@keystrokehq/cli 0.1.5 → 0.1.9

package/dist/index.mjs

@@ -1,13 +1,14 @@
 #!/usr/bin/env node
-import { $ as ListCredentialsResponseSchema, $t as UpsertGatewayAttachmentBodySchema, A as CreateOrganizationResponseSchema, At as SlugAvailabilityResponseSchema, B as GetCredentialResponseSchema, Bt as TriggerRunListResponseSchema, C as CreateApiKeyResponseSchema, Ct as PromptResponseSchema, D as CreateCustomAppRequestSchema, Dt as RecentResourceListResponseSchema, E as CreateCredentialsResponseSchema, Et as ROUTE_MANIFEST_REL_PATH, F as CredentialInstanceRecordSchema, Ft as StoredRouteManifestSchema, G as HistoryRunListQuerySchema, Gt as UpdateOrganizationMemberResponseSchema, H as HealthResponseSchema, Ht as UpdateCredentialInstanceBodySchema, I as DeclineOrganizationInvitationResponseSchema, It as SubmitTeamRequestRequestSchema, J as InviteOrganizationMembersResponseSchema, Jt as UpdateProjectMemberResponseSchema, K as HistoryRunListResponseSchema, Kt as UpdateOrganizationRequestSchema, L as DownloadActiveProjectArtifactResponseSchema, Lt as TriggerDetailResponseSchema, M as CreateProjectRequestSchema, Mt as StartKeystrokeConnectionResultSchema, N as CreateProjectResponseSchema, Nt as StartOAuthConnectionInputSchema, O as CreateCustomAppResponseSchema, Ot as SkillSummaryDetailResponseSchema, P as CredentialInstanceListResponseSchema, Pt as StartOAuthConnectionResultSchema, Q as ListAppsResponseSchema, Qt as UploadProjectSourceResponseSchema, R as ErrorResponseSchema, Rt as TriggerListResponseSchema, S as CreateApiKeyRequestSchema, St as PromptInputSchema, T as CreateCredentialsRequestSchema, Tt as QueuedRunResponseSchema, U as HistoryRunCancelResponseSchema, Ut as UpdateCredentialRequestSchema, V as GetCustomAppResponseSchema, Vt as UpdateChannelBindingBodySchema, W as HistoryRunDetailResponseSchema, Wt as UpdateOrganizationMemberRequestSchema, X as InviteProjectMembersResponseSchema, Xt as UpdateProjectSettingsRequestSchema, Y as InviteProjectMembersRequestSchema, Yt as UpdateProjectRequestSchema, Z as ListApiKeysResponseSchema, Zt as UploadProjectSourceManifestRequestSchema, _ as ChannelDirectoryListResponseSchema, _t as PresignUserAvatarResponseSchema, a as AgentSessionListResponseSchema, an as WorkflowRunListResponseSchema, at as ListProjectMembersResponseSchema, b as ConnectAuthorizeUrlResponseSchema, bt as ProjectSettingsResponseSchema, c as AppSlugAvailabilityResponseSchema, cn as listenPortFromPublicUrl, ct as OrganizationSidebarBrandingPatchSchema, d as CatalogActionsPageResponseSchema, dn as parseAppSlug, dt as PollRunResponseSchema, en as UserAvatarPatchSchema, et as ListOrganizationInvitationsResponseSchema, f as CatalogAppDetailResponseSchema, fn as parseErrorResponse, ft as PresignOrgLogoRequestSchema, g as ChannelConnectionSchema, gt as PresignUserAvatarRequestSchema, h as ChannelConnectionListResponseSchema, ht as PresignProjectSourceResponseSchema, i as AgentSessionDetailResponseSchema, in as WorkflowRunDetailResponseSchema, it as ListProjectFilesResponseSchema, j as CreateProjectArtifactResponseSchema, jt as StartKeystrokeConnectionInputSchema, k as CreateOrganizationRequestSchema, kt as SkillSummaryListResponseSchema, l as BindChannelBodySchema, lt as OrganizationSidebarBrandingSchema, m as ChannelAccountListResponseSchema, mt as PresignProjectSourceRequestSchema, n as AcceptOrganizationInvitationResponseSchema, nn as UserPreferencesPatchSchema, nt as ListOrganizationsResponseSchema, o as AgentSummaryDetailResponseSchema, on as WorkflowSummaryDetailResponseSchema, ot as ListProjectMetricsResponseSchema, p as CatalogAppsPageResponseSchema, pn as slugifyAppName, pt as PresignOrgLogoResponseSchema, q as InviteOrganizationMembersRequestSchema, qt as UpdateProjectMemberRequestSchema, r as ActiveOrganizationResponseSchema, rn as UserPreferencesSchema, rt as ListProjectDeploymentsResponseSchema, s as AgentSummaryListResponseSchema, sn as WorkflowSummaryListResponseSchema, st as ListProjectsResponseSchema, t as ACTIVE_ORG_HEADER, tn as UserAvatarSchema, tt as ListOrganizationMembersResponseSchema, u as CatalogActionDetailResponseSchema, ut as PROJECT_REACHABILITY_REQUEST_TIMEOUT_MS, v as ChannelPlatformSchema, vt as ProjectReachabilityResponseSchema, w as CreateCredentialInstanceBodySchema, wt as QueuedAgentPromptResponseSchema, x as ConnectProvidersResponseSchema, xt as ProjectSlugAvailabilityResponseSchema, y as CompleteProjectArtifactResponseSchema, yt as ProjectResponseSchema, z as GatewayAttachmentRecordSchema, zt as TriggerRunDetailResponseSchema } from "./dist-C3YClLXV.mjs";
-import { _ as resolvePlatformUrlForWebUrl, a as installPlaygroundDependencies, c as createCliConfig, d as getEffectiveApiTarget, f as getPlatformUrl, h as DEFAULT_PLATFORM_URL, i as installDependencies, l as getCliConfigDir, m as getWebUrl, n as buildPlaygroundWorkspace, o as resolvePackageManager, p as getServerUrl, s as resolveCliRoot, t as readCliVersion, u as getConfigDir } from "./version-BOm_5ar9.mjs";
+import { $ as HistoryRunDetailResponseSchema, $t as TriggerDetailResponseSchema, A as CreateCustomAppRequestSchema, At as PresignUserAvatarRequestSchema, B as CredentialConsumerListQuerySchema, C as ConnectAuthorizeUrlResponseSchema, Cn as WorkflowSummaryListResponseSchema, Ct as OrganizationSidebarBrandingSchema, D as CreateCredentialInstanceBodySchema, Dn as WorkspaceTriggerOverviewSchema, Dt as PresignOrgLogoResponseSchema, E as CreateApiKeyResponseSchema, En as WorkspaceTriggerListResponseSchema, Et as PresignOrgLogoRequestSchema, F as CreateProjectRequestSchema, Fn as parseErrorResponse, Ft as ProjectSlugAvailabilityResponseSchema, G as DownloadActiveProjectArtifactResponseSchema, Gt as StartKeystrokeConnectionInputSchema, H as CredentialInstanceListResponseSchema, Ht as SkillSummaryDetailResponseSchema, I as CreateProjectResponseSchema, It as PromptInputSchema, J as GetCredentialResponseSchema, Jt as StartMcpOAuthConnectionResultSchema, K as ErrorResponseSchema, Kt as StartKeystrokeConnectionResultSchema, L as CredentialAssignmentListQuerySchema, Ln as resolvePublicPlatformOrigin, Lt as PromptResponseSchema, M as CreateOrganizationRequestSchema, Mt as ProjectReachabilityResponseSchema, N as CreateOrganizationResponseSchema, Nt as ProjectResponseSchema, O as CreateCredentialsRequestSchema, On as WorkspaceTriggerRunListResponseSchema, Ot as PresignProjectSourceRequestSchema, P as CreateProjectArtifactResponseSchema, Pn as parseAppSlug, Pt as ProjectSettingsResponseSchema, Q as HistoryRunCancelResponseSchema, Qt as SubmitTeamRequestRequestSchema, R as CredentialAssignmentListResponseSchema, Rn as slugifyAppName, Rt as QueuedAgentPromptResponseSchema, S as CompleteProjectArtifactResponseSchema, Sn as WorkflowSummaryDetailResponseSchema, St as OrganizationSidebarBrandingPatchSchema, T as CreateApiKeyRequestSchema, Tn as WorkspaceTriggerFileSchema, Tt as PollRunResponseSchema, U as CredentialInstanceRecordSchema, Ut as SkillSummaryListResponseSchema, V as CredentialConsumerListResponseSchema, Vt as RecentResourceListResponseSchema, W as DeclineOrganizationInvitationResponseSchema, Wt as SlugAvailabilityResponseSchema, X as GraphqlDiscoverResponseSchema, Xt as StartOAuthConnectionResultSchema, Y as GetCustomAppResponseSchema, Yt as StartOAuthConnectionInputSchema, Z as HealthResponseSchema, Zt as SubmitMarketingContactRequestSchema, _ as ChannelAccountListResponseSchema, _n as UserAvatarSchema, _t as ListProjectMembersResponseSchema, a as AgentSessionDetailResponseSchema, an as UpdateCredentialRequestSchema, at as InviteProjectMembersResponseSchema, b as ChannelDirectoryListResponseSchema, bn as WorkflowRunDetailResponseSchema, bt as McpDiscoverResponseSchema, c as AgentSummaryListResponseSchema, cn as UpdateOrganizationRequestSchema, ct as ListAgentWorkspaceFilesResponseSchema, d as AssignCredentialBodySchema, dn as UpdateProjectRequestSchema, dt as ListCredentialsResponseSchema, en as TriggerListResponseSchema, et as HistoryRunListQuerySchema, f as BindChannelBodySchema, fn as UpdateProjectSettingsRequestSchema, ft as ListOrganizationInvitationsResponseSchema, g as CatalogAppsPageResponseSchema, gn as UserAvatarPatchSchema, gt as ListProjectFilesResponseSchema, h as CatalogAppDetailResponseSchema, hn as UpsertGatewayAttachmentBodySchema, ht as ListProjectDeploymentsResponseSchema, i as AgentSessionChatStateResponseSchema, in as UpdateCredentialInstanceBodySchema, it as InviteProjectMembersRequestSchema, j as CreateCustomAppResponseSchema, jn as listenPortFromPublicUrl, jt as PresignUserAvatarResponseSchema, k as CreateCredentialsResponseSchema, kn as buildConnectDeeplink, kt as PresignProjectSourceResponseSchema, l as AgentTriggerSummaryListResponseSchema, ln as UpdateProjectMemberRequestSchema, lt as ListApiKeysResponseSchema, m as CatalogActionsPageResponseSchema, mn as UploadProjectSourceResponseSchema, mt as ListOrganizationsResponseSchema, n as AcceptOrganizationInvitationResponseSchema, nn as TriggerRunListResponseSchema, nt as InviteOrganizationMembersRequestSchema, o as AgentSessionListResponseSchema, on as UpdateOrganizationMemberRequestSchema, p as CatalogActionDetailResponseSchema, pn as UploadProjectSourceManifestRequestSchema, pt as ListOrganizationMembersResponseSchema, q as GatewayAttachmentRecordSchema, qt as StartMcpOAuthConnectionInputSchema, r as ActiveOrganizationResponseSchema, rn as UpdateChannelBindingBodySchema, rt as InviteOrganizationMembersResponseSchema, s as AgentSummaryDetailResponseSchema, sn as UpdateOrganizationMemberResponseSchema, st as ListAgentMemoryFilesResponseSchema, t as ACTIVE_ORG_HEADER, tn as TriggerRunDetailResponseSchema, tt as HistoryRunListResponseSchema, u as AppSlugAvailabilityResponseSchema, un as UpdateProjectMemberResponseSchema, ut as ListAppsResponseSchema, v as ChannelConnectionListResponseSchema, vn as UserPreferencesPatchSchema, vt as ListProjectMetricsResponseSchema, w as ConnectProvidersResponseSchema, wn as WorkspaceTriggerDetailSchema, wt as PROJECT_REACHABILITY_REQUEST_TIMEOUT_MS, x as ChannelPlatformSchema, xn as WorkflowRunListResponseSchema, xt as OpenApiDiscoverResponseSchema, y as ChannelConnectionSchema, yn as UserPreferencesSchema, yt as ListProjectsResponseSchema, z as CredentialAssignmentRecordSchema, zt as QueuedRunResponseSchema } from "./dist-YV-kApfg.mjs";
+import { a as installPlaygroundDependencies, c as createCliConfig, d as getEffectiveApiTarget, f as getPlatformUrl, g as resolvePlatformUrlForWebUrl, i as installDependencies, l as getCliConfigDir, m as DEFAULT_PLATFORM_URL, n as buildPlaygroundWorkspace, o as resolvePackageManager, p as getWebUrl, s as resolveCliRoot, t as readCliVersion, u as getConfigDir } from "./version-BGuC7Cpu.mjs";
+import { n as packProjectArtifact, t as mergeFilteredArtifact } from "./pack-artifact-DVnIKrsg-BtNTTQcz.mjs";
 import { createRequire } from "node:module";
 import { Command } from "commander";
-import { platform, tmpdir } from "node:os";
+import { platform } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { Entry } from "@napi-rs/keyring";
 import { confirm, input, select } from "@inquirer/prompts";
-import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
+import { existsSync, lstatSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { access, copyFile, cp, lstat, mkdir, readFile, readdir, rm, stat, symlink, unlink, writeFile } from "node:fs/promises";
 import { spawn, spawnSync } from "node:child_process";
 import { pathToFileURL } from "node:url";
@@ -1433,6 +1434,40 @@ function createCredentialsResource$1(http) {
 			} catch (error) {
 				throw await toKeystrokeError(error);
 			}
+		},
+		async listAssignments(query) {
+			try {
+				const params = CredentialAssignmentListQuerySchema.parse(query);
+				const data = await http.get("credentials/assignments", { searchParams: params }).json();
+				return CredentialAssignmentListResponseSchema.parse(data);
+			} catch (error) {
+				throw await toKeystrokeError(error);
+			}
+		},
+		async assignCredential(body) {
+			try {
+				const payload = AssignCredentialBodySchema.parse(body);
+				const data = await http.put("credentials/assignments", { json: payload }).json();
+				return CredentialAssignmentRecordSchema.parse(data);
+			} catch (error) {
+				throw await toKeystrokeError(error);
+			}
+		},
+		async unassignCredential(id) {
+			try {
+				await http.delete(`credentials/assignments/${id}`);
+			} catch (error) {
+				throw await toKeystrokeError(error);
+			}
+		},
+		async listConsumers(query) {
+			try {
+				const params = CredentialConsumerListQuerySchema.parse(query);
+				const data = await http.get("credentials/consumers", { searchParams: params }).json();
+				return CredentialConsumerListResponseSchema.parse(data);
+			} catch (error) {
+				throw await toKeystrokeError(error);
+			}
 		}
 	};
 }
@@ -1474,7 +1509,7 @@ function detailSearchParams$1(query) {
 	if (!query?.include) return {};
 	return { include: query.include };
 }
-function createTriggersResource(http) {
+function createTriggersResource$1(http) {
 	return {
 		async list(query) {
 			try {
@@ -1552,7 +1587,7 @@ function createTriggersResource(http) {
 function isQueuedRunResponse(value) {
 	return QueuedRunResponseSchema.safeParse(value).success;
 }
-function listRunsSearchParams(query) {
+function listRunsSearchParams$2(query) {
 	if (!query) return {};
 	const params = {};
 	if (query.limit !== void 0) params.limit = String(query.limit);
@@ -1579,7 +1614,7 @@ function createWorkflowsResource$1(http) {
 		},
 		async listRuns(workflowId, query) {
 			try {
-				const data = await http.get(`workflows/${workflowId}/runs`, { searchParams: listRunsSearchParams(query) }).json();
+				const data = await http.get(`workflows/${workflowId}/runs`, { searchParams: listRunsSearchParams$2(query) }).json();
 				return WorkflowRunListResponseSchema.parse(data);
 			} catch (error) {
 				throw await toKeystrokeError(error);
@@ -1616,7 +1651,7 @@ function createKeystrokeClient(options) {
 		openapi: createOpenApiResource(http),
 		agents: createAgentsResource$1(http),
 		workflows: createWorkflowsResource$1(http),
-		triggers: createTriggersResource(http)
+		triggers: createTriggersResource$1(http)
 	};
 }
 //#endregion
@@ -1700,7 +1735,7 @@ function createJwtTokenCache(mint) {
 	};
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._648f7a3b727ed48c95c8caf5024eaef9/node_modules/better-auth/dist/version.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._775c78039924a67af81d79c1d7be3379/node_modules/better-auth/dist/version.mjs
 const PACKAGE_VERSION = "1.6.11";
 //#endregion
 //#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.4.3/node_modules/better-call/dist/error.mjs
@@ -1825,7 +1860,7 @@ var BetterAuthError = class extends Error {
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._648f7a3b727ed48c95c8caf5024eaef9/node_modules/better-auth/dist/plugins/device-authorization/client.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._775c78039924a67af81d79c1d7be3379/node_modules/better-auth/dist/plugins/device-authorization/client.mjs
 const deviceAuthorizationClient = () => {
 	return {
 		id: "device-authorization",
@@ -1970,7 +2005,7 @@ let onMount = ($store, initialize) => {
 	});
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._648f7a3b727ed48c95c8caf5024eaef9/node_modules/better-auth/dist/client/query.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._775c78039924a67af81d79c1d7be3379/node_modules/better-auth/dist/client/query.mjs
 const isServer = () => typeof window === "undefined";
 const useAuthQuery = (initializedAtom, path, $fetch, options) => {
 	const value = /* @__PURE__ */ atom({
@@ -2064,7 +2099,7 @@ const useAuthQuery = (initializedAtom, path, $fetch, options) => {
 	return value;
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._648f7a3b727ed48c95c8caf5024eaef9/node_modules/better-auth/dist/client/broadcast-channel.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._775c78039924a67af81d79c1d7be3379/node_modules/better-auth/dist/client/broadcast-channel.mjs
 const kBroadcastChannel = Symbol.for("better-auth:broadcast-channel");
 const now$1 = () => Math.floor(Date.now() / 1e3);
 var WindowBroadcastChannel = class {
@@ -2107,7 +2142,7 @@ function getGlobalBroadcastChannel(name = "better-auth.message") {
 	return globalThis[kBroadcastChannel];
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._648f7a3b727ed48c95c8caf5024eaef9/node_modules/better-auth/dist/client/focus-manager.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._775c78039924a67af81d79c1d7be3379/node_modules/better-auth/dist/client/focus-manager.mjs
 const kFocusManager = Symbol.for("better-auth:focus-manager");
 var WindowFocusManager = class {
 	listeners = /* @__PURE__ */ new Set();
@@ -2136,7 +2171,7 @@ function getGlobalFocusManager() {
 	return globalThis[kFocusManager];
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._648f7a3b727ed48c95c8caf5024eaef9/node_modules/better-auth/dist/client/online-manager.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._775c78039924a67af81d79c1d7be3379/node_modules/better-auth/dist/client/online-manager.mjs
 const kOnlineManager = Symbol.for("better-auth:online-manager");
 var WindowOnlineManager = class {
 	listeners = /* @__PURE__ */ new Set();
@@ -2168,7 +2203,7 @@ function getGlobalOnlineManager() {
 	return globalThis[kOnlineManager];
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._648f7a3b727ed48c95c8caf5024eaef9/node_modules/better-auth/dist/client/parser.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._775c78039924a67af81d79c1d7be3379/node_modules/better-auth/dist/client/parser.mjs
 const PROTO_POLLUTION_PATTERNS = {
 	proto: /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/,
 	constructor: /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/,
@@ -2238,7 +2273,7 @@ function parseJSON(value, options = { strict: true }) {
 	return betterJSONParse(value, options);
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._648f7a3b727ed48c95c8caf5024eaef9/node_modules/better-auth/dist/client/session-refresh.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._775c78039924a67af81d79c1d7be3379/node_modules/better-auth/dist/client/session-refresh.mjs
 const now = () => Math.floor(Date.now() / 1e3);
 /**
 * Normalize $fetch response: `throw: true` returns data directly, otherwise `{ data, error }`.
@@ -2436,7 +2471,7 @@ Object.freeze({
 	}
 });
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._648f7a3b727ed48c95c8caf5024eaef9/node_modules/better-auth/dist/utils/url.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._775c78039924a67af81d79c1d7be3379/node_modules/better-auth/dist/utils/url.mjs
 function checkHasPath(url) {
 	try {
 		return (new URL(url).pathname.replace(/\/+$/, "") || "/") !== "/";
@@ -2508,7 +2543,7 @@ function getOrigin(url) {
 	}
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._648f7a3b727ed48c95c8caf5024eaef9/node_modules/better-auth/dist/client/fetch-plugins.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._775c78039924a67af81d79c1d7be3379/node_modules/better-auth/dist/client/fetch-plugins.mjs
 const redirectPlugin = {
 	id: "redirect",
 	name: "Redirect",
@@ -2523,7 +2558,7 @@ const redirectPlugin = {
 	} }
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._648f7a3b727ed48c95c8caf5024eaef9/node_modules/better-auth/dist/client/session-atom.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._775c78039924a67af81d79c1d7be3379/node_modules/better-auth/dist/client/session-atom.mjs
 function getSessionAtom($fetch, options) {
 	const $signal = /* @__PURE__ */ atom(false);
 	const session = useAuthQuery($signal, "/get-session", $fetch, { method: "GET" });
@@ -3010,7 +3045,7 @@ var betterFetch = async (url, options) => {
 	};
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._648f7a3b727ed48c95c8caf5024eaef9/node_modules/better-auth/dist/client/config.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._775c78039924a67af81d79c1d7be3379/node_modules/better-auth/dist/client/config.mjs
 const resolvePublicAuthUrl = (basePath) => {
 	if (typeof process === "undefined") return void 0;
 	const path = basePath ?? "/api/auth";
@@ -3108,12 +3143,12 @@ const getClientConfig = (options, loadEnv) => {
 	};
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._648f7a3b727ed48c95c8caf5024eaef9/node_modules/better-auth/dist/utils/is-atom.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._775c78039924a67af81d79c1d7be3379/node_modules/better-auth/dist/utils/is-atom.mjs
 function isAtom(value) {
 	return typeof value === "object" && value !== null && "get" in value && typeof value.get === "function" && "lc" in value && typeof value.lc === "number";
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._648f7a3b727ed48c95c8caf5024eaef9/node_modules/better-auth/dist/client/proxy.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._775c78039924a67af81d79c1d7be3379/node_modules/better-auth/dist/client/proxy.mjs
 function getMethod(path, knownPathMethods, args) {
 	const method = knownPathMethods[path];
 	const { fetchOptions, query: _query, ...body } = args || {};
@@ -3193,7 +3228,7 @@ function capitalizeFirstLetter(str) {
 	return str.charAt(0).toUpperCase() + str.slice(1);
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._648f7a3b727ed48c95c8caf5024eaef9/node_modules/better-auth/dist/client/vanilla.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._775c78039924a67af81d79c1d7be3379/node_modules/better-auth/dist/client/vanilla.mjs
 function createAuthClient(options) {
 	const { pluginPathMethods, pluginsActions, pluginsAtoms, $fetch, atomListeners, $store } = getClientConfig(options);
 	const resolvedHooks = {};
@@ -3303,8 +3338,13 @@ async function getCliJwt(platformUrl, force = false) {
 }
 //#endregion
 //#region src/auth/resolve-cli-auth.ts
-/** Returns JWT bearer auth when a session refresh token is stored; otherwise none. */
+/** Returns API key, JWT bearer, or none auth for platform requests. */
 function resolveCliAuth(config) {
+	const apiKey = process.env.KEYSTROKE_API_KEY?.trim();
+	if (apiKey) return {
+		type: "apiKey",
+		getKey: () => apiKey
+	};
 	const platformUrl = getPlatformUrl(config);
 	if (!getAccessToken(platformUrl)) return { type: "none" };
 	return {
@@ -3582,6 +3622,88 @@ function createAgentsResource(http) {
 			} catch (error) {
 				throw await toPlatformError(error);
 			}
+		},
+		/**
+		* Prompting goes through the project-scoped runtime route
+		* (`POST /api/projects/:projectId/agents/:slug`) so it reuses the runtime's
+		* `requireProject` + `requireProjectMembership` auth — a user must belong to
+		* the project to prompt its agents.
+		*/
+		async prompt(projectId, agentSlug, input) {
+			try {
+				const payload = PromptInputSchema.parse(input);
+				const data = await (await http.post(`api/projects/${encodeURIComponent(projectId)}/agents/${encodeURIComponent(agentSlug)}`, { json: payload })).json();
+				return QueuedAgentPromptResponseSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async getSessionState(projectId, sessionId, options) {
+			try {
+				const sinceSeq = options?.sinceSeq;
+				const searchParams = sinceSeq != null && sinceSeq > 0 ? { sinceSeq: String(sinceSeq) } : void 0;
+				const data = await http.get(`api/projects/${encodeURIComponent(projectId)}/sessions/${encodeURIComponent(sessionId)}/state`, { searchParams }).json();
+				if (data == null) return null;
+				return AgentSessionChatStateResponseSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async listSessions(projectId, agentSlug) {
+			try {
+				const data = await http.get(`api/projects/${encodeURIComponent(projectId)}/agents/${encodeURIComponent(agentSlug)}/sessions`).json();
+				return AgentSessionListResponseSchema.parse(data).items;
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async listTriggers(projectId, agentSlug) {
+			try {
+				const data = await http.get(`api/projects/${encodeURIComponent(projectId)}/agents/${encodeURIComponent(agentSlug)}/triggers`).json();
+				return AgentTriggerSummaryListResponseSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		/** Deletes an agent-owned ephemeral trigger; throws if it is not deletable (404). */
+		async deleteTrigger(projectId, agentSlug, triggerId) {
+			try {
+				await http.delete(`api/projects/${encodeURIComponent(projectId)}/agents/${encodeURIComponent(agentSlug)}/triggers/${encodeURIComponent(triggerId)}`);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async listMemoryFiles(agentId) {
+			try {
+				const data = await http.get(`api/agents/${encodeURIComponent(agentId)}/memory/files`).json();
+				return ListAgentMemoryFilesResponseSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async getMemoryFileContent(agentId, path) {
+			try {
+				return await http.get(`api/agents/${encodeURIComponent(agentId)}/memory/files/content`, { searchParams: { path } }).text();
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		/** Persistent agent workspace files under `/workspace/agent`. */
+		async listWorkspaceFiles(agentId) {
+			try {
+				const data = await http.get(`api/agents/${encodeURIComponent(agentId)}/workspace/files`).json();
+				return ListAgentWorkspaceFilesResponseSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		/** Content for a path from {@link listWorkspaceFiles}. */
+		async getWorkspaceFileContent(agentId, path) {
+			try {
+				return await http.get(`api/agents/${encodeURIComponent(agentId)}/workspace/files/content`, { searchParams: { path } }).text();
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
 		}
 	};
 }
@@ -3708,6 +3830,74 @@ function createSkillsResource(http) {
 		}
 	};
 }
+function listRunsSearchParams(query) {
+	if (!query) return {};
+	const params = {};
+	if (query.limit !== void 0) params.limit = String(query.limit);
+	if (query.cursor) params.cursor = query.cursor;
+	if (query.triggerType) params.triggerType = query.triggerType;
+	return params;
+}
+function createTriggersResource(http) {
+	return {
+		/** Triggers across the projects the caller can access in the active org. */
+		async list() {
+			try {
+				const data = await http.get("api/triggers").json();
+				return WorkspaceTriggerListResponseSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async get(triggerId) {
+			try {
+				const data = await http.get(`api/triggers/${encodeURIComponent(triggerId)}`).json();
+				return WorkspaceTriggerDetailSchema.parse(data);
+			} catch (error) {
+				const platformError = await toPlatformError(error);
+				if (platformError.status === 404) return null;
+				throw platformError;
+			}
+		},
+		/** LLM-generated markdown overview of the trigger (generated lazily on the worker). */
+		async getOverview(triggerId) {
+			try {
+				const data = await http.get(`api/triggers/${encodeURIComponent(triggerId)}/overview`).json();
+				return WorkspaceTriggerOverviewSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		/** The trigger source file. */
+		async getFile(triggerId) {
+			try {
+				const data = await http.get(`api/triggers/${encodeURIComponent(triggerId)}/file`).json();
+				return WorkspaceTriggerFileSchema.parse(data);
+			} catch (error) {
+				const platformError = await toPlatformError(error);
+				if (platformError.status === 404) return null;
+				throw platformError;
+			}
+		},
+		/** Every fire of the trigger (poll/webhook/cron), dispatched or not. */
+		async listRuns(triggerId, query) {
+			try {
+				const data = await http.get(`api/triggers/${encodeURIComponent(triggerId)}/runs`, { searchParams: listRunsSearchParams(query) }).json();
+				return WorkspaceTriggerRunListResponseSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async updateAttachment(triggerId, attachmentId, body) {
+			try {
+				const data = await http.patch(`api/triggers/${encodeURIComponent(triggerId)}/attachments/${encodeURIComponent(attachmentId)}`, { json: body }).json();
+				return WorkspaceTriggerDetailSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		}
+	};
+}
 function createTeamRequestsResource(http) {
 	return { async submit(input) {
 		const body = SubmitTeamRequestRequestSchema.parse(input);
@@ -3718,6 +3908,16 @@ function createTeamRequestsResource(http) {
 		}
 	} };
 }
+function createMarketingContactResource(http) {
+	return { async submit(input) {
+		const body = SubmitMarketingContactRequestSchema.parse(input);
+		try {
+			await http.post("/api/public/contact", { json: body }).json();
+		} catch (error) {
+			throw await toPlatformError(error);
+		}
+	} };
+}
 function createRecentsResource(http) {
 	return { 
 	/** Always the viewer's own recents, scoped to their project memberships. */
@@ -3740,6 +3940,8 @@ function buildOAuthAuthorizeSearchParams(input) {
 	if (input.createUserProvidedCredential) params.user = "true";
 	const label = input.label?.trim();
 	if (label) params.label = label;
+	const credentialInstanceId = input.credentialInstanceId?.trim();
+	if (credentialInstanceId) params.credentialInstanceId = credentialInstanceId;
 	return params;
 }
 function createCredentialsResource(http) {
@@ -3910,6 +4112,42 @@ function createAppsResource(http) {
 			} catch (error) {
 				throw await toPlatformError(error);
 			}
+		},
+		async discoverMcp(input) {
+			try {
+				const data = await http.post("/api/apps/discover", { json: input }).json();
+				return McpDiscoverResponseSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async discoverOpenApi(input) {
+			try {
+				const data = await http.post("/api/apps/discover-openapi", { json: input }).json();
+				return OpenApiDiscoverResponseSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async discoverGraphql(input) {
+			try {
+				const data = await http.post("/api/apps/discover-graphql", { json: input }).json();
+				return GraphqlDiscoverResponseSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
+		},
+		async startMcpOAuthConnection(slug, input) {
+			try {
+				const body = StartMcpOAuthConnectionInputSchema.parse({
+					...input,
+					appSlug: slug
+				});
+				const data = await http.post(`/api/apps/${encodeURIComponent(slug)}/mcp/oauth/connections`, { json: body }).json();
+				return StartMcpOAuthConnectionResultSchema.parse(data);
+			} catch (error) {
+				throw await toPlatformError(error);
+			}
 		}
 	};
 }
@@ -4246,6 +4484,7 @@ function projectChannelPlatform(app) {
 		resourceNoun: app.gateway.resourceNoun,
 		webhookPathHint: app.gateway.webhookPathHint,
 		supportsChannelDirectory: app.gateway.supportsChannelDirectory,
+		...app.gateway.connectAppId ? { connectAppId: app.gateway.connectAppId } : {},
 		docsUrl: app.gateway.docsUrl
 	});
 }
@@ -4362,6 +4601,7 @@ function createPlatformClient(options) {
 		agents: createAgentsResource(http),
 		workflows: createWorkflowsResource(http),
 		skills: createSkillsResource(http),
+		triggers: createTriggersResource(http),
 		apps: createAppsResource(http),
 		credentials: createCredentialsResource(http),
 		history: createHistoryResource(http),
@@ -4378,6 +4618,7 @@ function createPlatformClient(options) {
 		userAvatar: createUserAvatarResource(http),
 		organizationSidebarBranding: createOrganizationSidebarBrandingResource(http, { getActiveOrganizationId: () => activeOrganizationId }),
 		teamRequests: createTeamRequestsResource(http),
+		marketingContact: createMarketingContactResource(http),
 		getActiveOrganizationId: () => activeOrganizationId,
 		setActiveOrganizationId
 	};
@@ -4500,6 +4741,49 @@ async function ensureActiveOrganization(config) {
 	throw new Error("No active organization. Run `keystroke auth login` or `keystroke config use org`.");
 }
 //#endregion
+//#region src/project/resolve-project-root.ts
+function hasProjectLayout(dir) {
+	return existsSync(join(dir, "package.json")) && existsSync(join(dir, "src", "agents"));
+}
+function resolveProjectRoot(fromDir = process.cwd()) {
+	let dir = resolve(fromDir);
+	while (dir !== dirname(dir)) {
+		if (hasProjectLayout(dir)) return dir;
+		dir = dirname(dir);
+	}
+	if (hasProjectLayout(dir)) return dir;
+	throw new Error("Could not find keystroke project root (expected package.json and src/agents/)");
+}
+//#endregion
+//#region src/project/load-project-env.ts
+let loaded = false;
+function parseEnvFile(contents) {
+	const values = {};
+	for (const line of contents.split("\n")) {
+		const trimmed = line.trim();
+		if (!trimmed || trimmed.startsWith("#")) continue;
+		const eq = trimmed.indexOf("=");
+		if (eq === -1) continue;
+		const key = trimmed.slice(0, eq).trim();
+		let value = trimmed.slice(eq + 1).trim();
+		if (value.startsWith("\"") && value.endsWith("\"") || value.startsWith("'") && value.endsWith("'")) value = value.slice(1, -1);
+		values[key] = value;
+	}
+	return values;
+}
+function loadProjectEnv(fromDir = process.cwd()) {
+	if (loaded) return;
+	loaded = true;
+	let envPath;
+	try {
+		envPath = join(resolveProjectRoot(fromDir), ".env");
+	} catch {
+		return;
+	}
+	if (!existsSync(envPath)) return;
+	for (const [key, value] of Object.entries(parseEnvFile(readFileSync(envPath, "utf8")))) if (process.env[key] === void 0) process.env[key] = value;
+}
+//#endregion
 //#region src/dev-session.ts
 function getDevSessionPath(configDir = getCliConfigDir()) {
 	return join(configDir, "dev-session.json");
@@ -4538,13 +4822,30 @@ function readDevSession(configDir = getCliConfigDir()) {
 }
 //#endregion
 //#region src/resolve-api-target.ts
+/** Standalone local server default project id — keep in sync with @keystrokehq/database. */
+const DEFAULT_LOCAL_PROJECT_ID = "default";
 const projectScopedTarget = { projectScoped: true };
-function resolveLocalTarget(config) {
+function resolveLocalTargetFromOrigin(origin, options = {}) {
+	const base = origin.replace(/\/+$/, "");
+	if (!options.projectScoped) return {
+		baseUrl: base,
+		mode: "local"
+	};
+	const projectPathMatch = base.match(/^(.*\/api\/projects\/([^/]+))$/);
+	if (projectPathMatch) return {
+		baseUrl: projectPathMatch[1],
+		projectId: projectPathMatch[2],
+		mode: "local"
+	};
 	return {
-		baseUrl: getServerUrl(config),
+		baseUrl: `${base}/api/projects/${DEFAULT_LOCAL_PROJECT_ID}`,
+		projectId: DEFAULT_LOCAL_PROJECT_ID,
 		mode: "local"
 	};
 }
+function resolveLocalTarget(options = {}) {
+	return resolveLocalTargetFromOrigin(resolvePublicPlatformOrigin(process.env), options);
+}
 function resolveOrgPlatformTarget(config) {
 	return {
 		baseUrl: `${getPlatformUrl(config).replace(/\/+$/, "")}/api`,
@@ -4568,18 +4869,16 @@ async function resolvePlatformTarget(config, projectRef) {
 	};
 }
 async function resolveApiTarget(config, options = {}) {
-	if (options.local) return resolveLocalTarget(config);
+	loadProjectEnv(process.cwd());
+	if (options.local) return resolveLocalTarget(options);
 	const devSession = readDevSession(getConfigDir(config));
-	if (devSession && getEffectiveApiTarget(config) !== "platform") return {
-		baseUrl: devSession.serverUrl,
-		mode: "local"
-	};
+	if (devSession && getEffectiveApiTarget(config) !== "platform") return resolveLocalTargetFromOrigin(devSession.serverUrl, options);
 	if (options.orgScoped || options.projectScoped === false) {
-		if (getEffectiveApiTarget(config) === "local") return resolveLocalTarget(config);
+		if (getEffectiveApiTarget(config) === "local") return resolveLocalTarget(options);
 		return resolveOrgPlatformTarget(config);
 	}
 	if (options.projectId) return resolvePlatformTarget(config, options.projectId);
-	if (getEffectiveApiTarget(config) === "local") return resolveLocalTarget(config);
+	if (getEffectiveApiTarget(config) === "local") return resolveLocalTarget(options);
 	if (!options.projectScoped) return resolveOrgPlatformTarget(config);
 	const projectRef = options.projectId ?? config.get("activeProjectId");
 	if (!projectRef) throw new Error("No project selected. Pass `--project <slug>` or run `keystroke config use project <slug>`.");
@@ -4666,6 +4965,9 @@ function formatHttpClientError(error, context) {
 		if (origin && !getAccessToken(origin)) return "Not logged in. Run `keystroke auth login` first.";
 		return "Authentication failed. Run `keystroke auth login` again.";
 	}
+	if (error.status === 403) {
+		if (parseErrorResponse(error.body)?.code === "org_unverified") return "This organization is pending verification. Request access in the Keystroke dashboard.";
+	}
 	if (error.status === 0) {
 		if (error.message && !isUnreachableServerError(error)) return error.message;
 		return unreachableServerMessage(unreachableTarget(context));
@@ -5062,6 +5364,7 @@ function registerAppCreateCommand(app) {
 			name: options.name.trim(),
 			slug,
 			description: options.description,
+			source: "custom",
 			fields: parseCustomAppFields(options.field)
 		});
 		process.stdout.write(`${JSON.stringify(created, null, 2)}\n`);
@@ -5135,7 +5438,7 @@ function resolveSyncedAppDirName(slug) {
 }
 function generateAppStub(app) {
 	const exportName = resolveSyncedAppExportName(app.slug);
-	const credentialLines = Object.entries(app.credentialFields).map(([key, field]) => {
+	const credentialLines = Object.entries(app.credentialFields ?? {}).map(([key, field]) => {
 		return `    ${key}: ${field.optional ? "z.string().optional()" : "z.string()"},`;
 	}).join("\n");
 	return `import { defineApp } from "@keystrokehq/keystroke/app";
@@ -5216,11 +5519,6 @@ function resolveConnectAppSlug(slug, apps) {
 	}
 	return match;
 }
-function buildConnectDeeplink(options) {
-	const base = options.webUrl.replace(/\/+$/, "");
-	const params = new URLSearchParams({ connect: options.appSlug });
-	return `${base}/${options.orgSlug}/apps?${params.toString()}`;
-}
 async function runConnect(options) {
 	const apps = await options.platform.apps.listCatalog();
 	const app = resolveConnectAppSlug(options.slug, apps);
@@ -5256,6 +5554,90 @@ function registerConnectCommand(program) {
 	}, void 0, { orgScoped: true }));
 }
 //#endregion
+//#region src/commands/credentials/parse-assignment-target.ts
+function parseAssignmentTarget(options) {
+	const agent = options.agent?.trim();
+	const workflow = options.workflow?.trim();
+	if (agent && workflow) throw new Error("Exactly one of --agent or --workflow is required");
+	if (agent) return {
+		targetType: "agent",
+		targetKey: agent
+	};
+	if (workflow) return {
+		targetType: "workflow",
+		targetKey: workflow
+	};
+	throw new Error("Exactly one of --agent or --workflow is required");
+}
+//#endregion
+//#region src/commands/credentials/assignments/assign.ts
+function registerCredentialsAssignmentsAssignCommand(assignments) {
+	assignments.command("assign").description("Assign a credential instance to a workflow step or agent tool").option("--agent <key>", "Agent slug").option("--workflow <key>", "Workflow slug").requiredOption("--credential <slug>", "Credential instance slug (e.g. work, org/work, linear/work)").option("--consumer <id>", "Consumer id (step correlation id or tool slug); omit for wildcard (*)").addHelpText("after", `
+Examples:
+  ${cliBinaryName()} credentials assignments assign --workflow sync --credential work
+  ${cliBinaryName()} credentials assignments assign --workflow sync --credential org/work --consumer step:fetch-gmail#0
+  ${cliBinaryName()} credentials assignments assign --agent support --credential vault-prod --consumer vault-lookup
+  ${cliBinaryName()} credentials assignments assign --agent pm --credential linear/work
+`).action((options) => runProjectCliCommand("Assign credential failed", async ({ client }) => {
+		const target = parseAssignmentTarget(options);
+		const assignment = await client.credentials.assignCredential({
+			targetType: target.targetType,
+			targetKey: target.targetKey,
+			credential: options.credential,
+			...options.consumer ? { consumerId: options.consumer } : {}
+		});
+		process.stdout.write(`${JSON.stringify(assignment, null, 2)}\n`);
+	}));
+}
+//#endregion
+//#region src/commands/credentials/assignments/list.ts
+function registerCredentialsAssignmentsListCommand(assignments) {
+	assignments.command("list").description("List credential assignments for a workflow or agent").option("--agent <key>", "Agent slug").option("--workflow <key>", "Workflow slug").action((options) => runProjectCliCommand("List credential assignments failed", async ({ client }) => {
+		const target = parseAssignmentTarget(options);
+		const result = await client.credentials.listAssignments({
+			targetType: target.targetType,
+			targetKey: target.targetKey
+		});
+		process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+	}));
+}
+//#endregion
+//#region src/commands/credentials/assignments/unassign.ts
+function registerCredentialsAssignmentsUnassignCommand(assignments) {
+	assignments.command("unassign").description("Remove a credential assignment by id").argument("<id>", "Credential assignment id").action((id) => runProjectCliCommand("Unassign credential failed", async ({ client }) => {
+		await client.credentials.unassignCredential(id);
+	}));
+}
+//#endregion
+//#region src/commands/credentials/assignments/index.ts
+function registerCredentialsAssignmentsCommands(credentials) {
+	const assignments = credentials.command("assignments").description("Assign credential instances to workflow steps or agent tools");
+	registerCredentialsAssignmentsListCommand(assignments);
+	registerCredentialsAssignmentsAssignCommand(assignments);
+	registerCredentialsAssignmentsUnassignCommand(assignments);
+}
+//#endregion
+//#region src/commands/credentials/consumers/list.ts
+function registerCredentialsConsumersListCommand(consumers) {
+	consumers.command("list").description("List bindable consumers for a workflow or agent").option("--agent <key>", "Agent slug").option("--workflow <key>", "Workflow slug").addHelpText("after", `
+Workflow consumers come from recent step_completed events (e.g. step:fetch-gmail#0).
+Agent consumers include known tool slugs when available, plus any from existing assignments.
+Use consumer id "*" (wildcard) or omit --consumer on assignments assign to bind all consumers.
+`).action((options) => runProjectCliCommand("List credential consumers failed", async ({ client }) => {
+		const target = parseAssignmentTarget(options);
+		const result = await client.credentials.listConsumers({
+			targetType: target.targetType,
+			targetKey: target.targetKey
+		});
+		process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+	}));
+}
+//#endregion
+//#region src/commands/credentials/consumers/index.ts
+function registerCredentialsConsumersCommands(credentials) {
+	registerCredentialsConsumersListCommand(credentials.command("consumers").description("Discover workflow step and agent tool consumer ids for assignment"));
+}
+//#endregion
 //#region src/commands/credentials/target-options.ts
 function resolveCredentialsTargetOptions(options = {}) {
 	if (options.scopeType === "project") return {
@@ -5332,13 +5714,13 @@ function buildPlatformUpdatePatch(args) {
 //#endregion
 //#region src/commands/credentials/delete.ts
 function registerCredentialsDeleteCommand(credentials) {
-	credentials.command("delete").description("Delete a credential instance").argument("<id>", "Credential instance id").action((id) => runCredentialsCommand("Delete credential failed", async ({ platform, local }) => {
+	credentials.command("delete").description("Delete a credential instance").argument("<ref>", "Credential slug or id").action((ref) => runCredentialsCommand("Delete credential failed", async ({ platform, local }) => {
 		if (local) {
 			const { client } = await createLocalCredentialsClient();
-			await client.credentials.deleteInstance(id);
+			await client.credentials.deleteInstance(ref);
 			return;
 		}
-		await platform.credentials.delete(id);
+		await platform.credentials.delete(ref);
 	}));
 }
 //#endregion
@@ -5380,49 +5762,6 @@ function envRefName(raw) {
 	return raw.slice(5);
 }
 //#endregion
-//#region src/project/resolve-project-root.ts
-function hasProjectLayout(dir) {
-	return existsSync(join(dir, "package.json")) && existsSync(join(dir, "src", "agents"));
-}
-function resolveProjectRoot(fromDir = process.cwd()) {
-	let dir = resolve(fromDir);
-	while (dir !== dirname(dir)) {
-		if (hasProjectLayout(dir)) return dir;
-		dir = dirname(dir);
-	}
-	if (hasProjectLayout(dir)) return dir;
-	throw new Error("Could not find keystroke project root (expected package.json and src/agents/)");
-}
-//#endregion
-//#region src/project/load-project-env.ts
-let loaded = false;
-function parseEnvFile(contents) {
-	const values = {};
-	for (const line of contents.split("\n")) {
-		const trimmed = line.trim();
-		if (!trimmed || trimmed.startsWith("#")) continue;
-		const eq = trimmed.indexOf("=");
-		if (eq === -1) continue;
-		const key = trimmed.slice(0, eq).trim();
-		let value = trimmed.slice(eq + 1).trim();
-		if (value.startsWith("\"") && value.endsWith("\"") || value.startsWith("'") && value.endsWith("'")) value = value.slice(1, -1);
-		values[key] = value;
-	}
-	return values;
-}
-function loadProjectEnv(fromDir = process.cwd()) {
-	if (loaded) return;
-	loaded = true;
-	let envPath;
-	try {
-		envPath = join(resolveProjectRoot(fromDir), ".env");
-	} catch {
-		return;
-	}
-	if (!existsSync(envPath)) return;
-	for (const [key, value] of Object.entries(parseEnvFile(readFileSync(envPath, "utf8")))) if (process.env[key] === void 0) process.env[key] = value;
-}
-//#endregion
 //#region src/commands/credentials/parse-value.ts
 function parseCredentialValueFields(fields) {
 	const value = {};
@@ -5468,8 +5807,7 @@ function collectSetValues$2(value, previous) {
 //#region src/commands/credentials/format-set-conflict-error.ts
 function describeInstance(instance) {
 	const defaultStatus = instance.isDefault ? "default" : "not default";
-	const labelStatus = instance.label ? `label: ${instance.label}` : "no label";
-	return `id: ${instance.id}, ${defaultStatus}, ${labelStatus}`;
+	return `${instance.name ? `name: ${instance.name}` : `slug: ${instance.slug}`}, ${defaultStatus}`;
 }
 function formatSetFields(setFields) {
 	return setFields.map((field) => `--set ${field}`).join(" ");
@@ -5478,10 +5816,10 @@ function formatSetConflictError(args) {
 	const binary = cliBinaryName();
 	const setArgs = formatSetFields(args.setFields);
 	const listCmd = `${binary} credentials list --key ${args.key}`;
-	const addSecondCmd = `${binary} credentials set ${args.key} --scope ${args.scope} --label <name> ${setArgs}`;
+	const addSecondCmd = `${binary} credentials set ${args.key} --scope ${args.scope} --slug <slug> ${setArgs}`;
 	if (args.matching.length === 1) {
 		const instance = args.matching[0];
-		const updateCmd = `${binary} credentials update ${instance.id} ${setArgs}`;
+		const updateCmd = `${binary} credentials update ${instance.slug} ${setArgs}`;
 		return [
 			`An ${args.key} credential already exists in ${args.scope} scope (${describeInstance(instance)}).`,
 			"credentials set creates a new instance — it does not update an existing one.",
@@ -5494,7 +5832,7 @@ function formatSetConflictError(args) {
 	}
 	const instanceLines = args.matching.map((instance) => `  • ${describeInstance(instance)}`);
 	return [
-		`Multiple ${args.key} credentials already exist in ${args.scope} scope. --label is required to add another:`,
+		`Multiple ${args.key} credentials already exist in ${args.scope} scope. Pass --slug to add another:`,
 		...instanceLines,
 		"To add another credential in the same scope:",
 		`  ${addSecondCmd}`,
@@ -5502,7 +5840,7 @@ function formatSetConflictError(args) {
 	].join("\n");
 }
 async function assertNoSetConflict(client, args) {
-	if (args.label) return;
+	if (args.slug) return;
 	const { instances } = await client.credentials.listInstances({ key: args.key });
 	const matching = instances.filter((instance) => instance.scopeType === args.scopeType && (args.scopeType !== "project" || instance.scopeId === args.projectId));
 	if (matching.length === 0) return;
@@ -5538,7 +5876,7 @@ function parseCredentialSetScopes(scopes, projectSlugs) {
 //#endregion
 //#region src/commands/credentials/set.ts
 function registerCredentialsSetCommand(credentials) {
-	credentials.command("set").description("Create a new api_key credential instance").argument("<key>", "Credential key or app id, e.g. exa").option("--scope <scope>", "org, user, or project (repeatable)", collectValues, []).option("--project-slug <slug>", "Project slug when scope includes project (repeatable)", collectValues, []).option("--label <label>", "Human-readable label within the scope").option("--default", "Mark as default for this scope").option("--set <field>", "Credential field as key=value or key=@env:VAR (falls back to project .env when unset in shell)", collectSetValues$1, []).action((key, options) => runCredentialsCommand("Set credential failed", async ({ platform, local }) => {
+	credentials.command("set").description("Create a new api_key credential instance").argument("<key>", "Credential key or app id, e.g. exa").option("--scope <scope>", "org, user, or project (repeatable)", collectValues, []).option("--project-slug <slug>", "Project slug when scope includes project (repeatable)", collectValues, []).option("--slug <slug>", "Friendly credential slug within the scope").option("--name <name>", "Display name (used to derive slug when --slug is omitted)").option("--label <label>", "Alias for --name").option("--default", "Mark as default for this scope").option("--set <field>", "Credential field as key=value or key=@env:VAR (falls back to project .env when unset in shell)", collectSetValues$1, []).action((key, options) => runCredentialsCommand("Set credential failed", async ({ platform, local }) => {
 		const value = parseCredentialValueFields(options.set);
 		const parsedScopes = parseCredentialSetScopes(options.scope, options.projectSlug);
 		if (local) {
@@ -5546,19 +5884,21 @@ function registerCredentialsSetCommand(credentials) {
 			const targets = expandLocalCredentialTargets(parsedScopes);
 			const instances = [];
 			for (const target of targets) {
+				const displayName = options.name ?? options.label;
 				await assertNoSetConflict(client, {
 					key,
 					scope: target.scope,
 					scopeType: target.scopeType,
 					projectId: target.projectSlug,
-					label: options.label,
+					slug: options.slug,
 					setFields: options.set
 				});
 				instances.push(await client.credentials.createInstance({
 					key,
 					scopeType: target.scopeType,
 					scopeId: target.projectSlug,
-					label: options.label,
+					...options.slug !== void 0 ? { slug: options.slug } : {},
+					...displayName !== void 0 ? { name: displayName } : {},
 					isDefault: options.default,
 					value
 				}));
@@ -5614,12 +5954,14 @@ function expandLocalCredentialTargets(targets) {
 //#endregion
 //#region src/commands/credentials/update.ts
 function registerCredentialsUpdateCommand(credentials) {
-	credentials.command("update").description("Update a credential instance").argument("<id>", "Credential instance id").option("--label <label>", "Human-readable label within the scope").option("--default", "Mark as default for this scope").option("--set <field>", "Credential field as key=value or key=@env:VAR", collectSetValues, []).action((id, options) => runCredentialsCommand("Update credential failed", async ({ platform, local }) => {
+	credentials.command("update").description("Update a credential instance").argument("<ref>", "Credential slug or id").option("--slug <slug>", "Update friendly slug").option("--name <name>", "Update display name").option("--label <label>", "Alias for --name").option("--default", "Mark as default for this scope").option("--set <field>", "Credential field as key=value or key=@env:VAR", collectSetValues, []).action((ref, options) => runCredentialsCommand("Update credential failed", async ({ platform, local }) => {
 		const value = options.set.length > 0 ? parseCredentialValueFields(options.set) : void 0;
+		const displayName = options.name ?? options.label;
 		if (local) {
 			const { client } = await createLocalCredentialsClient();
-			const result = await client.credentials.updateInstance(id, {
-				...options.label !== void 0 ? { label: options.label } : {},
+			const result = await client.credentials.updateInstance(ref, {
+				...options.slug !== void 0 ? { slug: options.slug } : {},
+				...displayName !== void 0 ? { name: displayName } : {},
 				...options.default !== void 0 ? { isDefault: options.default } : {},
 				...value ? { value } : {}
 			});
@@ -5627,11 +5969,11 @@ function registerCredentialsUpdateCommand(credentials) {
 			return;
 		}
 		const patch = buildPlatformUpdatePatch({
-			...options.label !== void 0 ? { label: options.label } : {},
+			...displayName !== void 0 ? { label: displayName } : {},
 			...options.default !== void 0 ? { isDefault: options.default } : {},
 			...value ? { value } : {}
 		});
-		const credential = await platform.credentials.update(id, patch);
+		const credential = await platform.credentials.update(ref, patch);
 		process.stdout.write(`${JSON.stringify({ credential }, null, 2)}\n`);
 	}));
 }
@@ -5648,11 +5990,13 @@ function registerCredentialsCommand(program) {
 	registerCredentialsUpdateCommand(credentials);
 	registerCredentialsRotateKeyCommand(credentials);
 	registerCredentialsDeleteCommand(credentials);
+	registerCredentialsAssignmentsCommands(credentials);
+	registerCredentialsConsumersCommands(credentials);
 }
 //#endregion
 //#region src/auth/resolve-login-targets.ts
 function resolveAuthLoginTargets(options, config) {
-	const webUrl = options.webUrl ?? "https://app.keystroke.ai";
+	const webUrl = options.webUrl ?? "https://keystroke.ai";
 	return {
 		webUrl,
 		platformUrl: resolvePlatformUrlForWebUrl(webUrl, {
@@ -5759,7 +6103,7 @@ function registerBuildCommand(program) {
 	program.command("build").description("Build the keystroke project for production").option("--dir <path>", "Project directory", process.cwd()).action(async (options) => {
 		try {
 			const root = resolveProjectRoot(options.dir);
-			const { buildApp } = await import("./dist-B9XaHV_2.mjs");
+			const { buildApp } = await import("./dist-IOphuHYN.mjs");
 			await buildApp({ root });
 			process.stdout.write(`Built ${root}\n`);
 		} catch (error) {
@@ -5770,109 +6114,6 @@ function registerBuildCommand(program) {
 	});
 }
 //#endregion
-//#region ../../packages/storage/dist/pack-artifact-NGxvGcXq.mjs
-/**
-* Pack a directory tree that contains a `dist/` folder into a gzip tarball
-* suitable for project-server extraction.
-*/
-function packDistTree(rootContainingDist) {
-	const tempDir = mkdtempSync(join(tmpdir(), "keystroke-artifact-pack-"));
-	const archivePath = join(tempDir, "artifact.tgz");
-	try {
-		const result = spawnSync("tar", [
-			"-czf",
-			archivePath,
-			"--exclude=._*",
-			"--exclude=.DS_Store",
-			"-C",
-			rootContainingDist,
-			"dist"
-		], {
-			encoding: "utf8",
-			env: {
-				...process.env,
-				COPYFILE_DISABLE: "1"
-			}
-		});
-		if (result.status !== 0) throw new Error(result.stderr?.trim() || "Failed to pack project artifact");
-		return readFileSync(archivePath);
-	} finally {
-		rmSync(tempDir, {
-			recursive: true,
-			force: true
-		});
-	}
-}
-/** Extract a packed project artifact tarball into `destDir` (creates `destDir/dist/`). */
-function extractProjectArtifact(archive, destDir) {
-	const tempDir = mkdtempSync(join(tmpdir(), "keystroke-artifact-extract-"));
-	const archivePath = join(tempDir, "artifact.tgz");
-	try {
-		writeFileSync(archivePath, archive);
-		const result = spawnSync("tar", [
-			"-xzf",
-			archivePath,
-			"-C",
-			destDir
-		], {
-			encoding: "utf8",
-			env: {
-				...process.env,
-				COPYFILE_DISABLE: "1"
-			}
-		});
-		if (result.status !== 0) throw new Error(result.stderr?.trim() || "Failed to extract project artifact");
-	} finally {
-		rmSync(tempDir, {
-			recursive: true,
-			force: true
-		});
-	}
-}
-function moduleFileOf(entry) {
-	return "moduleFile" in entry && typeof entry.moduleFile === "string" ? entry.moduleFile : void 0;
-}
-/** Replace manifest rows for rebuilt modules while keeping untouched routes and metadata. */
-function mergeStoredRouteManifest(base, rebuiltEntries) {
-	const rebuiltModuleFiles = new Set(rebuiltEntries.map(moduleFileOf).filter((value) => Boolean(value)));
-	const keptEntries = base.entries.filter((entry) => {
-		const moduleFile = moduleFileOf(entry);
-		if (!moduleFile) return true;
-		return !rebuiltModuleFiles.has(moduleFile);
-	});
-	const filteredRebuilt = rebuiltEntries.filter((entry) => entry.kind !== "health");
-	return {
-		...base,
-		entries: [...keptEntries, ...filteredRebuilt]
-	};
-}
-async function mergeFilteredArtifact(input) {
-	const mergeRoot = mkdtempSync(join(tmpdir(), "keystroke-artifact-merge-"));
-	try {
-		extractProjectArtifact(input.baseArchive, mergeRoot);
-		const manifestPath = join(mergeRoot, ROUTE_MANIFEST_REL_PATH);
-		const mergedManifest = mergeStoredRouteManifest(StoredRouteManifestSchema.parse(JSON.parse(readFileSync(manifestPath, "utf8"))), input.filtered.manifestEntries);
-		writeFileSync(manifestPath, `${JSON.stringify(mergedManifest, null, 2)}\n`);
-		for (const file of input.filtered.files) {
-			const destination = join(mergeRoot, "dist", file.relativePath);
-			mkdirSync(dirname(destination), { recursive: true });
-			writeFileSync(destination, file.contents);
-			if (file.sourceMap) writeFileSync(`${destination}.map`, file.sourceMap);
-		}
-		return packDistTree(mergeRoot);
-	} finally {
-		rmSync(mergeRoot, {
-			recursive: true,
-			force: true
-		});
-	}
-}
-/** Pack `dist/` into a gzip tarball suitable for `/app` extraction in the project server image. */
-function packProjectArtifact(projectRoot) {
-	if (!existsSync(join(projectRoot, "dist"))) throw new Error("dist/ not found — run keystroke build first");
-	return packDistTree(projectRoot);
-}
-//#endregion
 //#region src/commands/deploy.ts
 const POLL_INTERVAL_MS = 2e3;
 const DEPLOY_TIMEOUT_MS = 12e4;
@@ -5916,7 +6157,7 @@ async function sleep(ms) {
 }
 async function buildDeployArchive(client, root, projectId, filter) {
 	if (filter?.length) {
-		const { buildFilteredApp } = await import("./dist-B9XaHV_2.mjs");
+		const { buildFilteredApp } = await import("./dist-IOphuHYN.mjs");
 		const filtered = await buildFilteredApp({
 			root,
 			filter,
@@ -5938,7 +6179,7 @@ async function buildDeployArchive(client, root, projectId, filter) {
 			sourceFiles: filtered.sourceFiles
 		};
 	}
-	const { buildApp } = await import("./dist-B9XaHV_2.mjs");
+	const { buildApp } = await import("./dist-IOphuHYN.mjs");
 	const { sourceFiles } = await buildApp({
 		root,
 		collectSources: true,
@@ -6006,6 +6247,13 @@ function registerDeployCommand(program) {
 	});
 }
 //#endregion
+//#region src/resolve-local-api-origin.ts
+/** Local platform API origin from the project `.env` (`PUBLIC_PLATFORM_URL`). */
+function resolveLocalApiOrigin(fromDir = process.cwd()) {
+	loadProjectEnv(fromDir);
+	return resolvePublicPlatformOrigin(process.env);
+}
+//#endregion
 //#region src/project/runtime-child-env.ts
 /** Strip dev-only Node flags so the API child loads built `dist/`, not package `src/`. */
 function runtimeChildNodeOptions(nodeOptions) {
@@ -6044,14 +6292,13 @@ function runtimeChildEnv(parentEnv, overrides) {
 		env.DATABASE_URL = "file:./data/public.db";
 	}
 	env.KEYSTROKE_APP_MODE ??= "standalone";
-	env.PROJECT_ID ??= "default";
 	return env;
 }
 //#endregion
 //#region src/project/bootstrap-run.ts
 /** Node args + env for `@keystrokehq/build` bootstrap (shared by start + dev). */
 async function resolveBootstrapRun(options) {
-	const { resolveRuntimeBuildArtifact } = await import("./dist-B9XaHV_2.mjs");
+	const { resolveRuntimeBuildArtifact } = await import("./dist-IOphuHYN.mjs");
 	const loader = pathToFileURL(resolveRuntimeBuildArtifact(options.runtimeNodeModules, "dist/runtime-loader.mjs")).href;
 	const bootstrap = resolveRuntimeBuildArtifact(options.runtimeNodeModules, "dist/standalone-bootstrap.mjs");
 	const args = [`--import=${loader}`];
@@ -6061,10 +6308,9 @@ async function resolveBootstrapRun(options) {
 	const childEnv = runtimeChildEnv(process.env, {
 		KEYSTROKE_ROOT: options.root,
 		KEYSTROKE_RUNTIME_NODE_MODULES: options.runtimeNodeModules,
-		KEYSTROKE_APP_MODE: "standalone",
-		PROJECT_ID: process.env.PROJECT_ID ?? "default"
+		KEYSTROKE_APP_MODE: "standalone"
 	});
-	childEnv.PORT = String(listenPortFromPublicUrl(childEnv.PUBLIC_SERVER_URL, options.apiPort));
+	childEnv.PORT = String(listenPortFromPublicUrl(childEnv.PUBLIC_PLATFORM_URL, options.apiPort));
 	return {
 		cwd: options.root,
 		args,
@@ -6156,8 +6402,8 @@ const DEV_BANNER = "keystroke dev: watch rebuilds dist/ and restarts the API —
 function stopChild(child) {
 	if (child && !child.killed && child.pid !== void 0) child.kill("SIGTERM");
 }
-function resolveDevServerUrl(config, portOverride) {
-	const url = new URL(getServerUrl(config));
+function resolveDevServerUrl(root, portOverride) {
+	const url = new URL(resolveLocalApiOrigin(root));
 	if (portOverride !== void 0) url.port = String(portOverride);
 	return url.origin;
 }
@@ -6165,10 +6411,9 @@ async function runDev(options) {
 	const root = resolveProjectRoot(options.dir);
 	const runtimeNodeModules = resolveCliRuntimeNodeModules(resolveCliRoot(import.meta.url));
 	ensureNativeDeps(runtimeNodeModules);
-	const cliConfig = createCliConfig();
-	const configDir = getConfigDir(cliConfig);
+	const configDir = getConfigDir(createCliConfig());
 	process.stdout.write(DEV_BANNER);
-	const serverUrl = resolveDevServerUrl(cliConfig, options.port);
+	const serverUrl = resolveDevServerUrl(root, options.port);
 	const apiPort = Number(new URL(serverUrl).port || 80);
 	writeDevSession({
 		pid: process.pid,
@@ -6202,7 +6447,7 @@ async function runDev(options) {
 	process.on("SIGINT", shutdown);
 	process.on("SIGTERM", shutdown);
 	try {
-		const { watchApp } = await import("./dist-B9XaHV_2.mjs");
+		const { watchApp } = await import("./dist-IOphuHYN.mjs");
 		await watchApp({
 			root,
 			clean: false,
@@ -6352,10 +6597,11 @@ const INIT_CATALOG_VERSIONS = {
 	vitest: "^4.1.7",
 	"@types/node": "^25.9.1"
 };
+const INIT_KEYSTROKE_VERSION = "^0.1.8";
 //#endregion
 //#region src/init/copy-template.ts
 function renderTemplate(content, variables) {
-	let rendered = content.replaceAll("{{projectName}}", variables.projectName).replaceAll("{{version}}", variables.version);
+	let rendered = content.replaceAll("{{projectName}}", variables.projectName).replaceAll("{{keystrokeVersion}}", INIT_KEYSTROKE_VERSION).replaceAll("{{version}}", variables.version);
 	for (const [dep, version] of Object.entries(INIT_CATALOG_VERSIONS)) rendered = rendered.replaceAll(`{{catalog:${dep}}}`, version);
 	return rendered;
 }
@@ -6531,6 +6777,33 @@ function resolvePlaygroundRoot(targetDir) {
 	const rel = relative(join(root, "playground"), resolve(targetDir));
 	return rel.length > 0 && !rel.startsWith("..") && !isAbsolute(rel) ? root : null;
 }
+/** Example primitives the hello-world template ships; removed when --no-example is set. */
+const EXAMPLE_FILES = [
+	"src/actions/greet.ts",
+	"src/agents/hello.ts",
+	"src/agents/hello.int.test.ts",
+	"src/workflows/greeting.ts",
+	"src/workflows/greeting.test.ts"
+];
+async function removeExampleFiles(targetDir) {
+	await Promise.all(EXAMPLE_FILES.map((rel) => rm(join(targetDir, rel), { force: true })));
+}
+/**
+* Drop the README sections that walk through the example hello agent / greeting
+* workflow — those primitives don't exist in a --no-example scaffold (e.g. MCP
+* sprite bootstrap), so shipping their usage docs is misleading.
+*/
+async function stripExampleReadme(targetDir) {
+	const readmePath = join(targetDir, "README.md");
+	let content;
+	try {
+		content = await readFile(readmePath, "utf8");
+	} catch {
+		return;
+	}
+	const next = content.replace(/Prompt the hello agent:\n+```bash\n[\s\S]*?\n```\n+/, "").replace(/Run the greeting workflow:\n+```bash\n[\s\S]*?\n```\n+/, "").replace(/\nExample: `src\/workflows\/greeting\.test\.ts`[^\n]*\n/, "\n");
+	if (next !== content) await writeFile(readmePath, next);
+}
 async function directoryExists(path) {
 	try {
 		await access(path);
@@ -6564,6 +6837,10 @@ async function runInit(options) {
 		version: options.version
 	});
 	await scaffoldEmptySrcDirs(targetDir);
+	if (options.noExample) {
+		await removeExampleFiles(targetDir);
+		await stripExampleReadme(targetDir);
+	}
 	if (playgroundRoot) await applyPlaygroundManifest(targetDir, projectName, playgroundRoot);
 	else await scaffoldProjectDotfiles(targetDir);
 	await syncBundledSkills(targetDir);
@@ -6580,7 +6857,7 @@ async function runInit(options) {
 //#endregion
 //#region src/commands/init.ts
 function registerInitCommand(program) {
-	program.command("init").description("Create a new keystroke project from a template").argument("[directory]", "Directory to create the project in").option("--name <name>", "Project name (kebab-case)").option("--template <name>", "Template to use", "hello-world").option("-y, --yes", "Skip prompts (headless mode for scripts and AI agents)").option("--skip-install", "Skip dependency installation").option("--pm <manager>", "Package manager: npm, pnpm, yarn, or bun").action(async (directory, options) => {
+	program.command("init").description("Create a new keystroke project from a template").argument("[directory]", "Directory to create the project in").option("--name <name>", "Project name (kebab-case)").option("--template <name>", "Template to use", "hello-world").option("-y, --yes", "Skip prompts (headless mode for scripts and AI agents)").option("--skip-install", "Skip dependency installation").option("--pm <manager>", "Package manager: npm, pnpm, yarn, or bun").option("--no-example", "Scaffold without the example action, agent, and workflow").action(async (directory, options) => {
 		try {
 			const result = await runInit({
 				directory,
@@ -6589,6 +6866,7 @@ function registerInitCommand(program) {
 				yes: options.yes,
 				skipInstall: options.skipInstall,
 				packageManager: options.pm,
+				noExample: options.example === false,
 				version: readCliVersion()
 			});
 			process.stdout.write(`Created keystroke project "${result.projectName}" at ${result.targetDir}\n`);
@@ -7017,18 +7295,18 @@ function registerProjectCommand(program) {
 }
 //#endregion
 //#region src/commands/start.ts
-function resolveStartServerUrl(portOverride) {
-	const url = new URL(getServerUrl(createCliConfig()));
+function resolveStartServerUrl(root, portOverride) {
+	const url = new URL(resolveLocalApiOrigin(root));
 	if (portOverride !== void 0) url.port = String(portOverride);
 	return url.origin;
 }
 async function runStart(options) {
 	const root = resolveProjectRoot(options.dir);
-	const serverUrl = resolveStartServerUrl(options.port);
+	const serverUrl = resolveStartServerUrl(root, options.port);
 	const apiPort = Number(new URL(serverUrl).port || 80);
 	const runtimeNodeModules = resolveCliRuntimeNodeModules(resolveCliRoot(import.meta.url));
 	ensureNativeDeps(runtimeNodeModules);
-	const { buildApp } = await import("./dist-B9XaHV_2.mjs");
+	const { buildApp } = await import("./dist-IOphuHYN.mjs");
 	await buildApp({
 		root,
 		clean: false
@@ -7111,6 +7389,61 @@ function registerTriggerRunsCommand(trigger) {
 	}));
 }
 //#endregion
+//#region src/commands/trigger/resolve-trigger-attachment.ts
+function findAssignment(assignments, attachmentRef) {
+	return assignments.find((entry) => entry.attachmentId === attachmentRef || entry.attachmentSlug === attachmentRef);
+}
+async function resolveTriggerAttachment(platform, triggerRef, attachmentRef) {
+	let trigger = await platform.triggers.get(triggerRef);
+	if (!trigger) {
+		const summary = (await platform.triggers.list()).find((entry) => entry.id === triggerRef || entry.slug === triggerRef) ?? null;
+		if (summary) trigger = await platform.triggers.get(summary.id);
+	}
+	if (!trigger) throw new Error(`Trigger not found: ${triggerRef}`);
+	const assignment = findAssignment(trigger.assignments, attachmentRef);
+	if (!assignment) throw new Error(`Attachment not found on trigger ${trigger.slug}: ${attachmentRef}`);
+	return {
+		triggerId: trigger.id,
+		attachmentId: assignment.attachmentId,
+		trigger,
+		assignment
+	};
+}
+//#endregion
+//#region src/commands/trigger/run-attachment-enabled.ts
+async function runTriggerAttachmentEnabled(config, options) {
+	await withActivePlatformClient(config, async (platform) => {
+		const resolved = await resolveTriggerAttachment(platform, options.triggerRef, options.attachmentRef);
+		const trigger = await platform.triggers.updateAttachment(resolved.triggerId, resolved.attachmentId, { enabled: options.enabled });
+		process.stdout.write(`${JSON.stringify(trigger, null, 2)}\n`);
+	});
+}
+//#endregion
+//#region src/commands/trigger/attachment.ts
+function registerAttachmentToggleCommand(attachment, command, enabled) {
+	attachment.command(command).description(`${command === "enable" ? "Enable" : "Disable"} a trigger attachment`).argument("<triggerRef>", "Trigger id or slug").argument("<attachmentRef>", "Attachment id or slug (for example signup:signup-pipeline)").action(async (triggerRef, attachmentRef) => {
+		const config = createCliConfig();
+		try {
+			await runTriggerAttachmentEnabled(config, {
+				triggerRef,
+				attachmentRef,
+				enabled
+			});
+		} catch (error) {
+			process.stderr.write(`${formatCliError(error, `${command} trigger attachment failed`, {
+				serverUrl: getPlatformUrl(config),
+				webUrl: getWebUrl(config)
+			})}\n`);
+			process.exitCode = 1;
+		}
+	});
+}
+function registerTriggerAttachmentCommand(trigger) {
+	const attachment = trigger.command("attachment").description("Enable or disable individual trigger attachments");
+	registerAttachmentToggleCommand(attachment, "disable", false);
+	registerAttachmentToggleCommand(attachment, "enable", true);
+}
+//#endregion
 //#region src/commands/trigger/index.ts
 function registerTriggerCommand(program) {
 	const trigger = program.command("trigger").description("Invoke and inspect triggers");
@@ -7119,6 +7452,7 @@ function registerTriggerCommand(program) {
 	registerTriggerUrlCommand(trigger);
 	registerTriggerPollCommand(trigger);
 	registerTriggerRunsCommand(trigger);
+	registerTriggerAttachmentCommand(trigger);
 }
 //#endregion
 //#region src/commands/workflow/list.ts
@@ -7412,9 +7746,9 @@ function registerConfigCommand(program) {
 		const cliConfig = createCliConfig();
 		const configDir = getConfigDir(cliConfig);
 		process.stdout.write(`${JSON.stringify({
-			serverUrl: cliConfig.get("serverUrl"),
 			webUrl: cliConfig.get("webUrl"),
 			platformUrl: getPlatformUrl(cliConfig),
+			localApiUrl: resolveLocalApiOrigin(process.cwd()),
 			activeOrganizationId: cliConfig.get("activeOrganizationId"),
 			activeProjectId: cliConfig.get("activeProjectId"),
 			apiTarget: getEffectiveApiTarget(cliConfig),
@@ -7551,7 +7885,7 @@ function createProgram() {
 	return program;
 }
 async function runCli(argv) {
-	const { maybeAutoUpdate } = await import("./maybe-auto-update-DHt-mVf1.mjs");
+	const { maybeAutoUpdate } = await import("./maybe-auto-update-BiR_kXZX.mjs");
 	await maybeAutoUpdate(argv);
 	createProgram().parse(argv);
 }