-//#endregion
 //#region src/commands/deploy.ts
 const POLL_INTERVAL_MS = 2e3;
 const DEPLOY_TIMEOUT_MS = 12e4;
@@ -5633,7 +6149,7 @@ async function sleep(ms) {
 }
 async function buildDeployArchive(client, root, projectId, filter) {
 	if (filter?.length) {
-		const { buildFilteredApp } = await import("./dist-CJL2zYbP.mjs");
+		const { buildFilteredApp } = await import("./dist-jchdNGBU.mjs");
 		const filtered = await buildFilteredApp({
 			root,
 			filter,
@@ -5655,7 +6171,7 @@ async function buildDeployArchive(client, root, projectId, filter) {
 			sourceFiles: filtered.sourceFiles
 		};
 	}
-	const { buildApp } = await import("./dist-CJL2zYbP.mjs");
+	const { buildApp } = await import("./dist-jchdNGBU.mjs");
 	const { sourceFiles } = await buildApp({
 		root,
 		collectSources: true,
@@ -5723,6 +6239,13 @@ function registerDeployCommand(program) {
 	});
 }
 //#endregion
+//#region src/resolve-local-api-origin.ts
+/** Local platform API origin from the project `.env` (`PUBLIC_PLATFORM_URL`). */
+function resolveLocalApiOrigin(fromDir = process.cwd()) {
+	loadProjectEnv(fromDir);
+	return resolvePublicPlatformOrigin(process.env);
+}
+//#endregion
 //#region src/project/runtime-child-env.ts
 /** Strip dev-only Node flags so the API child loads built `dist/`, not package `src/`. */
 function runtimeChildNodeOptions(nodeOptions) {
@@ -5761,14 +6284,13 @@ function runtimeChildEnv(parentEnv, overrides) {
 		env.DATABASE_URL = "file:./data/public.db";
 	}
 	env.KEYSTROKE_APP_MODE ??= "standalone";
-	env.PROJECT_ID ??= "default";
 	return env;
 }
 //#endregion
 //#region src/project/bootstrap-run.ts
 /** Node args + env for `@keystrokehq/build` bootstrap (shared by start + dev). */
 async function resolveBootstrapRun(options) {
-	const { resolveRuntimeBuildArtifact } = await import("./dist-CJL2zYbP.mjs");
+	const { resolveRuntimeBuildArtifact } = await import("./dist-jchdNGBU.mjs");
 	const loader = pathToFileURL(resolveRuntimeBuildArtifact(options.runtimeNodeModules, "dist/runtime-loader.mjs")).href;
 	const bootstrap = resolveRuntimeBuildArtifact(options.runtimeNodeModules, "dist/standalone-bootstrap.mjs");
 	const args = [`--import=${loader}`];
@@ -5778,10 +6300,9 @@ async function resolveBootstrapRun(options) {
 	const childEnv = runtimeChildEnv(process.env, {
 		KEYSTROKE_ROOT: options.root,
 		KEYSTROKE_RUNTIME_NODE_MODULES: options.runtimeNodeModules,
-		KEYSTROKE_APP_MODE: "standalone",
-		PROJECT_ID: process.env.PROJECT_ID ?? "default"
+		KEYSTROKE_APP_MODE: "standalone"
 	});
-	childEnv.PORT = String(listenPortFromPublicUrl(childEnv.PUBLIC_SERVER_URL, options.apiPort));
+	childEnv.PORT = String(listenPortFromPublicUrl(childEnv.PUBLIC_PLATFORM_URL, options.apiPort));
 	return {
 		cwd: options.root,
 		args,
@@ -5873,8 +6394,8 @@ const DEV_BANNER = "keystroke dev: watch rebuilds dist/ and restarts the API —
 function stopChild(child) {
 	if (child && !child.killed && child.pid !== void 0) child.kill("SIGTERM");
 }
-function resolveDevServerUrl(config, portOverride) {
-	const url = new URL(getServerUrl(config));
+function resolveDevServerUrl(root, portOverride) {
+	const url = new URL(resolveLocalApiOrigin(root));
 	if (portOverride !== void 0) url.port = String(portOverride);
 	return url.origin;
 }
@@ -5882,10 +6403,9 @@ async function runDev(options) {
 	const root = resolveProjectRoot(options.dir);
 	const runtimeNodeModules = resolveCliRuntimeNodeModules(resolveCliRoot(import.meta.url));
 	ensureNativeDeps(runtimeNodeModules);
-	const cliConfig = createCliConfig();
-	const configDir = getConfigDir(cliConfig);
+	const configDir = getConfigDir(createCliConfig());
 	process.stdout.write(DEV_BANNER);
-	const serverUrl = resolveDevServerUrl(cliConfig, options.port);
+	const serverUrl = resolveDevServerUrl(root, options.port);
 	const apiPort = Number(new URL(serverUrl).port || 80);
 	writeDevSession({
 		pid: process.pid,
@@ -5919,7 +6439,7 @@ async function runDev(options) {
 	process.on("SIGINT", shutdown);
 	process.on("SIGTERM", shutdown);
 	try {
-		const { watchApp } = await import("./dist-CJL2zYbP.mjs");
+		const { watchApp } = await import("./dist-jchdNGBU.mjs");
 		await watchApp({
 			root,
 			clean: false,
@@ -6069,10 +6589,11 @@ const INIT_CATALOG_VERSIONS = {
 	vitest: "^4.1.7",
 	"@types/node": "^25.9.1"
 };
+const INIT_KEYSTROKE_VERSION = "^0.1.5";
 //#endregion
 //#region src/init/copy-template.ts
 function renderTemplate(content, variables) {
-	let rendered = content.replaceAll("{{projectName}}", variables.projectName).replaceAll("{{version}}", variables.version);
+	let rendered = content.replaceAll("{{projectName}}", variables.projectName).replaceAll("{{keystrokeVersion}}", INIT_KEYSTROKE_VERSION).replaceAll("{{version}}", variables.version);
 	for (const [dep, version] of Object.entries(INIT_CATALOG_VERSIONS)) rendered = rendered.replaceAll(`{{catalog:${dep}}}`, version);
 	return rendered;
 }
@@ -6248,6 +6769,33 @@ function resolvePlaygroundRoot(targetDir) {
 	const rel = relative(join(root, "playground"), resolve(targetDir));
 	return rel.length > 0 && !rel.startsWith("..") && !isAbsolute(rel) ? root : null;
 }
+/** Example primitives the hello-world template ships; removed when --no-example is set. */
+const EXAMPLE_FILES = [
+	"src/actions/greet.ts",
+	"src/agents/hello.ts",
+	"src/agents/hello.int.test.ts",
+	"src/workflows/greeting.ts",
+	"src/workflows/greeting.test.ts"
+];
+async function removeExampleFiles(targetDir) {
+	await Promise.all(EXAMPLE_FILES.map((rel) => rm(join(targetDir, rel), { force: true })));
+}
+/**
+* Drop the README sections that walk through the example hello agent / greeting
+* workflow — those primitives don't exist in a --no-example scaffold (e.g. MCP
+* sprite bootstrap), so shipping their usage docs is misleading.
+*/
+async function stripExampleReadme(targetDir) {
+	const readmePath = join(targetDir, "README.md");
+	let content;
+	try {
+		content = await readFile(readmePath, "utf8");
+	} catch {
+		return;
+	}
+	const next = content.replace(/Prompt the hello agent:\n+```bash\n[\s\S]*?\n```\n+/, "").replace(/Run the greeting workflow:\n+```bash\n[\s\S]*?\n```\n+/, "").replace(/\nExample: `src\/workflows\/greeting\.test\.ts`[^\n]*\n/, "\n");
+	if (next !== content) await writeFile(readmePath, next);
+}
 async function directoryExists(path) {
 	try {
 		await access(path);
@@ -6281,6 +6829,10 @@ async function runInit(options) {
 		version: options.version
 	});
 	await scaffoldEmptySrcDirs(targetDir);
+	if (options.noExample) {
+		await removeExampleFiles(targetDir);
+		await stripExampleReadme(targetDir);
+	}
 	if (playgroundRoot) await applyPlaygroundManifest(targetDir, projectName, playgroundRoot);
 	else await scaffoldProjectDotfiles(targetDir);
 	await syncBundledSkills(targetDir);
@@ -6297,7 +6849,7 @@ async function runInit(options) {
 //#endregion
 //#region src/commands/init.ts
 function registerInitCommand(program) {
-	program.command("init").description("Create a new keystroke project from a template").argument("[directory]", "Directory to create the project in").option("--name <name>", "Project name (kebab-case)").option("--template <name>", "Template to use", "hello-world").option("-y, --yes", "Skip prompts (headless mode for scripts and AI agents)").option("--skip-install", "Skip dependency installation").option("--pm <manager>", "Package manager: npm, pnpm, yarn, or bun").action(async (directory, options) => {
+	program.command("init").description("Create a new keystroke project from a template").argument("[directory]", "Directory to create the project in").option("--name <name>", "Project name (kebab-case)").option("--template <name>", "Template to use", "hello-world").option("-y, --yes", "Skip prompts (headless mode for scripts and AI agents)").option("--skip-install", "Skip dependency installation").option("--pm <manager>", "Package manager: npm, pnpm, yarn, or bun").option("--no-example", "Scaffold without the example action, agent, and workflow").action(async (directory, options) => {
 		try {
 			const result = await runInit({
 				directory,
@@ -6306,6 +6858,7 @@ function registerInitCommand(program) {
 				yes: options.yes,
 				skipInstall: options.skipInstall,
 				packageManager: options.pm,
+				noExample: options.example === false,
 				version: readCliVersion()
 			});
 			process.stdout.write(`Created keystroke project "${result.projectName}" at ${result.targetDir}\n`);
@@ -6734,18 +7287,18 @@ function registerProjectCommand(program) {
 }
 //#endregion
 //#region src/commands/start.ts
-function resolveStartServerUrl(portOverride) {
-	const url = new URL(getServerUrl(createCliConfig()));
+function resolveStartServerUrl(root, portOverride) {
+	const url = new URL(resolveLocalApiOrigin(root));
 	if (portOverride !== void 0) url.port = String(portOverride);
 	return url.origin;
 }
 async function runStart(options) {
 	const root = resolveProjectRoot(options.dir);
-	const serverUrl = resolveStartServerUrl(options.port);
+	const serverUrl = resolveStartServerUrl(root, options.port);
 	const apiPort = Number(new URL(serverUrl).port || 80);
 	const runtimeNodeModules = resolveCliRuntimeNodeModules(resolveCliRoot(import.meta.url));
 	ensureNativeDeps(runtimeNodeModules);
-	const { buildApp } = await import("./dist-CJL2zYbP.mjs");
+	const { buildApp } = await import("./dist-jchdNGBU.mjs");
 	await buildApp({
 		root,
 		clean: false
@@ -6828,6 +7381,61 @@ function registerTriggerRunsCommand(trigger) {
 	}));
 }
 //#endregion
+//#region src/commands/trigger/resolve-trigger-attachment.ts
+function findAssignment(assignments, attachmentRef) {
+	return assignments.find((entry) => entry.attachmentId === attachmentRef || entry.attachmentSlug === attachmentRef);
+}
+async function resolveTriggerAttachment(platform, triggerRef, attachmentRef) {
+	let trigger = await platform.triggers.get(triggerRef);
+	if (!trigger) {
+		const summary = (await platform.triggers.list()).find((entry) => entry.id === triggerRef || entry.slug === triggerRef) ?? null;
+		if (summary) trigger = await platform.triggers.get(summary.id);
+	}
+	if (!trigger) throw new Error(`Trigger not found: ${triggerRef}`);
+	const assignment = findAssignment(trigger.assignments, attachmentRef);
+	if (!assignment) throw new Error(`Attachment not found on trigger ${trigger.slug}: ${attachmentRef}`);
+	return {
+		triggerId: trigger.id,
+		attachmentId: assignment.attachmentId,
+		trigger,
+		assignment
+	};
+}
+//#endregion
+//#region src/commands/trigger/run-attachment-enabled.ts
+async function runTriggerAttachmentEnabled(config, options) {
+	await withActivePlatformClient(config, async (platform) => {
+		const resolved = await resolveTriggerAttachment(platform, options.triggerRef, options.attachmentRef);
+		const trigger = await platform.triggers.updateAttachment(resolved.triggerId, resolved.attachmentId, { enabled: options.enabled });
+		process.stdout.write(`${JSON.stringify(trigger, null, 2)}\n`);
+	});
+}
+//#endregion
+//#region src/commands/trigger/attachment.ts
+function registerAttachmentToggleCommand(attachment, command, enabled) {
+	attachment.command(command).description(`${command === "enable" ? "Enable" : "Disable"} a trigger attachment`).argument("<triggerRef>", "Trigger id or slug").argument("<attachmentRef>", "Attachment id or slug (for example signup:signup-pipeline)").action(async (triggerRef, attachmentRef) => {
+		const config = createCliConfig();
+		try {
+			await runTriggerAttachmentEnabled(config, {
+				triggerRef,
+				attachmentRef,
+				enabled
+			});
+		} catch (error) {
+			process.stderr.write(`${formatCliError(error, `${command} trigger attachment failed`, {
+				serverUrl: getPlatformUrl(config),
+				webUrl: getWebUrl(config)
+			})}\n`);
+			process.exitCode = 1;
+		}
+	});
+}
+function registerTriggerAttachmentCommand(trigger) {
+	const attachment = trigger.command("attachment").description("Enable or disable individual trigger attachments");
+	registerAttachmentToggleCommand(attachment, "disable", false);
+	registerAttachmentToggleCommand(attachment, "enable", true);
+}
+//#endregion
 //#region src/commands/trigger/index.ts
 function registerTriggerCommand(program) {
 	const trigger = program.command("trigger").description("Invoke and inspect triggers");
@@ -6836,6 +7444,7 @@ function registerTriggerCommand(program) {
 	registerTriggerUrlCommand(trigger);
 	registerTriggerPollCommand(trigger);
 	registerTriggerRunsCommand(trigger);
+	registerTriggerAttachmentCommand(trigger);
 }
 //#endregion
 //#region src/commands/workflow/list.ts
@@ -7129,9 +7738,9 @@ function registerConfigCommand(program) {
 		const cliConfig = createCliConfig();
 		const configDir = getConfigDir(cliConfig);
 		process.stdout.write(`${JSON.stringify({
-			serverUrl: cliConfig.get("serverUrl"),
 			webUrl: cliConfig.get("webUrl"),
 			platformUrl: getPlatformUrl(cliConfig),
+			localApiUrl: resolveLocalApiOrigin(process.cwd()),
 			activeOrganizationId: cliConfig.get("activeOrganizationId"),
 			activeProjectId: cliConfig.get("activeProjectId"),
 			apiTarget: getEffectiveApiTarget(cliConfig),
@@ -7201,19 +7810,6 @@ function registerSkillsCommand(program) {
 	});
 }
 //#endregion
-//#region src/project/resolve-keystroke-config-root.ts
-const KEYSTROKE_CONFIG = "keystroke.config.ts";
-/** Walk up from `fromDir` and return the directory containing `keystroke.config.ts`, if any. */
-function resolveKeystrokeConfigRoot(fromDir = process.cwd()) {
-	let dir = resolve(fromDir);
-	while (dir !== dirname(dir)) {
-		if (existsSync(join(dir, KEYSTROKE_CONFIG))) return dir;
-		dir = dirname(dir);
-	}
-	if (existsSync(join(dir, KEYSTROKE_CONFIG))) return dir;
-	return null;
-}
-//#endregion
 //#region src/skills/sync-skills.ts
 function commandPath(command) {
 	const names = [];
@@ -7281,7 +7877,7 @@ function createProgram() {
 	return program;
 }
 async function runCli(argv) {
-	const { maybeAutoUpdate } = await import("./maybe-auto-update-B0kal2FM.mjs");
+	const { maybeAutoUpdate } = await import("./maybe-auto-update-ClXO7U-6.mjs");
 	await maybeAutoUpdate(argv);
 	createProgram().parse(argv);
 }