@keystrokehq/cli 0.1.5 → 0.1.9

package/dist/{maybe-auto-update-DHt-mVf1.mjs → maybe-auto-update-BiR_kXZX.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { l as getCliConfigDir, r as detectPackageManager, s as resolveCliRoot, t as readCliVersion } from "./version-BOm_5ar9.mjs";
+import { l as getCliConfigDir, r as detectPackageManager, s as resolveCliRoot, t as readCliVersion } from "./version-BGuC7Cpu.mjs";
 import { dirname, join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
 import { spawnSync } from "node:child_process";
@@ -405,4 +405,4 @@ async function maybeAutoUpdate(argv) {
 //#endregion
 export { maybeAutoUpdate };
 
-//# sourceMappingURL=maybe-auto-update-DHt-mVf1.mjs.map
+//# sourceMappingURL=maybe-auto-update-BiR_kXZX.mjs.map

package/dist/{maybe-auto-update-DHt-mVf1.mjs.map → maybe-auto-update-BiR_kXZX.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"maybe-auto-update-DHt-mVf1.mjs","names":[],"sources":["../src/update/compare-version.ts","../src/update/detect-cli-install.ts","../src/update/detect-release-age-block.ts","../src/update/fetch-latest-version.ts","../src/update/read-pnpm-release-age-minutes.ts","../src/update/resolve-global-pnpm-root.ts","../src/update/build-update-command.ts","../src/update/run-package-manager-update.ts","../src/update/update-block-cache.ts","../src/update/maybe-auto-update.ts"],"sourcesContent":["function parseVersion(version: string): [number, number, number] {\n  const normalized = version.trim().replace(/^v/, \"\").split(\"-\")[0] ?? \"\";\n  const [major = 0, minor = 0, patch = 0] = normalized.split(\".\").map((part) => {\n    const value = Number.parseInt(part, 10);\n    return Number.isFinite(value) ? value : 0;\n  });\n\n  return [major, minor, patch];\n}\n\nexport function isNewerVersion(latest: string, current: string): boolean {\n  const [latestMajor, latestMinor, latestPatch] = parseVersion(latest);\n  const [currentMajor, currentMinor, currentPatch] = parseVersion(current);\n\n  if (latestMajor !== currentMajor) {\n    return latestMajor > currentMajor;\n  }\n\n  if (latestMinor !== currentMinor) {\n    return latestMinor > currentMinor;\n  }\n\n  return latestPatch > currentPatch;\n}\n","import { existsSync, realpathSync } from \"node:fs\";\nimport { spawnSync } from \"node:child_process\";\nimport { dirname, join } from \"node:path\";\n\nimport { detectPackageManager, type PackageManager } from \"../init/package-manager\";\n\nexport type CliInstallKind = \"global\" | \"local\";\n\nexport type CliInstallInfo = {\n  kind: CliInstallKind;\n  packageManager: PackageManager;\n  packageRoot: string;\n  projectRoot?: string;\n};\n\nfunction realpathSafe(path: string): string {\n  try {\n    return realpathSync(path);\n  } catch {\n    return path;\n  }\n}\n\nfunction detectManagerFromLockfile(dir: string): PackageManager | undefined {\n  if (existsSync(join(dir, \"pnpm-lock.yaml\"))) {\n    return \"pnpm\";\n  }\n\n  if (existsSync(join(dir, \"bun.lockb\")) || existsSync(join(dir, \"bun.lock\"))) {\n    return \"bun\";\n  }\n\n  if (existsSync(join(dir, \"yarn.lock\"))) {\n    return \"yarn\";\n  }\n\n  if (existsSync(join(dir, \"package-lock.json\"))) {\n    return \"npm\";\n  }\n\n  return undefined;\n}\n\nfunction findLocalProjectRoot(packageRoot: string): string | undefined {\n  const normalizedRoot = realpathSafe(packageRoot);\n  let dir = dirname(packageRoot);\n\n  while (dir !== dirname(dir)) {\n    const installedCliPath = join(dir, \"node_modules\", \"@keystrokehq\", \"cli\");\n    if (\n      existsSync(join(dir, \"package.json\")) &&\n      realpathSafe(installedCliPath) === normalizedRoot\n    ) {\n      return dir;\n    }\n\n    dir = dirname(dir);\n  }\n\n  return undefined;\n}\n\nfunction globalRootForManager(manager: PackageManager): string | undefined {\n  const commands: Record<PackageManager, { command: string; args: string[] }> = {\n    pnpm: { command: \"pnpm\", args: [\"root\", \"-g\"] },\n    npm: { command: \"npm\", args: [\"root\", \"-g\"] },\n    yarn: { command: \"yarn\", args: [\"global\", \"dir\"] },\n    bun: { command: \"bun\", args: [\"pm\", \"bin\"] },\n  };\n\n  const { command, args } = commands[manager];\n  const result = spawnSync(command, args, { encoding: \"utf8\" });\n\n  if (result.status !== 0) {\n    return undefined;\n  }\n\n  const root = result.stdout.trim();\n  return root ? realpathSafe(root) : undefined;\n}\n\nfunction detectGlobalManager(packageRoot: string): PackageManager {\n  const normalizedRoot = realpathSafe(packageRoot);\n\n  if (normalizedRoot.includes(`${join(\"\", \".pnpm\")}`)) {\n    return \"pnpm\";\n  }\n\n  for (const manager of [\"pnpm\", \"npm\", \"yarn\", \"bun\"] as const) {\n    const globalRoot = globalRootForManager(manager);\n    if (globalRoot && normalizedRoot.startsWith(globalRoot)) {\n      return manager;\n    }\n  }\n\n  if (process.env.PNPM_HOME) {\n    return \"pnpm\";\n  }\n\n  return detectPackageManager();\n}\n\nexport function detectCliInstall(packageRoot: string): CliInstallInfo | undefined {\n  const normalizedRoot = realpathSafe(packageRoot);\n  const projectRoot = findLocalProjectRoot(normalizedRoot);\n\n  if (projectRoot) {\n    const packageManager = detectManagerFromLockfile(projectRoot) ?? detectPackageManager();\n\n    return {\n      kind: \"local\",\n      packageManager,\n      packageRoot: normalizedRoot,\n      projectRoot,\n    };\n  }\n\n  return {\n    kind: \"global\",\n    packageManager: detectGlobalManager(normalizedRoot),\n    packageRoot: normalizedRoot,\n  };\n}\n","const RELEASE_AGE_PATTERNS = [\n  /minimumReleaseAge/i,\n  /minimum-release-age/i,\n  /ERR_PNPM_NO_MATURE_MATCHING_VERSION/,\n  /ERR_PNPM_MINIMUM_RELEASE_AGE/,\n  /does not meet the minimumReleaseAge constraint/,\n];\n\nexport function isReleaseAgeBlock(output: string): boolean {\n  return RELEASE_AGE_PATTERNS.some((pattern) => pattern.test(output));\n}\n\nexport function formatReleaseAgeBlockMessage(options: {\n  currentVersion: string;\n  availableVersion: string;\n  retryAfter?: Date;\n}): string {\n  const retry =\n    options.retryAfter !== undefined ? ` Retry after ${options.retryAfter.toLocaleString()}.` : \"\";\n\n  return (\n    `@keystrokehq/cli ${options.availableVersion} is available but blocked by your ` +\n    `minimum-release-age setting. You're on ${options.currentVersion}.${retry} ` +\n    `Add @keystrokehq/cli to minimumReleaseAgeExclude to install immediately.`\n  );\n}\n","const REGISTRY_URL = \"https://registry.npmjs.org/@keystrokehq%2Fcli\";\nconst REQUEST_TIMEOUT_MS = 3_000;\n\ntype RegistryPackage = {\n  \"dist-tags\"?: {\n    latest?: string;\n  };\n  time?: Record<string, string>;\n};\n\nexport type CliRegistryRelease = {\n  version: string;\n  publishedAt?: string;\n};\n\nexport async function fetchLatestCliRelease(): Promise<CliRegistryRelease | undefined> {\n  const controller = new AbortController();\n  const timeout = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);\n\n  try {\n    const response = await fetch(REGISTRY_URL, {\n      signal: controller.signal,\n      headers: {\n        Accept: \"application/json\",\n      },\n    });\n\n    if (!response.ok) {\n      return undefined;\n    }\n\n    const payload = (await response.json()) as RegistryPackage;\n    const version = payload[\"dist-tags\"]?.latest?.trim();\n    if (!version) {\n      return undefined;\n    }\n\n    return {\n      version,\n      publishedAt: payload.time?.[version],\n    };\n  } catch {\n    return undefined;\n  } finally {\n    clearTimeout(timeout);\n  }\n}\n\nexport async function fetchLatestCliVersion(): Promise<string | undefined> {\n  const release = await fetchLatestCliRelease();\n  return release?.version;\n}\n","import { spawnSync } from \"node:child_process\";\n\nexport function readPnpmMinimumReleaseAgeMinutes(): number | undefined {\n  const result = spawnSync(\"pnpm\", [\"config\", \"get\", \"minimum-release-age\"], {\n    encoding: \"utf8\",\n  });\n\n  if (result.status !== 0) {\n    return undefined;\n  }\n\n  const value = result.stdout.trim();\n  if (!value || value === \"undefined\" || value === \"0\") {\n    return undefined;\n  }\n\n  const minutes = Number.parseInt(value, 10);\n  return Number.isFinite(minutes) && minutes > 0 ? minutes : undefined;\n}\n\nexport function computeReleaseAgeRetryAfter(\n  publishedAt: string | undefined,\n  minimumReleaseAgeMinutes: number | undefined,\n): Date | undefined {\n  if (!publishedAt || !minimumReleaseAgeMinutes) {\n    return undefined;\n  }\n\n  const publishedMs = Date.parse(publishedAt);\n  if (!Number.isFinite(publishedMs)) {\n    return undefined;\n  }\n\n  return new Date(publishedMs + minimumReleaseAgeMinutes * 60_000);\n}\n","/** pnpm global installs live in `<pnpm-home>/global/<major>/`. */\nexport function resolveGlobalPnpmRoot(packageRoot: string): string | undefined {\n  const normalized = packageRoot.replace(/\\\\/g, \"/\");\n  const match = normalized.match(/^(.*\\/global\\/\\d+)\\//);\n  return match?.[1];\n}\n","import type { CliInstallInfo } from \"./detect-cli-install\";\nimport { resolveGlobalPnpmRoot } from \"./resolve-global-pnpm-root\";\n\nconst PACKAGE_NAME = \"@keystrokehq/cli@latest\";\n\nexport function buildUpdateCommand(install: CliInstallInfo): {\n  command: string;\n  args: string[];\n  cwd?: string;\n} {\n  const { kind, packageManager } = install;\n\n  if (kind === \"global\") {\n    switch (packageManager) {\n      case \"pnpm\":\n        return {\n          command: \"pnpm\",\n          args: [\"add\", \"-g\", PACKAGE_NAME],\n          cwd: resolveGlobalPnpmRoot(install.packageRoot),\n        };\n      case \"yarn\":\n        return { command: \"yarn\", args: [\"global\", \"add\", PACKAGE_NAME] };\n      case \"bun\":\n        return { command: \"bun\", args: [\"add\", \"-g\", PACKAGE_NAME] };\n      case \"npm\":\n      default:\n        return { command: \"npm\", args: [\"install\", \"-g\", PACKAGE_NAME] };\n    }\n  }\n\n  const cwd = install.projectRoot;\n  switch (packageManager) {\n    case \"pnpm\":\n      return { command: \"pnpm\", args: [\"add\", \"-D\", PACKAGE_NAME], cwd };\n    case \"yarn\":\n      return { command: \"yarn\", args: [\"add\", \"-D\", PACKAGE_NAME], cwd };\n    case \"bun\":\n      return { command: \"bun\", args: [\"add\", \"-D\", PACKAGE_NAME], cwd };\n    case \"npm\":\n    default:\n      return { command: \"npm\", args: [\"install\", \"-D\", PACKAGE_NAME], cwd };\n  }\n}\n","import { spawnSync } from \"node:child_process\";\n\nimport { buildUpdateCommand } from \"./build-update-command\";\nimport type { CliInstallInfo } from \"./detect-cli-install\";\n\nexport function updateSpawnEnv(): NodeJS.ProcessEnv {\n  const env = { ...process.env };\n  const pnpmHome = env.PNPM_HOME;\n\n  if (!pnpmHome) {\n    return env;\n  }\n\n  const pathKey = process.platform === \"win32\" ? \"Path\" : \"PATH\";\n  const path = env[pathKey] ?? \"\";\n  const segments = path.split(process.platform === \"win32\" ? \";\" : \":\");\n  const binDir = `${pnpmHome}/bin`;\n  const prefix = [binDir, pnpmHome].filter((dir) => !segments.includes(dir));\n\n  if (prefix.length > 0) {\n    env[pathKey] = [...prefix, path].filter(Boolean).join(process.platform === \"win32\" ? \";\" : \":\");\n  }\n\n  return env;\n}\n\nexport type PackageManagerRunResult = {\n  ok: boolean;\n  output: string;\n};\n\nfunction runPackageManager(command: string, args: string[], cwd?: string): PackageManagerRunResult {\n  const result = spawnSync(command, args, {\n    cwd,\n    encoding: \"utf8\",\n    env: updateSpawnEnv(),\n  });\n\n  const output = `${result.stdout ?? \"\"}${result.stderr ?? \"\"}`;\n\n  return {\n    ok: result.status === 0,\n    output,\n  };\n}\n\nfunction migratePnpmGlobal(cwd: string): boolean {\n  const result = spawnSync(\"pnpm\", [\"install\"], {\n    cwd,\n    encoding: \"utf8\",\n    env: {\n      ...updateSpawnEnv(),\n      CI: \"true\",\n    },\n  });\n\n  return result.status === 0;\n}\n\nexport function runPackageManagerUpdate(install: CliInstallInfo): PackageManagerRunResult {\n  const { command, args, cwd } = buildUpdateCommand(install);\n  const firstAttempt = runPackageManager(command, args, cwd);\n\n  if (firstAttempt.ok) {\n    return firstAttempt;\n  }\n\n  if (install.kind === \"global\" && install.packageManager === \"pnpm\" && cwd) {\n    if (migratePnpmGlobal(cwd)) {\n      return runPackageManager(command, args, cwd);\n    }\n  }\n\n  return firstAttempt;\n}\n","import { existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\n\nimport { getCliConfigDir } from \"../config\";\n\nexport type UpdateBlockCache = {\n  registryLatest?: string;\n  blockedUntil?: string;\n  lastFailedAt?: string;\n};\n\nconst CACHE_FILE = \"update-check.json\";\nconst GENERIC_RETRY_MS = 24 * 60 * 60 * 1000;\n\nfunction cachePath(configDir = getCliConfigDir()): string {\n  return join(configDir, CACHE_FILE);\n}\n\nexport function readUpdateBlockCache(configDir?: string): UpdateBlockCache {\n  const path = cachePath(configDir);\n  if (!existsSync(path)) {\n    return {};\n  }\n\n  try {\n    return JSON.parse(readFileSync(path, \"utf8\")) as UpdateBlockCache;\n  } catch {\n    return {};\n  }\n}\n\nexport function writeUpdateBlockCache(cache: UpdateBlockCache, configDir?: string): void {\n  const dir = configDir ?? getCliConfigDir();\n  mkdirSync(dir, { recursive: true });\n  writeFileSync(cachePath(dir), `${JSON.stringify(cache, null, 2)}\\n`, \"utf8\");\n}\n\nexport function shouldSkipCachedUpdate(\n  cache: UpdateBlockCache,\n  registryLatest: string,\n  now = Date.now(),\n): boolean {\n  if (cache.registryLatest !== registryLatest) {\n    return false;\n  }\n\n  if (cache.blockedUntil) {\n    const blockedUntilMs = Date.parse(cache.blockedUntil);\n    if (Number.isFinite(blockedUntilMs) && blockedUntilMs > now) {\n      return true;\n    }\n  }\n\n  if (cache.lastFailedAt) {\n    const lastFailedMs = Date.parse(cache.lastFailedAt);\n    if (Number.isFinite(lastFailedMs) && now - lastFailedMs < GENERIC_RETRY_MS) {\n      return true;\n    }\n  }\n\n  return false;\n}\n\nexport function clearUpdateBlockCache(configDir?: string): void {\n  writeUpdateBlockCache({}, configDir);\n}\n\nexport function recordReleaseAgeBlock(options: {\n  registryLatest: string;\n  retryAfter?: Date;\n  configDir?: string;\n}): void {\n  writeUpdateBlockCache(\n    {\n      registryLatest: options.registryLatest,\n      blockedUntil: options.retryAfter?.toISOString(),\n    },\n    options.configDir,\n  );\n}\n\nexport function recordGenericUpdateFailure(registryLatest: string, configDir?: string): void {\n  writeUpdateBlockCache(\n    {\n      registryLatest,\n      lastFailedAt: new Date().toISOString(),\n    },\n    configDir,\n  );\n}\n","import { spawnSync } from \"node:child_process\";\n\nimport { resolveCliRoot } from \"../project/resolve-cli-root\";\nimport { readCliVersion } from \"../version\";\nimport { isNewerVersion } from \"./compare-version\";\nimport { detectCliInstall } from \"./detect-cli-install\";\nimport { formatReleaseAgeBlockMessage, isReleaseAgeBlock } from \"./detect-release-age-block\";\nimport { fetchLatestCliRelease } from \"./fetch-latest-version\";\nimport {\n  computeReleaseAgeRetryAfter,\n  readPnpmMinimumReleaseAgeMinutes,\n} from \"./read-pnpm-release-age-minutes\";\nimport { runPackageManagerUpdate } from \"./run-package-manager-update\";\nimport {\n  clearUpdateBlockCache,\n  readUpdateBlockCache,\n  recordGenericUpdateFailure,\n  recordReleaseAgeBlock,\n  shouldSkipCachedUpdate,\n} from \"./update-block-cache\";\n\nfunction shouldSkipAutoUpdate(argv: string[]): boolean {\n  if (\n    process.env.KEYSTROKE_DEV ||\n    process.env.KEYSTROKE_SKIP_UPDATE ||\n    process.env.KEYSTROKE_UPDATING\n  ) {\n    return true;\n  }\n\n  if (process.env.CI === \"true\" || process.env.CI === \"1\") {\n    return true;\n  }\n\n  const args = argv.slice(2);\n  if (args.length === 0) {\n    return false;\n  }\n\n  return args.every(\n    (arg) =>\n      arg === \"-V\" ||\n      arg === \"--version\" ||\n      arg === \"-h\" ||\n      arg === \"--help\" ||\n      arg.startsWith(\"-V\"),\n  );\n}\n\nfunction reexecCli(argv: string[]): never {\n  const result = spawnSync(process.execPath, argv.slice(1), {\n    stdio: \"inherit\",\n    env: {\n      ...process.env,\n      KEYSTROKE_UPDATING: \"1\",\n    },\n  });\n\n  process.exit(result.status ?? 1);\n}\n\nfunction releaseAgeRetryAfter(\n  install: NonNullable<ReturnType<typeof detectCliInstall>>,\n  publishedAt: string | undefined,\n): Date | undefined {\n  if (install.packageManager !== \"pnpm\") {\n    return undefined;\n  }\n\n  return computeReleaseAgeRetryAfter(publishedAt, readPnpmMinimumReleaseAgeMinutes());\n}\n\nexport async function maybeAutoUpdate(argv: string[]): Promise<void> {\n  if (shouldSkipAutoUpdate(argv)) {\n    return;\n  }\n\n  const install = detectCliInstall(resolveCliRoot(import.meta.url));\n  if (!install || (install.kind === \"local\" && !install.projectRoot)) {\n    return;\n  }\n\n  const currentVersion = readCliVersion();\n  const release = await fetchLatestCliRelease();\n\n  if (!release || !isNewerVersion(release.version, currentVersion)) {\n    clearUpdateBlockCache();\n    return;\n  }\n\n  const cache = readUpdateBlockCache();\n  if (shouldSkipCachedUpdate(cache, release.version)) {\n    return;\n  }\n\n  process.stderr.write(\n    `Updating @keystrokehq/cli ${currentVersion} -> ${release.version} via ${install.packageManager}...\\n`,\n  );\n\n  const result = runPackageManagerUpdate(install);\n  const installedVersion = readCliVersion();\n\n  if (isNewerVersion(installedVersion, currentVersion)) {\n    clearUpdateBlockCache();\n    process.stderr.write(`Updated @keystrokehq/cli ${currentVersion} -> ${installedVersion}.\\n`);\n    reexecCli(argv);\n  }\n\n  if (result.ok) {\n    clearUpdateBlockCache();\n    return;\n  }\n\n  if (isReleaseAgeBlock(result.output)) {\n    const retryAfter = releaseAgeRetryAfter(install, release.publishedAt);\n    recordReleaseAgeBlock({\n      registryLatest: release.version,\n      retryAfter,\n    });\n    process.stderr.write(\n      `${formatReleaseAgeBlockMessage({\n        currentVersion,\n        availableVersion: release.version,\n        retryAfter,\n      })}\\n`,\n    );\n    return;\n  }\n\n  recordGenericUpdateFailure(release.version);\n  process.stderr.write(\"Auto-update failed; continuing with the current version.\\n\");\n}\n"],"mappings":";;;;;;AAAA,SAAS,aAAa,SAA2C;CAE/D,MAAM,CAAC,QAAQ,GAAG,QAAQ,GAAG,QAAQ,MADlB,QAAQ,KAAK,EAAE,QAAQ,MAAM,EAAE,EAAE,MAAM,GAAG,EAAE,MAAM,IAChB,MAAM,GAAG,EAAE,KAAK,SAAS;EAC5E,MAAM,QAAQ,OAAO,SAAS,MAAM,EAAE;EACtC,OAAO,OAAO,SAAS,KAAK,IAAI,QAAQ;CAC1C,CAAC;CAED,OAAO;EAAC;EAAO;EAAO;CAAK;AAC7B;AAEA,SAAgB,eAAe,QAAgB,SAA0B;CACvE,MAAM,CAAC,aAAa,aAAa,eAAe,aAAa,MAAM;CACnE,MAAM,CAAC,cAAc,cAAc,gBAAgB,aAAa,OAAO;CAEvE,IAAI,gBAAgB,cAClB,OAAO,cAAc;CAGvB,IAAI,gBAAgB,cAClB,OAAO,cAAc;CAGvB,OAAO,cAAc;AACvB;;;ACRA,SAAS,aAAa,MAAsB;CAC1C,IAAI;EACF,OAAO,aAAa,IAAI;CAC1B,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,0BAA0B,KAAyC;CAC1E,IAAI,WAAW,KAAK,KAAK,gBAAgB,CAAC,GACxC,OAAO;CAGT,IAAI,WAAW,KAAK,KAAK,WAAW,CAAC,KAAK,WAAW,KAAK,KAAK,UAAU,CAAC,GACxE,OAAO;CAGT,IAAI,WAAW,KAAK,KAAK,WAAW,CAAC,GACnC,OAAO;CAGT,IAAI,WAAW,KAAK,KAAK,mBAAmB,CAAC,GAC3C,OAAO;AAIX;AAEA,SAAS,qBAAqB,aAAyC;CACrE,MAAM,iBAAiB,aAAa,WAAW;CAC/C,IAAI,MAAM,QAAQ,WAAW;CAE7B,OAAO,QAAQ,QAAQ,GAAG,GAAG;EAC3B,MAAM,mBAAmB,KAAK,KAAK,gBAAgB,gBAAgB,KAAK;EACxE,IACE,WAAW,KAAK,KAAK,cAAc,CAAC,KACpC,aAAa,gBAAgB,MAAM,gBAEnC,OAAO;EAGT,MAAM,QAAQ,GAAG;CACnB;AAGF;AAEA,SAAS,qBAAqB,SAA6C;CAQzE,MAAM,EAAE,SAAS,SAAS;EANxB,MAAM;GAAE,SAAS;GAAQ,MAAM,CAAC,QAAQ,IAAI;EAAE;EAC9C,KAAK;GAAE,SAAS;GAAO,MAAM,CAAC,QAAQ,IAAI;EAAE;EAC5C,MAAM;GAAE,SAAS;GAAQ,MAAM,CAAC,UAAU,KAAK;EAAE;EACjD,KAAK;GAAE,SAAS;GAAO,MAAM,CAAC,MAAM,KAAK;EAAE;CAGZ,EAAE;CACnC,MAAM,SAAS,UAAU,SAAS,MAAM,EAAE,UAAU,OAAO,CAAC;CAE5D,IAAI,OAAO,WAAW,GACpB;CAGF,MAAM,OAAO,OAAO,OAAO,KAAK;CAChC,OAAO,OAAO,aAAa,IAAI,IAAI,KAAA;AACrC;AAEA,SAAS,oBAAoB,aAAqC;CAChE,MAAM,iBAAiB,aAAa,WAAW;CAE/C,IAAI,eAAe,SAAS,GAAG,KAAK,IAAI,OAAO,GAAG,GAChD,OAAO;CAGT,KAAK,MAAM,WAAW;EAAC;EAAQ;EAAO;EAAQ;CAAK,GAAY;EAC7D,MAAM,aAAa,qBAAqB,OAAO;EAC/C,IAAI,cAAc,eAAe,WAAW,UAAU,GACpD,OAAO;CAEX;CAEA,IAAI,QAAQ,IAAI,WACd,OAAO;CAGT,OAAO,qBAAqB;AAC9B;AAEA,SAAgB,iBAAiB,aAAiD;CAChF,MAAM,iBAAiB,aAAa,WAAW;CAC/C,MAAM,cAAc,qBAAqB,cAAc;CAEvD,IAAI,aAGF,OAAO;EACL,MAAM;EACN,gBAJqB,0BAA0B,WAAW,KAAK,qBAAqB;EAKpF,aAAa;EACb;CACF;CAGF,OAAO;EACL,MAAM;EACN,gBAAgB,oBAAoB,cAAc;EAClD,aAAa;CACf;AACF;;;AC1HA,MAAM,uBAAuB;CAC3B;CACA;CACA;CACA;CACA;AACF;AAEA,SAAgB,kBAAkB,QAAyB;CACzD,OAAO,qBAAqB,MAAM,YAAY,QAAQ,KAAK,MAAM,CAAC;AACpE;AAEA,SAAgB,6BAA6B,SAIlC;CACT,MAAM,QACJ,QAAQ,eAAe,KAAA,IAAY,gBAAgB,QAAQ,WAAW,eAAe,EAAE,KAAK;CAE9F,OACE,oBAAoB,QAAQ,iBAAiB,2EACH,QAAQ,eAAe,GAAG,MAAM;AAG9E;;;ACzBA,MAAM,eAAe;AACrB,MAAM,qBAAqB;AAc3B,eAAsB,wBAAiE;CACrF,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,UAAU,iBAAiB,WAAW,MAAM,GAAG,kBAAkB;CAEvE,IAAI;EACF,MAAM,WAAW,MAAM,MAAM,cAAc;GACzC,QAAQ,WAAW;GACnB,SAAS,EACP,QAAQ,mBACV;EACF,CAAC;EAED,IAAI,CAAC,SAAS,IACZ;EAGF,MAAM,UAAW,MAAM,SAAS,KAAK;EACrC,MAAM,UAAU,QAAQ,cAAc,QAAQ,KAAK;EACnD,IAAI,CAAC,SACH;EAGF,OAAO;GACL;GACA,aAAa,QAAQ,OAAO;EAC9B;CACF,QAAQ;EACN;CACF,UAAU;EACR,aAAa,OAAO;CACtB;AACF;;;AC5CA,SAAgB,mCAAuD;CACrE,MAAM,SAAS,UAAU,QAAQ;EAAC;EAAU;EAAO;CAAqB,GAAG,EACzE,UAAU,OACZ,CAAC;CAED,IAAI,OAAO,WAAW,GACpB;CAGF,MAAM,QAAQ,OAAO,OAAO,KAAK;CACjC,IAAI,CAAC,SAAS,UAAU,eAAe,UAAU,KAC/C;CAGF,MAAM,UAAU,OAAO,SAAS,OAAO,EAAE;CACzC,OAAO,OAAO,SAAS,OAAO,KAAK,UAAU,IAAI,UAAU,KAAA;AAC7D;AAEA,SAAgB,4BACd,aACA,0BACkB;CAClB,IAAI,CAAC,eAAe,CAAC,0BACnB;CAGF,MAAM,cAAc,KAAK,MAAM,WAAW;CAC1C,IAAI,CAAC,OAAO,SAAS,WAAW,GAC9B;CAGF,OAAO,IAAI,KAAK,cAAc,2BAA2B,GAAM;AACjE;;;;ACjCA,SAAgB,sBAAsB,aAAyC;CAG7E,OAFmB,YAAY,QAAQ,OAAO,GACvB,EAAE,MAAM,sBACpB,IAAI;AACjB;;;ACFA,MAAM,eAAe;AAErB,SAAgB,mBAAmB,SAIjC;CACA,MAAM,EAAE,MAAM,mBAAmB;CAEjC,IAAI,SAAS,UACX,QAAQ,gBAAR;EACE,KAAK,QACH,OAAO;GACL,SAAS;GACT,MAAM;IAAC;IAAO;IAAM;GAAY;GAChC,KAAK,sBAAsB,QAAQ,WAAW;EAChD;EACF,KAAK,QACH,OAAO;GAAE,SAAS;GAAQ,MAAM;IAAC;IAAU;IAAO;GAAY;EAAE;EAClE,KAAK,OACH,OAAO;GAAE,SAAS;GAAO,MAAM;IAAC;IAAO;IAAM;GAAY;EAAE;EAE7D,SACE,OAAO;GAAE,SAAS;GAAO,MAAM;IAAC;IAAW;IAAM;GAAY;EAAE;CACnE;CAGF,MAAM,MAAM,QAAQ;CACpB,QAAQ,gBAAR;EACE,KAAK,QACH,OAAO;GAAE,SAAS;GAAQ,MAAM;IAAC;IAAO;IAAM;GAAY;GAAG;EAAI;EACnE,KAAK,QACH,OAAO;GAAE,SAAS;GAAQ,MAAM;IAAC;IAAO;IAAM;GAAY;GAAG;EAAI;EACnE,KAAK,OACH,OAAO;GAAE,SAAS;GAAO,MAAM;IAAC;IAAO;IAAM;GAAY;GAAG;EAAI;EAElE,SACE,OAAO;GAAE,SAAS;GAAO,MAAM;IAAC;IAAW;IAAM;GAAY;GAAG;EAAI;CACxE;AACF;;;ACrCA,SAAgB,iBAAoC;CAClD,MAAM,MAAM,EAAE,GAAG,QAAQ,IAAI;CAC7B,MAAM,WAAW,IAAI;CAErB,IAAI,CAAC,UACH,OAAO;CAGT,MAAM,UAAU,QAAQ,aAAa,UAAU,SAAS;CACxD,MAAM,OAAO,IAAI,YAAY;CAC7B,MAAM,WAAW,KAAK,MAAM,QAAQ,aAAa,UAAU,MAAM,GAAG;CAEpE,MAAM,SAAS,CAAC,GADE,SAAS,OACH,QAAQ,EAAE,QAAQ,QAAQ,CAAC,SAAS,SAAS,GAAG,CAAC;CAEzE,IAAI,OAAO,SAAS,GAClB,IAAI,WAAW,CAAC,GAAG,QAAQ,IAAI,EAAE,OAAO,OAAO,EAAE,KAAK,QAAQ,aAAa,UAAU,MAAM,GAAG;CAGhG,OAAO;AACT;AAOA,SAAS,kBAAkB,SAAiB,MAAgB,KAAuC;CACjG,MAAM,SAAS,UAAU,SAAS,MAAM;EACtC;EACA,UAAU;EACV,KAAK,eAAe;CACtB,CAAC;CAED,MAAM,SAAS,GAAG,OAAO,UAAU,KAAK,OAAO,UAAU;CAEzD,OAAO;EACL,IAAI,OAAO,WAAW;EACtB;CACF;AACF;AAEA,SAAS,kBAAkB,KAAsB;CAU/C,OATe,UAAU,QAAQ,CAAC,SAAS,GAAG;EAC5C;EACA,UAAU;EACV,KAAK;GACH,GAAG,eAAe;GAClB,IAAI;EACN;CACF,CAEY,EAAE,WAAW;AAC3B;AAEA,SAAgB,wBAAwB,SAAkD;CACxF,MAAM,EAAE,SAAS,MAAM,QAAQ,mBAAmB,OAAO;CACzD,MAAM,eAAe,kBAAkB,SAAS,MAAM,GAAG;CAEzD,IAAI,aAAa,IACf,OAAO;CAGT,IAAI,QAAQ,SAAS,YAAY,QAAQ,mBAAmB,UAAU;MAChE,kBAAkB,GAAG,GACvB,OAAO,kBAAkB,SAAS,MAAM,GAAG;CAAA;CAI/C,OAAO;AACT;;;AC/DA,MAAM,aAAa;AACnB,MAAM,mBAAmB,OAAU,KAAK;AAExC,SAAS,UAAU,YAAY,gBAAgB,GAAW;CACxD,OAAO,KAAK,WAAW,UAAU;AACnC;AAEA,SAAgB,qBAAqB,WAAsC;CACzE,MAAM,OAAO,UAAU,SAAS;CAChC,IAAI,CAAC,WAAW,IAAI,GAClB,OAAO,CAAC;CAGV,IAAI;EACF,OAAO,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;CAC9C,QAAQ;EACN,OAAO,CAAC;CACV;AACF;AAEA,SAAgB,sBAAsB,OAAyB,WAA0B;CACvF,MAAM,MAAM,aAAa,gBAAgB;CACzC,UAAU,KAAK,EAAE,WAAW,KAAK,CAAC;CAClC,cAAc,UAAU,GAAG,GAAG,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,EAAE,KAAK,MAAM;AAC7E;AAEA,SAAgB,uBACd,OACA,gBACA,MAAM,KAAK,IAAI,GACN;CACT,IAAI,MAAM,mBAAmB,gBAC3B,OAAO;CAGT,IAAI,MAAM,cAAc;EACtB,MAAM,iBAAiB,KAAK,MAAM,MAAM,YAAY;EACpD,IAAI,OAAO,SAAS,cAAc,KAAK,iBAAiB,KACtD,OAAO;CAEX;CAEA,IAAI,MAAM,cAAc;EACtB,MAAM,eAAe,KAAK,MAAM,MAAM,YAAY;EAClD,IAAI,OAAO,SAAS,YAAY,KAAK,MAAM,eAAe,kBACxD,OAAO;CAEX;CAEA,OAAO;AACT;AAEA,SAAgB,sBAAsB,WAA0B;CAC9D,sBAAsB,CAAC,GAAG,SAAS;AACrC;AAEA,SAAgB,sBAAsB,SAI7B;CACP,sBACE;EACE,gBAAgB,QAAQ;EACxB,cAAc,QAAQ,YAAY,YAAY;CAChD,GACA,QAAQ,SACV;AACF;AAEA,SAAgB,2BAA2B,gBAAwB,WAA0B;CAC3F,sBACE;EACE;EACA,+BAAc,IAAI,KAAK,GAAE,YAAY;CACvC,GACA,SACF;AACF;;;ACpEA,SAAS,qBAAqB,MAAyB;CACrD,IACE,QAAQ,IAAI,iBACZ,QAAQ,IAAI,yBACZ,QAAQ,IAAI,oBAEZ,OAAO;CAGT,IAAI,QAAQ,IAAI,OAAO,UAAU,QAAQ,IAAI,OAAO,KAClD,OAAO;CAGT,MAAM,OAAO,KAAK,MAAM,CAAC;CACzB,IAAI,KAAK,WAAW,GAClB,OAAO;CAGT,OAAO,KAAK,OACT,QACC,QAAQ,QACR,QAAQ,eACR,QAAQ,QACR,QAAQ,YACR,IAAI,WAAW,IAAI,CACvB;AACF;AAEA,SAAS,UAAU,MAAuB;CACxC,MAAM,SAAS,UAAU,QAAQ,UAAU,KAAK,MAAM,CAAC,GAAG;EACxD,OAAO;EACP,KAAK;GACH,GAAG,QAAQ;GACX,oBAAoB;EACtB;CACF,CAAC;CAED,QAAQ,KAAK,OAAO,UAAU,CAAC;AACjC;AAEA,SAAS,qBACP,SACA,aACkB;CAClB,IAAI,QAAQ,mBAAmB,QAC7B;CAGF,OAAO,4BAA4B,aAAa,iCAAiC,CAAC;AACpF;AAEA,eAAsB,gBAAgB,MAA+B;CACnE,IAAI,qBAAqB,IAAI,GAC3B;CAGF,MAAM,UAAU,iBAAiB,eAAe,OAAO,KAAK,GAAG,CAAC;CAChE,IAAI,CAAC,WAAY,QAAQ,SAAS,WAAW,CAAC,QAAQ,aACpD;CAGF,MAAM,iBAAiB,eAAe;CACtC,MAAM,UAAU,MAAM,sBAAsB;CAE5C,IAAI,CAAC,WAAW,CAAC,eAAe,QAAQ,SAAS,cAAc,GAAG;EAChE,sBAAsB;EACtB;CACF;CAGA,IAAI,uBADU,qBACiB,GAAG,QAAQ,OAAO,GAC/C;CAGF,QAAQ,OAAO,MACb,6BAA6B,eAAe,MAAM,QAAQ,QAAQ,OAAO,QAAQ,eAAe,MAClG;CAEA,MAAM,SAAS,wBAAwB,OAAO;CAC9C,MAAM,mBAAmB,eAAe;CAExC,IAAI,eAAe,kBAAkB,cAAc,GAAG;EACpD,sBAAsB;EACtB,QAAQ,OAAO,MAAM,4BAA4B,eAAe,MAAM,iBAAiB,IAAI;EAC3F,UAAU,IAAI;CAChB;CAEA,IAAI,OAAO,IAAI;EACb,sBAAsB;EACtB;CACF;CAEA,IAAI,kBAAkB,OAAO,MAAM,GAAG;EACpC,MAAM,aAAa,qBAAqB,SAAS,QAAQ,WAAW;EACpE,sBAAsB;GACpB,gBAAgB,QAAQ;GACxB;EACF,CAAC;EACD,QAAQ,OAAO,MACb,GAAG,6BAA6B;GAC9B;GACA,kBAAkB,QAAQ;GAC1B;EACF,CAAC,EAAE,GACL;EACA;CACF;CAEA,2BAA2B,QAAQ,OAAO;CAC1C,QAAQ,OAAO,MAAM,4DAA4D;AACnF"}
+{"version":3,"file":"maybe-auto-update-BiR_kXZX.mjs","names":[],"sources":["../src/update/compare-version.ts","../src/update/detect-cli-install.ts","../src/update/detect-release-age-block.ts","../src/update/fetch-latest-version.ts","../src/update/read-pnpm-release-age-minutes.ts","../src/update/resolve-global-pnpm-root.ts","../src/update/build-update-command.ts","../src/update/run-package-manager-update.ts","../src/update/update-block-cache.ts","../src/update/maybe-auto-update.ts"],"sourcesContent":["function parseVersion(version: string): [number, number, number] {\n  const normalized = version.trim().replace(/^v/, \"\").split(\"-\")[0] ?? \"\";\n  const [major = 0, minor = 0, patch = 0] = normalized.split(\".\").map((part) => {\n    const value = Number.parseInt(part, 10);\n    return Number.isFinite(value) ? value : 0;\n  });\n\n  return [major, minor, patch];\n}\n\nexport function isNewerVersion(latest: string, current: string): boolean {\n  const [latestMajor, latestMinor, latestPatch] = parseVersion(latest);\n  const [currentMajor, currentMinor, currentPatch] = parseVersion(current);\n\n  if (latestMajor !== currentMajor) {\n    return latestMajor > currentMajor;\n  }\n\n  if (latestMinor !== currentMinor) {\n    return latestMinor > currentMinor;\n  }\n\n  return latestPatch > currentPatch;\n}\n","import { existsSync, realpathSync } from \"node:fs\";\nimport { spawnSync } from \"node:child_process\";\nimport { dirname, join } from \"node:path\";\n\nimport { detectPackageManager, type PackageManager } from \"../init/package-manager\";\n\nexport type CliInstallKind = \"global\" | \"local\";\n\nexport type CliInstallInfo = {\n  kind: CliInstallKind;\n  packageManager: PackageManager;\n  packageRoot: string;\n  projectRoot?: string;\n};\n\nfunction realpathSafe(path: string): string {\n  try {\n    return realpathSync(path);\n  } catch {\n    return path;\n  }\n}\n\nfunction detectManagerFromLockfile(dir: string): PackageManager | undefined {\n  if (existsSync(join(dir, \"pnpm-lock.yaml\"))) {\n    return \"pnpm\";\n  }\n\n  if (existsSync(join(dir, \"bun.lockb\")) || existsSync(join(dir, \"bun.lock\"))) {\n    return \"bun\";\n  }\n\n  if (existsSync(join(dir, \"yarn.lock\"))) {\n    return \"yarn\";\n  }\n\n  if (existsSync(join(dir, \"package-lock.json\"))) {\n    return \"npm\";\n  }\n\n  return undefined;\n}\n\nfunction findLocalProjectRoot(packageRoot: string): string | undefined {\n  const normalizedRoot = realpathSafe(packageRoot);\n  let dir = dirname(packageRoot);\n\n  while (dir !== dirname(dir)) {\n    const installedCliPath = join(dir, \"node_modules\", \"@keystrokehq\", \"cli\");\n    if (\n      existsSync(join(dir, \"package.json\")) &&\n      realpathSafe(installedCliPath) === normalizedRoot\n    ) {\n      return dir;\n    }\n\n    dir = dirname(dir);\n  }\n\n  return undefined;\n}\n\nfunction globalRootForManager(manager: PackageManager): string | undefined {\n  const commands: Record<PackageManager, { command: string; args: string[] }> = {\n    pnpm: { command: \"pnpm\", args: [\"root\", \"-g\"] },\n    npm: { command: \"npm\", args: [\"root\", \"-g\"] },\n    yarn: { command: \"yarn\", args: [\"global\", \"dir\"] },\n    bun: { command: \"bun\", args: [\"pm\", \"bin\"] },\n  };\n\n  const { command, args } = commands[manager];\n  const result = spawnSync(command, args, { encoding: \"utf8\" });\n\n  if (result.status !== 0) {\n    return undefined;\n  }\n\n  const root = result.stdout.trim();\n  return root ? realpathSafe(root) : undefined;\n}\n\nfunction detectGlobalManager(packageRoot: string): PackageManager {\n  const normalizedRoot = realpathSafe(packageRoot);\n\n  if (normalizedRoot.includes(`${join(\"\", \".pnpm\")}`)) {\n    return \"pnpm\";\n  }\n\n  for (const manager of [\"pnpm\", \"npm\", \"yarn\", \"bun\"] as const) {\n    const globalRoot = globalRootForManager(manager);\n    if (globalRoot && normalizedRoot.startsWith(globalRoot)) {\n      return manager;\n    }\n  }\n\n  if (process.env.PNPM_HOME) {\n    return \"pnpm\";\n  }\n\n  return detectPackageManager();\n}\n\nexport function detectCliInstall(packageRoot: string): CliInstallInfo | undefined {\n  const normalizedRoot = realpathSafe(packageRoot);\n  const projectRoot = findLocalProjectRoot(normalizedRoot);\n\n  if (projectRoot) {\n    const packageManager = detectManagerFromLockfile(projectRoot) ?? detectPackageManager();\n\n    return {\n      kind: \"local\",\n      packageManager,\n      packageRoot: normalizedRoot,\n      projectRoot,\n    };\n  }\n\n  return {\n    kind: \"global\",\n    packageManager: detectGlobalManager(normalizedRoot),\n    packageRoot: normalizedRoot,\n  };\n}\n","const RELEASE_AGE_PATTERNS = [\n  /minimumReleaseAge/i,\n  /minimum-release-age/i,\n  /ERR_PNPM_NO_MATURE_MATCHING_VERSION/,\n  /ERR_PNPM_MINIMUM_RELEASE_AGE/,\n  /does not meet the minimumReleaseAge constraint/,\n];\n\nexport function isReleaseAgeBlock(output: string): boolean {\n  return RELEASE_AGE_PATTERNS.some((pattern) => pattern.test(output));\n}\n\nexport function formatReleaseAgeBlockMessage(options: {\n  currentVersion: string;\n  availableVersion: string;\n  retryAfter?: Date;\n}): string {\n  const retry =\n    options.retryAfter !== undefined ? ` Retry after ${options.retryAfter.toLocaleString()}.` : \"\";\n\n  return (\n    `@keystrokehq/cli ${options.availableVersion} is available but blocked by your ` +\n    `minimum-release-age setting. You're on ${options.currentVersion}.${retry} ` +\n    `Add @keystrokehq/cli to minimumReleaseAgeExclude to install immediately.`\n  );\n}\n","const REGISTRY_URL = \"https://registry.npmjs.org/@keystrokehq%2Fcli\";\nconst REQUEST_TIMEOUT_MS = 3_000;\n\ntype RegistryPackage = {\n  \"dist-tags\"?: {\n    latest?: string;\n  };\n  time?: Record<string, string>;\n};\n\nexport type CliRegistryRelease = {\n  version: string;\n  publishedAt?: string;\n};\n\nexport async function fetchLatestCliRelease(): Promise<CliRegistryRelease | undefined> {\n  const controller = new AbortController();\n  const timeout = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);\n\n  try {\n    const response = await fetch(REGISTRY_URL, {\n      signal: controller.signal,\n      headers: {\n        Accept: \"application/json\",\n      },\n    });\n\n    if (!response.ok) {\n      return undefined;\n    }\n\n    const payload = (await response.json()) as RegistryPackage;\n    const version = payload[\"dist-tags\"]?.latest?.trim();\n    if (!version) {\n      return undefined;\n    }\n\n    return {\n      version,\n      publishedAt: payload.time?.[version],\n    };\n  } catch {\n    return undefined;\n  } finally {\n    clearTimeout(timeout);\n  }\n}\n\nexport async function fetchLatestCliVersion(): Promise<string | undefined> {\n  const release = await fetchLatestCliRelease();\n  return release?.version;\n}\n","import { spawnSync } from \"node:child_process\";\n\nexport function readPnpmMinimumReleaseAgeMinutes(): number | undefined {\n  const result = spawnSync(\"pnpm\", [\"config\", \"get\", \"minimum-release-age\"], {\n    encoding: \"utf8\",\n  });\n\n  if (result.status !== 0) {\n    return undefined;\n  }\n\n  const value = result.stdout.trim();\n  if (!value || value === \"undefined\" || value === \"0\") {\n    return undefined;\n  }\n\n  const minutes = Number.parseInt(value, 10);\n  return Number.isFinite(minutes) && minutes > 0 ? minutes : undefined;\n}\n\nexport function computeReleaseAgeRetryAfter(\n  publishedAt: string | undefined,\n  minimumReleaseAgeMinutes: number | undefined,\n): Date | undefined {\n  if (!publishedAt || !minimumReleaseAgeMinutes) {\n    return undefined;\n  }\n\n  const publishedMs = Date.parse(publishedAt);\n  if (!Number.isFinite(publishedMs)) {\n    return undefined;\n  }\n\n  return new Date(publishedMs + minimumReleaseAgeMinutes * 60_000);\n}\n","/** pnpm global installs live in `<pnpm-home>/global/<major>/`. */\nexport function resolveGlobalPnpmRoot(packageRoot: string): string | undefined {\n  const normalized = packageRoot.replace(/\\\\/g, \"/\");\n  const match = normalized.match(/^(.*\\/global\\/\\d+)\\//);\n  return match?.[1];\n}\n","import type { CliInstallInfo } from \"./detect-cli-install\";\nimport { resolveGlobalPnpmRoot } from \"./resolve-global-pnpm-root\";\n\nconst PACKAGE_NAME = \"@keystrokehq/cli@latest\";\n\nexport function buildUpdateCommand(install: CliInstallInfo): {\n  command: string;\n  args: string[];\n  cwd?: string;\n} {\n  const { kind, packageManager } = install;\n\n  if (kind === \"global\") {\n    switch (packageManager) {\n      case \"pnpm\":\n        return {\n          command: \"pnpm\",\n          args: [\"add\", \"-g\", PACKAGE_NAME],\n          cwd: resolveGlobalPnpmRoot(install.packageRoot),\n        };\n      case \"yarn\":\n        return { command: \"yarn\", args: [\"global\", \"add\", PACKAGE_NAME] };\n      case \"bun\":\n        return { command: \"bun\", args: [\"add\", \"-g\", PACKAGE_NAME] };\n      case \"npm\":\n      default:\n        return { command: \"npm\", args: [\"install\", \"-g\", PACKAGE_NAME] };\n    }\n  }\n\n  const cwd = install.projectRoot;\n  switch (packageManager) {\n    case \"pnpm\":\n      return { command: \"pnpm\", args: [\"add\", \"-D\", PACKAGE_NAME], cwd };\n    case \"yarn\":\n      return { command: \"yarn\", args: [\"add\", \"-D\", PACKAGE_NAME], cwd };\n    case \"bun\":\n      return { command: \"bun\", args: [\"add\", \"-D\", PACKAGE_NAME], cwd };\n    case \"npm\":\n    default:\n      return { command: \"npm\", args: [\"install\", \"-D\", PACKAGE_NAME], cwd };\n  }\n}\n","import { spawnSync } from \"node:child_process\";\n\nimport { buildUpdateCommand } from \"./build-update-command\";\nimport type { CliInstallInfo } from \"./detect-cli-install\";\n\nexport function updateSpawnEnv(): NodeJS.ProcessEnv {\n  const env = { ...process.env };\n  const pnpmHome = env.PNPM_HOME;\n\n  if (!pnpmHome) {\n    return env;\n  }\n\n  const pathKey = process.platform === \"win32\" ? \"Path\" : \"PATH\";\n  const path = env[pathKey] ?? \"\";\n  const segments = path.split(process.platform === \"win32\" ? \";\" : \":\");\n  const binDir = `${pnpmHome}/bin`;\n  const prefix = [binDir, pnpmHome].filter((dir) => !segments.includes(dir));\n\n  if (prefix.length > 0) {\n    env[pathKey] = [...prefix, path].filter(Boolean).join(process.platform === \"win32\" ? \";\" : \":\");\n  }\n\n  return env;\n}\n\nexport type PackageManagerRunResult = {\n  ok: boolean;\n  output: string;\n};\n\nfunction runPackageManager(command: string, args: string[], cwd?: string): PackageManagerRunResult {\n  const result = spawnSync(command, args, {\n    cwd,\n    encoding: \"utf8\",\n    env: updateSpawnEnv(),\n  });\n\n  const output = `${result.stdout ?? \"\"}${result.stderr ?? \"\"}`;\n\n  return {\n    ok: result.status === 0,\n    output,\n  };\n}\n\nfunction migratePnpmGlobal(cwd: string): boolean {\n  const result = spawnSync(\"pnpm\", [\"install\"], {\n    cwd,\n    encoding: \"utf8\",\n    env: {\n      ...updateSpawnEnv(),\n      CI: \"true\",\n    },\n  });\n\n  return result.status === 0;\n}\n\nexport function runPackageManagerUpdate(install: CliInstallInfo): PackageManagerRunResult {\n  const { command, args, cwd } = buildUpdateCommand(install);\n  const firstAttempt = runPackageManager(command, args, cwd);\n\n  if (firstAttempt.ok) {\n    return firstAttempt;\n  }\n\n  if (install.kind === \"global\" && install.packageManager === \"pnpm\" && cwd) {\n    if (migratePnpmGlobal(cwd)) {\n      return runPackageManager(command, args, cwd);\n    }\n  }\n\n  return firstAttempt;\n}\n","import { existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\n\nimport { getCliConfigDir } from \"../config\";\n\nexport type UpdateBlockCache = {\n  registryLatest?: string;\n  blockedUntil?: string;\n  lastFailedAt?: string;\n};\n\nconst CACHE_FILE = \"update-check.json\";\nconst GENERIC_RETRY_MS = 24 * 60 * 60 * 1000;\n\nfunction cachePath(configDir = getCliConfigDir()): string {\n  return join(configDir, CACHE_FILE);\n}\n\nexport function readUpdateBlockCache(configDir?: string): UpdateBlockCache {\n  const path = cachePath(configDir);\n  if (!existsSync(path)) {\n    return {};\n  }\n\n  try {\n    return JSON.parse(readFileSync(path, \"utf8\")) as UpdateBlockCache;\n  } catch {\n    return {};\n  }\n}\n\nexport function writeUpdateBlockCache(cache: UpdateBlockCache, configDir?: string): void {\n  const dir = configDir ?? getCliConfigDir();\n  mkdirSync(dir, { recursive: true });\n  writeFileSync(cachePath(dir), `${JSON.stringify(cache, null, 2)}\\n`, \"utf8\");\n}\n\nexport function shouldSkipCachedUpdate(\n  cache: UpdateBlockCache,\n  registryLatest: string,\n  now = Date.now(),\n): boolean {\n  if (cache.registryLatest !== registryLatest) {\n    return false;\n  }\n\n  if (cache.blockedUntil) {\n    const blockedUntilMs = Date.parse(cache.blockedUntil);\n    if (Number.isFinite(blockedUntilMs) && blockedUntilMs > now) {\n      return true;\n    }\n  }\n\n  if (cache.lastFailedAt) {\n    const lastFailedMs = Date.parse(cache.lastFailedAt);\n    if (Number.isFinite(lastFailedMs) && now - lastFailedMs < GENERIC_RETRY_MS) {\n      return true;\n    }\n  }\n\n  return false;\n}\n\nexport function clearUpdateBlockCache(configDir?: string): void {\n  writeUpdateBlockCache({}, configDir);\n}\n\nexport function recordReleaseAgeBlock(options: {\n  registryLatest: string;\n  retryAfter?: Date;\n  configDir?: string;\n}): void {\n  writeUpdateBlockCache(\n    {\n      registryLatest: options.registryLatest,\n      blockedUntil: options.retryAfter?.toISOString(),\n    },\n    options.configDir,\n  );\n}\n\nexport function recordGenericUpdateFailure(registryLatest: string, configDir?: string): void {\n  writeUpdateBlockCache(\n    {\n      registryLatest,\n      lastFailedAt: new Date().toISOString(),\n    },\n    configDir,\n  );\n}\n","import { spawnSync } from \"node:child_process\";\n\nimport { resolveCliRoot } from \"../project/resolve-cli-root\";\nimport { readCliVersion } from \"../version\";\nimport { isNewerVersion } from \"./compare-version\";\nimport { detectCliInstall } from \"./detect-cli-install\";\nimport { formatReleaseAgeBlockMessage, isReleaseAgeBlock } from \"./detect-release-age-block\";\nimport { fetchLatestCliRelease } from \"./fetch-latest-version\";\nimport {\n  computeReleaseAgeRetryAfter,\n  readPnpmMinimumReleaseAgeMinutes,\n} from \"./read-pnpm-release-age-minutes\";\nimport { runPackageManagerUpdate } from \"./run-package-manager-update\";\nimport {\n  clearUpdateBlockCache,\n  readUpdateBlockCache,\n  recordGenericUpdateFailure,\n  recordReleaseAgeBlock,\n  shouldSkipCachedUpdate,\n} from \"./update-block-cache\";\n\nfunction shouldSkipAutoUpdate(argv: string[]): boolean {\n  if (\n    process.env.KEYSTROKE_DEV ||\n    process.env.KEYSTROKE_SKIP_UPDATE ||\n    process.env.KEYSTROKE_UPDATING\n  ) {\n    return true;\n  }\n\n  if (process.env.CI === \"true\" || process.env.CI === \"1\") {\n    return true;\n  }\n\n  const args = argv.slice(2);\n  if (args.length === 0) {\n    return false;\n  }\n\n  return args.every(\n    (arg) =>\n      arg === \"-V\" ||\n      arg === \"--version\" ||\n      arg === \"-h\" ||\n      arg === \"--help\" ||\n      arg.startsWith(\"-V\"),\n  );\n}\n\nfunction reexecCli(argv: string[]): never {\n  const result = spawnSync(process.execPath, argv.slice(1), {\n    stdio: \"inherit\",\n    env: {\n      ...process.env,\n      KEYSTROKE_UPDATING: \"1\",\n    },\n  });\n\n  process.exit(result.status ?? 1);\n}\n\nfunction releaseAgeRetryAfter(\n  install: NonNullable<ReturnType<typeof detectCliInstall>>,\n  publishedAt: string | undefined,\n): Date | undefined {\n  if (install.packageManager !== \"pnpm\") {\n    return undefined;\n  }\n\n  return computeReleaseAgeRetryAfter(publishedAt, readPnpmMinimumReleaseAgeMinutes());\n}\n\nexport async function maybeAutoUpdate(argv: string[]): Promise<void> {\n  if (shouldSkipAutoUpdate(argv)) {\n    return;\n  }\n\n  const install = detectCliInstall(resolveCliRoot(import.meta.url));\n  if (!install || (install.kind === \"local\" && !install.projectRoot)) {\n    return;\n  }\n\n  const currentVersion = readCliVersion();\n  const release = await fetchLatestCliRelease();\n\n  if (!release || !isNewerVersion(release.version, currentVersion)) {\n    clearUpdateBlockCache();\n    return;\n  }\n\n  const cache = readUpdateBlockCache();\n  if (shouldSkipCachedUpdate(cache, release.version)) {\n    return;\n  }\n\n  process.stderr.write(\n    `Updating @keystrokehq/cli ${currentVersion} -> ${release.version} via ${install.packageManager}...\\n`,\n  );\n\n  const result = runPackageManagerUpdate(install);\n  const installedVersion = readCliVersion();\n\n  if (isNewerVersion(installedVersion, currentVersion)) {\n    clearUpdateBlockCache();\n    process.stderr.write(`Updated @keystrokehq/cli ${currentVersion} -> ${installedVersion}.\\n`);\n    reexecCli(argv);\n  }\n\n  if (result.ok) {\n    clearUpdateBlockCache();\n    return;\n  }\n\n  if (isReleaseAgeBlock(result.output)) {\n    const retryAfter = releaseAgeRetryAfter(install, release.publishedAt);\n    recordReleaseAgeBlock({\n      registryLatest: release.version,\n      retryAfter,\n    });\n    process.stderr.write(\n      `${formatReleaseAgeBlockMessage({\n        currentVersion,\n        availableVersion: release.version,\n        retryAfter,\n      })}\\n`,\n    );\n    return;\n  }\n\n  recordGenericUpdateFailure(release.version);\n  process.stderr.write(\"Auto-update failed; continuing with the current version.\\n\");\n}\n"],"mappings":";;;;;;AAAA,SAAS,aAAa,SAA2C;CAE/D,MAAM,CAAC,QAAQ,GAAG,QAAQ,GAAG,QAAQ,MADlB,QAAQ,KAAK,EAAE,QAAQ,MAAM,EAAE,EAAE,MAAM,GAAG,EAAE,MAAM,IAChB,MAAM,GAAG,EAAE,KAAK,SAAS;EAC5E,MAAM,QAAQ,OAAO,SAAS,MAAM,EAAE;EACtC,OAAO,OAAO,SAAS,KAAK,IAAI,QAAQ;CAC1C,CAAC;CAED,OAAO;EAAC;EAAO;EAAO;CAAK;AAC7B;AAEA,SAAgB,eAAe,QAAgB,SAA0B;CACvE,MAAM,CAAC,aAAa,aAAa,eAAe,aAAa,MAAM;CACnE,MAAM,CAAC,cAAc,cAAc,gBAAgB,aAAa,OAAO;CAEvE,IAAI,gBAAgB,cAClB,OAAO,cAAc;CAGvB,IAAI,gBAAgB,cAClB,OAAO,cAAc;CAGvB,OAAO,cAAc;AACvB;;;ACRA,SAAS,aAAa,MAAsB;CAC1C,IAAI;EACF,OAAO,aAAa,IAAI;CAC1B,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,0BAA0B,KAAyC;CAC1E,IAAI,WAAW,KAAK,KAAK,gBAAgB,CAAC,GACxC,OAAO;CAGT,IAAI,WAAW,KAAK,KAAK,WAAW,CAAC,KAAK,WAAW,KAAK,KAAK,UAAU,CAAC,GACxE,OAAO;CAGT,IAAI,WAAW,KAAK,KAAK,WAAW,CAAC,GACnC,OAAO;CAGT,IAAI,WAAW,KAAK,KAAK,mBAAmB,CAAC,GAC3C,OAAO;AAIX;AAEA,SAAS,qBAAqB,aAAyC;CACrE,MAAM,iBAAiB,aAAa,WAAW;CAC/C,IAAI,MAAM,QAAQ,WAAW;CAE7B,OAAO,QAAQ,QAAQ,GAAG,GAAG;EAC3B,MAAM,mBAAmB,KAAK,KAAK,gBAAgB,gBAAgB,KAAK;EACxE,IACE,WAAW,KAAK,KAAK,cAAc,CAAC,KACpC,aAAa,gBAAgB,MAAM,gBAEnC,OAAO;EAGT,MAAM,QAAQ,GAAG;CACnB;AAGF;AAEA,SAAS,qBAAqB,SAA6C;CAQzE,MAAM,EAAE,SAAS,SAAS;EANxB,MAAM;GAAE,SAAS;GAAQ,MAAM,CAAC,QAAQ,IAAI;EAAE;EAC9C,KAAK;GAAE,SAAS;GAAO,MAAM,CAAC,QAAQ,IAAI;EAAE;EAC5C,MAAM;GAAE,SAAS;GAAQ,MAAM,CAAC,UAAU,KAAK;EAAE;EACjD,KAAK;GAAE,SAAS;GAAO,MAAM,CAAC,MAAM,KAAK;EAAE;CAGZ,EAAE;CACnC,MAAM,SAAS,UAAU,SAAS,MAAM,EAAE,UAAU,OAAO,CAAC;CAE5D,IAAI,OAAO,WAAW,GACpB;CAGF,MAAM,OAAO,OAAO,OAAO,KAAK;CAChC,OAAO,OAAO,aAAa,IAAI,IAAI,KAAA;AACrC;AAEA,SAAS,oBAAoB,aAAqC;CAChE,MAAM,iBAAiB,aAAa,WAAW;CAE/C,IAAI,eAAe,SAAS,GAAG,KAAK,IAAI,OAAO,GAAG,GAChD,OAAO;CAGT,KAAK,MAAM,WAAW;EAAC;EAAQ;EAAO;EAAQ;CAAK,GAAY;EAC7D,MAAM,aAAa,qBAAqB,OAAO;EAC/C,IAAI,cAAc,eAAe,WAAW,UAAU,GACpD,OAAO;CAEX;CAEA,IAAI,QAAQ,IAAI,WACd,OAAO;CAGT,OAAO,qBAAqB;AAC9B;AAEA,SAAgB,iBAAiB,aAAiD;CAChF,MAAM,iBAAiB,aAAa,WAAW;CAC/C,MAAM,cAAc,qBAAqB,cAAc;CAEvD,IAAI,aAGF,OAAO;EACL,MAAM;EACN,gBAJqB,0BAA0B,WAAW,KAAK,qBAAqB;EAKpF,aAAa;EACb;CACF;CAGF,OAAO;EACL,MAAM;EACN,gBAAgB,oBAAoB,cAAc;EAClD,aAAa;CACf;AACF;;;AC1HA,MAAM,uBAAuB;CAC3B;CACA;CACA;CACA;CACA;AACF;AAEA,SAAgB,kBAAkB,QAAyB;CACzD,OAAO,qBAAqB,MAAM,YAAY,QAAQ,KAAK,MAAM,CAAC;AACpE;AAEA,SAAgB,6BAA6B,SAIlC;CACT,MAAM,QACJ,QAAQ,eAAe,KAAA,IAAY,gBAAgB,QAAQ,WAAW,eAAe,EAAE,KAAK;CAE9F,OACE,oBAAoB,QAAQ,iBAAiB,2EACH,QAAQ,eAAe,GAAG,MAAM;AAG9E;;;ACzBA,MAAM,eAAe;AACrB,MAAM,qBAAqB;AAc3B,eAAsB,wBAAiE;CACrF,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,UAAU,iBAAiB,WAAW,MAAM,GAAG,kBAAkB;CAEvE,IAAI;EACF,MAAM,WAAW,MAAM,MAAM,cAAc;GACzC,QAAQ,WAAW;GACnB,SAAS,EACP,QAAQ,mBACV;EACF,CAAC;EAED,IAAI,CAAC,SAAS,IACZ;EAGF,MAAM,UAAW,MAAM,SAAS,KAAK;EACrC,MAAM,UAAU,QAAQ,cAAc,QAAQ,KAAK;EACnD,IAAI,CAAC,SACH;EAGF,OAAO;GACL;GACA,aAAa,QAAQ,OAAO;EAC9B;CACF,QAAQ;EACN;CACF,UAAU;EACR,aAAa,OAAO;CACtB;AACF;;;AC5CA,SAAgB,mCAAuD;CACrE,MAAM,SAAS,UAAU,QAAQ;EAAC;EAAU;EAAO;CAAqB,GAAG,EACzE,UAAU,OACZ,CAAC;CAED,IAAI,OAAO,WAAW,GACpB;CAGF,MAAM,QAAQ,OAAO,OAAO,KAAK;CACjC,IAAI,CAAC,SAAS,UAAU,eAAe,UAAU,KAC/C;CAGF,MAAM,UAAU,OAAO,SAAS,OAAO,EAAE;CACzC,OAAO,OAAO,SAAS,OAAO,KAAK,UAAU,IAAI,UAAU,KAAA;AAC7D;AAEA,SAAgB,4BACd,aACA,0BACkB;CAClB,IAAI,CAAC,eAAe,CAAC,0BACnB;CAGF,MAAM,cAAc,KAAK,MAAM,WAAW;CAC1C,IAAI,CAAC,OAAO,SAAS,WAAW,GAC9B;CAGF,OAAO,IAAI,KAAK,cAAc,2BAA2B,GAAM;AACjE;;;;ACjCA,SAAgB,sBAAsB,aAAyC;CAG7E,OAFmB,YAAY,QAAQ,OAAO,GACvB,EAAE,MAAM,sBACpB,IAAI;AACjB;;;ACFA,MAAM,eAAe;AAErB,SAAgB,mBAAmB,SAIjC;CACA,MAAM,EAAE,MAAM,mBAAmB;CAEjC,IAAI,SAAS,UACX,QAAQ,gBAAR;EACE,KAAK,QACH,OAAO;GACL,SAAS;GACT,MAAM;IAAC;IAAO;IAAM;GAAY;GAChC,KAAK,sBAAsB,QAAQ,WAAW;EAChD;EACF,KAAK,QACH,OAAO;GAAE,SAAS;GAAQ,MAAM;IAAC;IAAU;IAAO;GAAY;EAAE;EAClE,KAAK,OACH,OAAO;GAAE,SAAS;GAAO,MAAM;IAAC;IAAO;IAAM;GAAY;EAAE;EAE7D,SACE,OAAO;GAAE,SAAS;GAAO,MAAM;IAAC;IAAW;IAAM;GAAY;EAAE;CACnE;CAGF,MAAM,MAAM,QAAQ;CACpB,QAAQ,gBAAR;EACE,KAAK,QACH,OAAO;GAAE,SAAS;GAAQ,MAAM;IAAC;IAAO;IAAM;GAAY;GAAG;EAAI;EACnE,KAAK,QACH,OAAO;GAAE,SAAS;GAAQ,MAAM;IAAC;IAAO;IAAM;GAAY;GAAG;EAAI;EACnE,KAAK,OACH,OAAO;GAAE,SAAS;GAAO,MAAM;IAAC;IAAO;IAAM;GAAY;GAAG;EAAI;EAElE,SACE,OAAO;GAAE,SAAS;GAAO,MAAM;IAAC;IAAW;IAAM;GAAY;GAAG;EAAI;CACxE;AACF;;;ACrCA,SAAgB,iBAAoC;CAClD,MAAM,MAAM,EAAE,GAAG,QAAQ,IAAI;CAC7B,MAAM,WAAW,IAAI;CAErB,IAAI,CAAC,UACH,OAAO;CAGT,MAAM,UAAU,QAAQ,aAAa,UAAU,SAAS;CACxD,MAAM,OAAO,IAAI,YAAY;CAC7B,MAAM,WAAW,KAAK,MAAM,QAAQ,aAAa,UAAU,MAAM,GAAG;CAEpE,MAAM,SAAS,CAAC,GADE,SAAS,OACH,QAAQ,EAAE,QAAQ,QAAQ,CAAC,SAAS,SAAS,GAAG,CAAC;CAEzE,IAAI,OAAO,SAAS,GAClB,IAAI,WAAW,CAAC,GAAG,QAAQ,IAAI,EAAE,OAAO,OAAO,EAAE,KAAK,QAAQ,aAAa,UAAU,MAAM,GAAG;CAGhG,OAAO;AACT;AAOA,SAAS,kBAAkB,SAAiB,MAAgB,KAAuC;CACjG,MAAM,SAAS,UAAU,SAAS,MAAM;EACtC;EACA,UAAU;EACV,KAAK,eAAe;CACtB,CAAC;CAED,MAAM,SAAS,GAAG,OAAO,UAAU,KAAK,OAAO,UAAU;CAEzD,OAAO;EACL,IAAI,OAAO,WAAW;EACtB;CACF;AACF;AAEA,SAAS,kBAAkB,KAAsB;CAU/C,OATe,UAAU,QAAQ,CAAC,SAAS,GAAG;EAC5C;EACA,UAAU;EACV,KAAK;GACH,GAAG,eAAe;GAClB,IAAI;EACN;CACF,CAEY,EAAE,WAAW;AAC3B;AAEA,SAAgB,wBAAwB,SAAkD;CACxF,MAAM,EAAE,SAAS,MAAM,QAAQ,mBAAmB,OAAO;CACzD,MAAM,eAAe,kBAAkB,SAAS,MAAM,GAAG;CAEzD,IAAI,aAAa,IACf,OAAO;CAGT,IAAI,QAAQ,SAAS,YAAY,QAAQ,mBAAmB,UAAU;MAChE,kBAAkB,GAAG,GACvB,OAAO,kBAAkB,SAAS,MAAM,GAAG;CAAA;CAI/C,OAAO;AACT;;;AC/DA,MAAM,aAAa;AACnB,MAAM,mBAAmB,OAAU,KAAK;AAExC,SAAS,UAAU,YAAY,gBAAgB,GAAW;CACxD,OAAO,KAAK,WAAW,UAAU;AACnC;AAEA,SAAgB,qBAAqB,WAAsC;CACzE,MAAM,OAAO,UAAU,SAAS;CAChC,IAAI,CAAC,WAAW,IAAI,GAClB,OAAO,CAAC;CAGV,IAAI;EACF,OAAO,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;CAC9C,QAAQ;EACN,OAAO,CAAC;CACV;AACF;AAEA,SAAgB,sBAAsB,OAAyB,WAA0B;CACvF,MAAM,MAAM,aAAa,gBAAgB;CACzC,UAAU,KAAK,EAAE,WAAW,KAAK,CAAC;CAClC,cAAc,UAAU,GAAG,GAAG,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,EAAE,KAAK,MAAM;AAC7E;AAEA,SAAgB,uBACd,OACA,gBACA,MAAM,KAAK,IAAI,GACN;CACT,IAAI,MAAM,mBAAmB,gBAC3B,OAAO;CAGT,IAAI,MAAM,cAAc;EACtB,MAAM,iBAAiB,KAAK,MAAM,MAAM,YAAY;EACpD,IAAI,OAAO,SAAS,cAAc,KAAK,iBAAiB,KACtD,OAAO;CAEX;CAEA,IAAI,MAAM,cAAc;EACtB,MAAM,eAAe,KAAK,MAAM,MAAM,YAAY;EAClD,IAAI,OAAO,SAAS,YAAY,KAAK,MAAM,eAAe,kBACxD,OAAO;CAEX;CAEA,OAAO;AACT;AAEA,SAAgB,sBAAsB,WAA0B;CAC9D,sBAAsB,CAAC,GAAG,SAAS;AACrC;AAEA,SAAgB,sBAAsB,SAI7B;CACP,sBACE;EACE,gBAAgB,QAAQ;EACxB,cAAc,QAAQ,YAAY,YAAY;CAChD,GACA,QAAQ,SACV;AACF;AAEA,SAAgB,2BAA2B,gBAAwB,WAA0B;CAC3F,sBACE;EACE;EACA,+BAAc,IAAI,KAAK,GAAE,YAAY;CACvC,GACA,SACF;AACF;;;ACpEA,SAAS,qBAAqB,MAAyB;CACrD,IACE,QAAQ,IAAI,iBACZ,QAAQ,IAAI,yBACZ,QAAQ,IAAI,oBAEZ,OAAO;CAGT,IAAI,QAAQ,IAAI,OAAO,UAAU,QAAQ,IAAI,OAAO,KAClD,OAAO;CAGT,MAAM,OAAO,KAAK,MAAM,CAAC;CACzB,IAAI,KAAK,WAAW,GAClB,OAAO;CAGT,OAAO,KAAK,OACT,QACC,QAAQ,QACR,QAAQ,eACR,QAAQ,QACR,QAAQ,YACR,IAAI,WAAW,IAAI,CACvB;AACF;AAEA,SAAS,UAAU,MAAuB;CACxC,MAAM,SAAS,UAAU,QAAQ,UAAU,KAAK,MAAM,CAAC,GAAG;EACxD,OAAO;EACP,KAAK;GACH,GAAG,QAAQ;GACX,oBAAoB;EACtB;CACF,CAAC;CAED,QAAQ,KAAK,OAAO,UAAU,CAAC;AACjC;AAEA,SAAS,qBACP,SACA,aACkB;CAClB,IAAI,QAAQ,mBAAmB,QAC7B;CAGF,OAAO,4BAA4B,aAAa,iCAAiC,CAAC;AACpF;AAEA,eAAsB,gBAAgB,MAA+B;CACnE,IAAI,qBAAqB,IAAI,GAC3B;CAGF,MAAM,UAAU,iBAAiB,eAAe,OAAO,KAAK,GAAG,CAAC;CAChE,IAAI,CAAC,WAAY,QAAQ,SAAS,WAAW,CAAC,QAAQ,aACpD;CAGF,MAAM,iBAAiB,eAAe;CACtC,MAAM,UAAU,MAAM,sBAAsB;CAE5C,IAAI,CAAC,WAAW,CAAC,eAAe,QAAQ,SAAS,cAAc,GAAG;EAChE,sBAAsB;EACtB;CACF;CAGA,IAAI,uBADU,qBACiB,GAAG,QAAQ,OAAO,GAC/C;CAGF,QAAQ,OAAO,MACb,6BAA6B,eAAe,MAAM,QAAQ,QAAQ,OAAO,QAAQ,eAAe,MAClG;CAEA,MAAM,SAAS,wBAAwB,OAAO;CAC9C,MAAM,mBAAmB,eAAe;CAExC,IAAI,eAAe,kBAAkB,cAAc,GAAG;EACpD,sBAAsB;EACtB,QAAQ,OAAO,MAAM,4BAA4B,eAAe,MAAM,iBAAiB,IAAI;EAC3F,UAAU,IAAI;CAChB;CAEA,IAAI,OAAO,IAAI;EACb,sBAAsB;EACtB;CACF;CAEA,IAAI,kBAAkB,OAAO,MAAM,GAAG;EACpC,MAAM,aAAa,qBAAqB,SAAS,QAAQ,WAAW;EACpE,sBAAsB;GACpB,gBAAgB,QAAQ;GACxB;EACF,CAAC;EACD,QAAQ,OAAO,MACb,GAAG,6BAA6B;GAC9B;GACA,kBAAkB,QAAQ;GAC1B;EACF,CAAC,EAAE,GACL;EACA;CACF;CAEA,2BAA2B,QAAQ,OAAO;CAC1C,QAAQ,OAAO,MAAM,4DAA4D;AACnF"}

package/dist/pack-artifact-DVnIKrsg-BtNTTQcz.mjs

@@ -0,0 +1,112 @@
+#!/usr/bin/env node
+import { Bt as ROUTE_MANIFEST_REL_PATH, In as parseStoredRouteManifest } from "./dist-YV-kApfg.mjs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+//#region ../../packages/storage/dist/pack-artifact-DVnIKrsg.mjs
+/**
+* Pack a directory tree that contains a `dist/` folder into a gzip tarball
+* suitable for project-server extraction.
+*/
+function packDistTree(rootContainingDist) {
+	const tempDir = mkdtempSync(join(tmpdir(), "keystroke-artifact-pack-"));
+	const archivePath = join(tempDir, "artifact.tgz");
+	try {
+		const result = spawnSync("tar", [
+			"-czf",
+			archivePath,
+			"--exclude=._*",
+			"--exclude=.DS_Store",
+			"-C",
+			rootContainingDist,
+			"dist"
+		], {
+			encoding: "utf8",
+			env: {
+				...process.env,
+				COPYFILE_DISABLE: "1"
+			}
+		});
+		if (result.status !== 0) throw new Error(result.stderr?.trim() || "Failed to pack project artifact");
+		return readFileSync(archivePath);
+	} finally {
+		rmSync(tempDir, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+/** Extract a packed project artifact tarball into `destDir` (creates `destDir/dist/`). */
+function extractProjectArtifact(archive, destDir) {
+	const tempDir = mkdtempSync(join(tmpdir(), "keystroke-artifact-extract-"));
+	const archivePath = join(tempDir, "artifact.tgz");
+	try {
+		writeFileSync(archivePath, archive);
+		const result = spawnSync("tar", [
+			"-xzf",
+			archivePath,
+			"-C",
+			destDir
+		], {
+			encoding: "utf8",
+			env: {
+				...process.env,
+				COPYFILE_DISABLE: "1"
+			}
+		});
+		if (result.status !== 0) throw new Error(result.stderr?.trim() || "Failed to extract project artifact");
+	} finally {
+		rmSync(tempDir, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+function moduleFileOf(entry) {
+	return "moduleFile" in entry && typeof entry.moduleFile === "string" ? entry.moduleFile : void 0;
+}
+/** Replace manifest rows for rebuilt modules while keeping untouched routes and metadata. */
+function mergeStoredRouteManifest(base, rebuiltEntries) {
+	const rebuiltModuleFiles = new Set(rebuiltEntries.map(moduleFileOf).filter((value) => Boolean(value)));
+	const keptEntries = base.entries.filter((entry) => {
+		const moduleFile = moduleFileOf(entry);
+		if (!moduleFile) return true;
+		return !rebuiltModuleFiles.has(moduleFile);
+	});
+	const filteredRebuilt = rebuiltEntries.filter((entry) => entry.kind !== "health");
+	return {
+		...base,
+		entries: [...keptEntries, ...filteredRebuilt]
+	};
+}
+async function mergeFilteredArtifact(input) {
+	const mergeRoot = mkdtempSync(join(tmpdir(), "keystroke-artifact-merge-"));
+	try {
+		extractProjectArtifact(input.baseArchive, mergeRoot);
+		const manifestPath = join(mergeRoot, ROUTE_MANIFEST_REL_PATH);
+		const mergedManifest = mergeStoredRouteManifest(parseStoredRouteManifest(JSON.parse(readFileSync(manifestPath, "utf8"))), input.filtered.manifestEntries);
+		writeFileSync(manifestPath, `${JSON.stringify(mergedManifest, null, 2)}\n`);
+		for (const file of input.filtered.files) {
+			const destination = join(mergeRoot, "dist", file.relativePath);
+			mkdirSync(dirname(destination), { recursive: true });
+			writeFileSync(destination, file.contents);
+			if (file.sourceMap) writeFileSync(`${destination}.map`, file.sourceMap);
+		}
+		return packDistTree(mergeRoot);
+	} finally {
+		rmSync(mergeRoot, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+/** Pack `dist/` into a gzip tarball suitable for `/app` extraction in the project server image. */
+function packProjectArtifact(projectRoot) {
+	if (!existsSync(join(projectRoot, "dist"))) throw new Error("dist/ not found — run keystroke build first");
+	return packDistTree(projectRoot);
+}
+//#endregion
+export { packProjectArtifact as n, mergeFilteredArtifact as t };
+
+//# sourceMappingURL=pack-artifact-DVnIKrsg-BtNTTQcz.mjs.map

package/dist/pack-artifact-DVnIKrsg-BtNTTQcz.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"pack-artifact-DVnIKrsg-BtNTTQcz.mjs","names":[],"sources":["../../../packages/storage/dist/pack-artifact-DVnIKrsg.mjs"],"sourcesContent":["import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { spawnSync } from \"node:child_process\";\nimport { tmpdir } from \"node:os\";\nimport { ROUTE_MANIFEST_REL_PATH, parseStoredRouteManifest } from \"@keystrokehq/shared\";\n//#region src/pack-dir.ts\n/**\n* Pack a directory tree that contains a `dist/` folder into a gzip tarball\n* suitable for project-server extraction.\n*/\nfunction packDistTree(rootContainingDist) {\n\tconst tempDir = mkdtempSync(join(tmpdir(), \"keystroke-artifact-pack-\"));\n\tconst archivePath = join(tempDir, \"artifact.tgz\");\n\ttry {\n\t\tconst result = spawnSync(\"tar\", [\n\t\t\t\"-czf\",\n\t\t\tarchivePath,\n\t\t\t\"--exclude=._*\",\n\t\t\t\"--exclude=.DS_Store\",\n\t\t\t\"-C\",\n\t\t\trootContainingDist,\n\t\t\t\"dist\"\n\t\t], {\n\t\t\tencoding: \"utf8\",\n\t\t\tenv: {\n\t\t\t\t...process.env,\n\t\t\t\tCOPYFILE_DISABLE: \"1\"\n\t\t\t}\n\t\t});\n\t\tif (result.status !== 0) throw new Error(result.stderr?.trim() || \"Failed to pack project artifact\");\n\t\treturn readFileSync(archivePath);\n\t} finally {\n\t\trmSync(tempDir, {\n\t\t\trecursive: true,\n\t\t\tforce: true\n\t\t});\n\t}\n}\n//#endregion\n//#region src/extract-artifact.ts\n/** Extract a packed project artifact tarball into `destDir` (creates `destDir/dist/`). */\nfunction extractProjectArtifact(archive, destDir) {\n\tconst tempDir = mkdtempSync(join(tmpdir(), \"keystroke-artifact-extract-\"));\n\tconst archivePath = join(tempDir, \"artifact.tgz\");\n\ttry {\n\t\twriteFileSync(archivePath, archive);\n\t\tconst result = spawnSync(\"tar\", [\n\t\t\t\"-xzf\",\n\t\t\tarchivePath,\n\t\t\t\"-C\",\n\t\t\tdestDir\n\t\t], {\n\t\t\tencoding: \"utf8\",\n\t\t\tenv: {\n\t\t\t\t...process.env,\n\t\t\t\tCOPYFILE_DISABLE: \"1\"\n\t\t\t}\n\t\t});\n\t\tif (result.status !== 0) throw new Error(result.stderr?.trim() || \"Failed to extract project artifact\");\n\t} finally {\n\t\trmSync(tempDir, {\n\t\t\trecursive: true,\n\t\t\tforce: true\n\t\t});\n\t}\n}\n//#endregion\n//#region src/merge-route-manifest.ts\nfunction moduleFileOf(entry) {\n\treturn \"moduleFile\" in entry && typeof entry.moduleFile === \"string\" ? entry.moduleFile : void 0;\n}\n/** Replace manifest rows for rebuilt modules while keeping untouched routes and metadata. */\nfunction mergeStoredRouteManifest(base, rebuiltEntries) {\n\tconst rebuiltModuleFiles = new Set(rebuiltEntries.map(moduleFileOf).filter((value) => Boolean(value)));\n\tconst keptEntries = base.entries.filter((entry) => {\n\t\tconst moduleFile = moduleFileOf(entry);\n\t\tif (!moduleFile) return true;\n\t\treturn !rebuiltModuleFiles.has(moduleFile);\n\t});\n\tconst filteredRebuilt = rebuiltEntries.filter((entry) => entry.kind !== \"health\");\n\treturn {\n\t\t...base,\n\t\tentries: [...keptEntries, ...filteredRebuilt]\n\t};\n}\n//#endregion\n//#region src/merge-filtered-artifact.ts\nasync function mergeFilteredArtifact(input) {\n\tconst mergeRoot = mkdtempSync(join(tmpdir(), \"keystroke-artifact-merge-\"));\n\ttry {\n\t\textractProjectArtifact(input.baseArchive, mergeRoot);\n\t\tconst manifestPath = join(mergeRoot, ROUTE_MANIFEST_REL_PATH);\n\t\tconst mergedManifest = mergeStoredRouteManifest(parseStoredRouteManifest(JSON.parse(readFileSync(manifestPath, \"utf8\"))), input.filtered.manifestEntries);\n\t\twriteFileSync(manifestPath, `${JSON.stringify(mergedManifest, null, 2)}\\n`);\n\t\tfor (const file of input.filtered.files) {\n\t\t\tconst destination = join(mergeRoot, \"dist\", file.relativePath);\n\t\t\tmkdirSync(dirname(destination), { recursive: true });\n\t\t\twriteFileSync(destination, file.contents);\n\t\t\tif (file.sourceMap) writeFileSync(`${destination}.map`, file.sourceMap);\n\t\t}\n\t\treturn packDistTree(mergeRoot);\n\t} finally {\n\t\trmSync(mergeRoot, {\n\t\t\trecursive: true,\n\t\t\tforce: true\n\t\t});\n\t}\n}\n//#endregion\n//#region src/pack-artifact.ts\n/** Pack `dist/` into a gzip tarball suitable for `/app` extraction in the project server image. */\nfunction packProjectArtifact(projectRoot) {\n\tif (!existsSync(join(projectRoot, \"dist\"))) throw new Error(\"dist/ not found — run keystroke build first\");\n\treturn packDistTree(projectRoot);\n}\n//#endregion\nexport { packDistTree as a, extractProjectArtifact as i, mergeFilteredArtifact as n, mergeStoredRouteManifest as r, packProjectArtifact as t };\n\n//# sourceMappingURL=pack-artifact-DVnIKrsg.mjs.map"],"mappings":";;;;;;;;;;;AAUA,SAAS,aAAa,oBAAoB;CACzC,MAAM,UAAU,YAAY,KAAK,OAAO,GAAG,0BAA0B,CAAC;CACtE,MAAM,cAAc,KAAK,SAAS,cAAc;CAChD,IAAI;EACH,MAAM,SAAS,UAAU,OAAO;GAC/B;GACA;GACA;GACA;GACA;GACA;GACA;EACD,GAAG;GACF,UAAU;GACV,KAAK;IACJ,GAAG,QAAQ;IACX,kBAAkB;GACnB;EACD,CAAC;EACD,IAAI,OAAO,WAAW,GAAG,MAAM,IAAI,MAAM,OAAO,QAAQ,KAAK,KAAK,iCAAiC;EACnG,OAAO,aAAa,WAAW;CAChC,UAAU;EACT,OAAO,SAAS;GACf,WAAW;GACX,OAAO;EACR,CAAC;CACF;AACD;;AAIA,SAAS,uBAAuB,SAAS,SAAS;CACjD,MAAM,UAAU,YAAY,KAAK,OAAO,GAAG,6BAA6B,CAAC;CACzE,MAAM,cAAc,KAAK,SAAS,cAAc;CAChD,IAAI;EACH,cAAc,aAAa,OAAO;EAClC,MAAM,SAAS,UAAU,OAAO;GAC/B;GACA;GACA;GACA;EACD,GAAG;GACF,UAAU;GACV,KAAK;IACJ,GAAG,QAAQ;IACX,kBAAkB;GACnB;EACD,CAAC;EACD,IAAI,OAAO,WAAW,GAAG,MAAM,IAAI,MAAM,OAAO,QAAQ,KAAK,KAAK,oCAAoC;CACvG,UAAU;EACT,OAAO,SAAS;GACf,WAAW;GACX,OAAO;EACR,CAAC;CACF;AACD;AAGA,SAAS,aAAa,OAAO;CAC5B,OAAO,gBAAgB,SAAS,OAAO,MAAM,eAAe,WAAW,MAAM,aAAa,KAAK;AAChG;;AAEA,SAAS,yBAAyB,MAAM,gBAAgB;CACvD,MAAM,qBAAqB,IAAI,IAAI,eAAe,IAAI,YAAY,EAAE,QAAQ,UAAU,QAAQ,KAAK,CAAC,CAAC;CACrG,MAAM,cAAc,KAAK,QAAQ,QAAQ,UAAU;EAClD,MAAM,aAAa,aAAa,KAAK;EACrC,IAAI,CAAC,YAAY,OAAO;EACxB,OAAO,CAAC,mBAAmB,IAAI,UAAU;CAC1C,CAAC;CACD,MAAM,kBAAkB,eAAe,QAAQ,UAAU,MAAM,SAAS,QAAQ;CAChF,OAAO;EACN,GAAG;EACH,SAAS,CAAC,GAAG,aAAa,GAAG,eAAe;CAC7C;AACD;AAGA,eAAe,sBAAsB,OAAO;CAC3C,MAAM,YAAY,YAAY,KAAK,OAAO,GAAG,2BAA2B,CAAC;CACzE,IAAI;EACH,uBAAuB,MAAM,aAAa,SAAS;EACnD,MAAM,eAAe,KAAK,WAAW,uBAAuB;EAC5D,MAAM,iBAAiB,yBAAyB,yBAAyB,KAAK,MAAM,aAAa,cAAc,MAAM,CAAC,CAAC,GAAG,MAAM,SAAS,eAAe;EACxJ,cAAc,cAAc,GAAG,KAAK,UAAU,gBAAgB,MAAM,CAAC,EAAE,GAAG;EAC1E,KAAK,MAAM,QAAQ,MAAM,SAAS,OAAO;GACxC,MAAM,cAAc,KAAK,WAAW,QAAQ,KAAK,YAAY;GAC7D,UAAU,QAAQ,WAAW,GAAG,EAAE,WAAW,KAAK,CAAC;GACnD,cAAc,aAAa,KAAK,QAAQ;GACxC,IAAI,KAAK,WAAW,cAAc,GAAG,YAAY,OAAO,KAAK,SAAS;EACvE;EACA,OAAO,aAAa,SAAS;CAC9B,UAAU;EACT,OAAO,WAAW;GACjB,WAAW;GACX,OAAO;EACR,CAAC;CACF;AACD;;AAIA,SAAS,oBAAoB,aAAa;CACzC,IAAI,CAAC,WAAW,KAAK,aAAa,MAAM,CAAC,GAAG,MAAM,IAAI,MAAM,6CAA6C;CACzG,OAAO,aAAa,WAAW;AAChC"}

package/dist/skills-bundle/_AGENTS.md

@@ -12,7 +12,7 @@ The CLI routes runtime commands to one of two API targets:
 
 | Target                                        | Use for                                                                                            |
 | --------------------------------------------- | -------------------------------------------------------------------------------------------------- |
-| **Local** (`serverUrl`, default `:3001`)      | **Development and testing** — iterate on `src/`, run workflows/agents on your machine              |
+| **Local** (default `:3002`)      | **Development and testing** — iterate on `src/`, run workflows/agents on your machine              |
 | **Cloud** (`platformUrl` + `activeProjectId`) | **Invoking and listing deployed resources** — production runs, triggers, remote audit after deploy |
 
 ```bash
@@ -37,7 +37,7 @@ Full routing rules: [cli skill](.agents/skills/keystroke-cli/SKILL.md) → [api-
 
 ```bash
 # .env is created from .env.example on init — set ANTHROPIC_API_KEY + integration keys
-keystroke start               # API :3001, dashboard :3000
+keystroke start               # API :3002, dashboard :3000
 keystroke health
 keystroke agent prompt hello --message "Hi"
 ```
@@ -60,8 +60,8 @@ Required for cloud/platform commands and some trigger operations. Not required f
 | Agents         | `src/agents/`                          | `@keystrokehq/keystroke/agent`                                              |
 | Workflows      | `src/workflows/`                       | `@keystrokehq/keystroke/workflow`                                           |
 | Triggers       | `src/triggers/`                        | `@keystrokehq/keystroke/trigger`                                            |
-| Integrations   | action/tool imports                    | `@keystrokehq/googlesuper`, `@keystrokehq/slack`, … |
-| Credentials    | vault + OAuth                          | `keystroke credentials`, `keystroke connect`                                |
+| Apps           | `src/apps/`                            | `@keystrokehq/keystroke/app`, `keystroke app`, `keystroke connect`          |
+| Integrations   | npm packages + catalog                 | `@keystrokehq/exa`, `@keystrokehq/slack`, … — discover with `keystroke app search` |
 | Skills / files | `src/skills/`, `src/files/`            | attached on `defineAgent`                                                   |
 
 Default-export each module — the server discovers files under `src/`.
@@ -77,7 +77,7 @@ A few things that are easy to skip and cause common failures:
 - **Research real APIs before mirroring them** — web search and fetch the actual reference & explore relevant docs; don't guess endpoints or payload shapes.
 - **Run before you depend or deploy** — run the workflow/agent locally and read the real output (`keystroke workflow runs get <key> <run-id> --include steps,trace`) before wiring dependent steps.
 - **Cover obvious edge cases** and write simple tests as needed (null field, empty array, a step that throws) — see [workflows skill](.agents/skills/keystroke-workflows/SKILL.md).
-- **Cloud creds aren't in `.env`** — `keystroke deploy` never uploads `.env`; credentials that run in the cloud must be set against the cloud target. See [credentials skill](.agents/skills/keystroke-credentials/SKILL.md).
+- **Connected apps aren't in `.env`** — `keystroke deploy` never uploads `.env`; connect apps on the cloud target with `keystroke connect <slug>`. See [apps skill](.agents/skills/keystroke-apps/SKILL.md).
 - **Shipping to prod** — full vs filtered deploy, WIP ignore directives: [deploy skill](.agents/skills/keystroke-deploy/SKILL.md).
 
 ## Audit & debug (CLI)
@@ -92,7 +92,7 @@ keystroke agent sessions get <agent-key> <session-id> --include messages,trace
 keystroke workflow run <workflow-key> --input '{}'
 keystroke workflow runs list <workflow-key>
 keystroke workflow runs get <workflow-key> <run-id> --include steps,trace
-keystroke credentials list
+keystroke app list
 ```
 
 **Cloud** (deployed — `keystroke config use cloud` or after deploy):
@@ -118,4 +118,4 @@ Read `src/` first — existing agents, workflows, actions, and triggers are your
 | [gateways](.agents/skills/keystroke-gateways/SKILL.md)       | Slack / messaging bindings         |
 | [skills](.agents/skills/keystroke-skills/SKILL.md)           | `src/skills/` playbooks            |
 | [files](.agents/skills/keystroke-files/SKILL.md)             | Agent workspace files              |
-| [credentials](.agents/skills/keystroke-credentials/SKILL.md) | Vault, OAuth, connect              |
+| [apps](.agents/skills/keystroke-apps/SKILL.md)               | Connectable apps, catalog, connect |

package/dist/skills-bundle/skills/keystroke-actions/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: keystroke-actions
-description: Define keystroke actions with defineAction — workflow steps and agent tools, Zod IO, integration imports from Exa/Google/Slack. Use when authoring src/actions/ or browsing keystroke integrations.
+description: Define keystroke actions — workflow steps and agent tools. App-backed actions flow through synced apps (app.action); catalog integrations import from npm packages. Use when authoring src/actions/ or wiring integrations.
 metadata:
   keystroke-domain: actions
 ---
@@ -9,6 +9,8 @@ metadata:
 
 One **executable unit** used everywhere: workflow steps, agent tools, and codemode host calls.
 
+Anything that calls an external API **flows through an app** — sync the app into `src/apps/` first, connect it, then author with `app.action()`. See [apps skill](.agents/skills/keystroke-apps/SKILL.md).
+
 ## Actions are leaf units — never call an action from an action
 
 An action's `run` must **not** call another action (yours or an integration action like `postMessage`). Composition belongs in a **workflow**; an integration action is used directly as a workflow step or agent tool — not wrapped in a custom action.
@@ -28,7 +30,32 @@ async run(input) {
 
 This is enforced at runtime (calling an action inside an action throws) and by lint (`no-restricted-imports` blocks importing `@keystrokehq/*/actions` inside `src/actions/`). An action **may** call an agent — see below.
 
-## Your own action
+## App-backed actions (custom integrations)
+
+1. **App first** — create in the dashboard or `keystroke app create`, then `keystroke app sync <slug>` → `src/apps/<name>/app.ts`
+2. **Connect** — `keystroke connect <slug>` (see [apps skill](.agents/skills/keystroke-apps/SKILL.md))
+3. **Action** — `app.action()` in `src/actions/`, reading `credentials[app.slug]` in `run`
+
+```ts
+import { z } from "zod";
+import { kwatch } from "../apps/kwatch/app";
+
+export const kwatchListAlerts = kwatch.action({
+  slug: "kwatch-list-alerts",
+  input: z.object({}),
+  output: z.object({ ok: z.boolean(), alertCount: z.number() }),
+  async run(_input, credentials) {
+    const { apiKey } = credentials["keystroke/kwatch"];
+    return { ok: true, alertCount: 0 };
+  },
+});
+```
+
+Do not use bare `defineAction` for external API work — the app owns the connection.
+
+## Pure actions (no app)
+
+Use `defineAction` directly only when the step needs no app connection (pure logic, local transforms):
 
 ```ts
 import { defineAction } from "@keystrokehq/action";
@@ -44,11 +71,16 @@ export const triage = defineAction({
 });
 ```
 
-Declare `credentials: [slackCredential] as const` on the action when it needs vault/OAuth resolution at runtime.
+## Catalog integration actions
+
+Official integrations ship as npm packages with pre-built actions. Discover with `keystroke app search`, connect with `keystroke connect <slug>`, then import in workflows or agent tools — not in `src/actions/`:
 
-## Integration actions
+```ts
+import { exaSearch } from "@keystrokehq/exa/actions";
+import { postMessage } from "@keystrokehq/slack/actions";
+```
 
-Published actions (`@keystrokehq/exa/actions`, `@keystrokehq/slack/actions`, etc.) are used as **workflow steps** or **agent tools** — not imported into `src/actions/`. Set integration env vars in `.env` and run `keystroke connect` for OAuth when needed.
+Detail: [catalog-and-imports.md](references/catalog-and-imports.md).
 
 ## Call an agent from an action (allowed)
 
@@ -75,6 +107,6 @@ export const researchSignup = defineAction({
 
 ## Next references
 
-- [catalog-and-imports.md](references/catalog-and-imports.md) — plugins, credentials on actions
+- [catalog-and-imports.md](references/catalog-and-imports.md) — catalog discovery, npm imports
 
-Related: [workflows](.agents/skills/keystroke-workflows/SKILL.md), [agents](.agents/skills/keystroke-agents/SKILL.md), [credentials](.agents/skills/keystroke-credentials/SKILL.md).
+Related: [apps](.agents/skills/keystroke-apps/SKILL.md), [workflows](.agents/skills/keystroke-workflows/SKILL.md), [agents](.agents/skills/keystroke-agents/SKILL.md).

package/dist/skills-bundle/skills/keystroke-actions/references/catalog-and-imports.md

@@ -1,14 +1,11 @@
 # Integration actions
 
-## Install & configure
+## Official catalog integrations
 
-1. Add npm package (e.g. `@keystrokehq/exa`, `@keystrokehq/googlesuper`, `@keystrokehq/slack`)
-2. Set env vars in `.env`
-3. OAuth if needed: `keystroke connect google`
-
-## Use integration actions
-
-Import in `src/workflows/` or on `defineAgent` `tools` — not in `src/actions/`:
+1. Discover: `keystroke app search <query>` → `app show <slug>` → `app actions <slug>`
+2. Connect: `keystroke connect <slug>`
+3. Add npm package (e.g. `@keystrokehq/exa`, `@keystrokehq/googlesuper`, `@keystrokehq/slack`)
+4. Import in `src/workflows/` or on `defineAgent` `tools` — not in `src/actions/`:
 
 ```ts
 import { exaSearch, exaAnswer } from "@keystrokehq/exa/actions";
@@ -16,21 +13,30 @@ import { postMessage } from "@keystrokehq/slack/actions";
 import { googlesuperSendEmail } from "@keystrokehq/googlesuper/actions";
 ```
 
-## Credentials on custom actions
+Catalog packages ship a pre-built app + actions — you do not author `src/apps/` for these.
+
+## Custom integrations (app-first)
+
+All custom API work flows through a synced app:
 
-When wrapping an API yourself:
+1. Create the app (dashboard or `keystroke app create --name ... --field ...`)
+2. Sync: `keystroke app sync <slug>` → `src/apps/<name>/app.ts`
+3. Connect: `keystroke connect <slug>`
+4. Author actions in `src/actions/` with `app.action()`:
 
 ```ts
-import { defineAction } from "@keystrokehq/action";
-import { slackCredential } from "@keystrokehq/slack";
-
-defineAction({
-  slug: "my-notify",
-  credentials: [slackCredential] as const,
-  run: async (input, credentials) => {
-    /* … */
+import { z } from "zod";
+import { internalApi } from "../apps/internal-api/app";
+
+export const fetchStatus = internalApi.action({
+  slug: "fetch-status",
+  input: z.object({}),
+  output: z.object({ ok: z.boolean() }),
+  async run(_input, credentials) {
+    const { apiKey } = credentials["acme/internal-api"];
+    return { ok: true };
   },
 });
 ```
 
-Integration-packaged actions usually handle this for you.
+Re-run `keystroke app sync <slug>` after template changes on the platform. Full app lifecycle: [apps skill](../../keystroke-apps/SKILL.md).

package/dist/skills-bundle/skills/keystroke-agents/SKILL.md

@@ -28,11 +28,13 @@ export default defineAgent({
 **Skills + files** — static playbooks and docs in the workspace:
 
 ```ts
+import { defineSandbox } from "@keystrokehq/sandbox";
+
 defineAgent({
   slug: "support",
-  systemPrompt: "Read /workspace/product-guide.md before answering.",
+  systemPrompt: "Read /workspace/agent/product-guide.md before answering.",
   skills: ["support"],
-  files: true,
+  sandbox: defineSandbox({ files: true }),
 });
 ```
 
@@ -58,8 +60,8 @@ Follow up in the same session: `--session-id <id>`.
 
 ## Workspace
 
-- Skills → `.agents/skills/{key}/`
-- Files from `src/files/{key}/` → `/workspace/`
+- Skills → `/workspace/agent/skills/{key}/`
+- Files from `src/files/{key}/` → `/workspace/agent/`
 - Pass `module: import.meta.url` so skills/files resolve in dev without a rebuild
 
 ## Next references
@@ -68,4 +70,4 @@ Follow up in the same session: `--session-id <id>`.
 - [tools-mcp-codemode.md](references/tools-mcp-codemode.md) — actions as tools, MCP, codemode
 - [workflows-and-testing.md](references/workflows-and-testing.md) — sessions, workflow handoff
 
-Related: [actions](.agents/skills/keystroke-actions/SKILL.md), [workflows](.agents/skills/keystroke-workflows/SKILL.md), [files](.agents/skills/keystroke-files/SKILL.md), [credentials](.agents/skills/keystroke-credentials/SKILL.md).
+Related: [actions](.agents/skills/keystroke-actions/SKILL.md), [workflows](.agents/skills/keystroke-workflows/SKILL.md), [files](.agents/skills/keystroke-files/SKILL.md), [apps](.agents/skills/keystroke-apps/SKILL.md).

package/dist/skills-bundle/skills/keystroke-apps/SKILL.md

@@ -0,0 +1,133 @@
+---
+name: keystroke-apps
+description: Connectable apps — defineApp, app.action, catalog discovery via keystroke app search, custom app create/sync, and connect. Use when wiring integrations, OAuth, API keys, or a deployed run fails because an app is not connected.
+metadata:
+  keystroke-domain: apps
+---
+
+# Apps
+
+An **app** is a connectable integration: a slug, an auth kind, and (for custom apps) a field template. **Connected** = secrets for that app have been uploaded via the connect flow.
+
+Secrets never live in source or `.env`. Each **target** (local server vs cloud project) has its own connections — `keystroke deploy` uploads code only, not connections. Connect apps on **every target** you run on.
+
+Custom actions that call external APIs **must** go through an app — sync it into `src/apps/` first, then use `app.action()` in `src/actions/`. See [actions skill](.agents/skills/keystroke-actions/SKILL.md).
+
+## Two sources of apps
+
+| Source | How you get it | Author in code |
+| ------ | -------------- | -------------- |
+| **Catalog** | ~1000 Composio integrations + first-party (`exa`, `slack`, `googlesuper`) | npm package `@keystrokehq/<slug>` — discover via CLI |
+| **Custom** | Dashboard UI or `keystroke app create`, then `keystroke app sync <slug>` | `src/apps/<name>/app.ts` from sync |
+
+## Discover catalog integrations
+
+```bash
+keystroke auth login
+keystroke app search github              # live Composio catalog
+keystroke app show github
+keystroke app actions github --search issue
+keystroke app action GITHUB_CREATE_ISSUE
+keystroke app list                       # apps registered in your org
+```
+
+Discovery is read-only — there is no `app install` yet. To connect an app, its slug must be in your org registry (`app list`).
+
+## Create and sync custom apps
+
+Create in the dashboard or CLI, then pull the template into your project:
+
+```bash
+keystroke app create \
+  --name "Internal API" \
+  --description "Our internal service" \
+  --field apiKey:secret
+
+keystroke app sync acme/internal-api     # writes src/apps/internal-api/app.ts
+```
+
+Re-run `sync` after template changes on the platform. Then author actions with `app.action()` in `src/actions/`.
+
+## Author with defineApp
+
+Synced apps land as `defineApp` in `src/apps/<name>/app.ts`:
+
+```ts
+import { defineApp } from "@keystrokehq/keystroke/app";
+import { z } from "zod";
+
+export const kwatch = defineApp({
+  slug: "keystroke/kwatch",
+  auth: "api_key",
+  credential: { apiKey: z.string() },
+});
+```
+
+Actions use `app.action()` — the app binding is automatic:
+
+```ts
+import { kwatch } from "../apps/kwatch/app";
+
+export const kwatchListAlerts = kwatch.action({
+  slug: "kwatch-list-alerts",
+  input: z.object({}),
+  output: z.object({ ok: z.boolean(), alertCount: z.number() }),
+  async run(_input, credentials) {
+    const { apiKey } = credentials["keystroke/kwatch"];
+    return { ok: true, alertCount: 0 };
+  },
+});
+```
+
+Auth kinds: `keystroke` (MCP/Composio catalog apps), `api_key` (custom fields), `oauth` (token resolved at runtime). In `run`, read connected fields as `credentials[app.slug]`.
+
+## Connect an app
+
+`keystroke connect <slug>` opens the dashboard connect flow (OAuth or API-key form, depending on the app). This is how secrets get attached to an app — not via `.env`.
+
+**Official integrations** — the cleanest path:
+
+```bash
+keystroke connect google
+keystroke connect slack
+keystroke connect exa
+```
+
+**Custom apps** — sync the template first, then connect:
+
+```bash
+keystroke app sync acme/internal-api
+keystroke connect acme/internal-api
+```
+
+Run `connect` against **each target** you deploy to (local while developing; cloud after `keystroke config use cloud`). The dashboard **Apps** page offers the same flow.
+
+Field names in the connect form match the app's synced template. Default scope is **project** — see [cli-and-catalog.md](references/cli-and-catalog.md).
+
+## Before deploy: connect on cloud
+
+Cloud starts with **no connected apps**. After the first deploy:
+
+```bash
+keystroke deploy --project <id>
+keystroke config use cloud
+keystroke connect google
+keystroke connect exa
+keystroke app list
+```
+
+A runtime error about a missing connection almost always means the app was connected locally but not on the cloud target.
+
+## Audit
+
+```bash
+keystroke app list    # org-registered apps
+```
+
+Failed integration call → confirm target (`keystroke config show`), the app is connected on that target, and the action uses the right slug.
+
+## Next references
+
+- [cli-and-catalog.md](references/cli-and-catalog.md) — `keystroke app` commands, connect, scopes, local vs cloud
+
+Related: [cli](.agents/skills/keystroke-cli/SKILL.md), [actions](.agents/skills/keystroke-actions/SKILL.md), [gateways](.agents/skills/keystroke-gateways/SKILL.md).