@keystrokehq/cli 0.1.70 → 0.1.71

package/dist/index.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { $ as CredentialConsumerListResponseSchema, $n as WorkflowRunInputsSchema, $t as PresignUserAvatarRequestSchema, A as ConfirmCheckoutResponseSchema, An as UpdateCredentialInstanceBodySchema, At as ListOrganizationInvitationsResponseSchema, B as CreateCreditsCheckoutRequestSchema, Bn as UploadProjectSourceManifestRequestSchema, Bt as McpDiscoverResponseSchema, C as ChannelAccountListResponseSchema, Cn as SubmitTeamRequestRequestSchema, Cr as resolveDocsMcpUrl, D as ChannelPlatformSchema, Dn as TriggerRunListResponseSchema, Dt as ListAppsResponseSchema, E as ChannelDirectoryListResponseSchema, En as TriggerRunDetailResponseSchema, Et as ListApiKeysResponseSchema, F as CreateApiKeyResponseSchema, Fn as UpdateOrganizationRequestSchema, Ft as ListProjectMembersResponseSchema, G as CreateProjectArtifactResponseSchema, Gn as UserPreferencesPatchSchema, Gt as PROJECT_REACHABILITY_REQUEST_TIMEOUT_MS, H as CreateCustomAppResponseSchema, Hn as UpsertGatewayAttachmentBodySchema, Ht as OrganizationSidebarBrandingPatchSchema, I as CreateBillingPortalRequestSchema, In as UpdateProjectMemberRequestSchema, It as ListProjectMetricsResponseSchema, J as CreateSubscriptionCheckoutRequestSchema, Jn as WorkflowCanvasRunSchema, Jt as PresignChatAttachmentResponseSchema, K as CreateProjectRequestSchema, Kn as UserPreferencesSchema, Kt as PollRunResponseSchema, L as CreateCredentialInstanceBodySchema, Ln as UpdateProjectMemberResponseSchema, Lt as ListProjectsResponseSchema, M as ConnectManagedServiceCredentialRequestSchema, Mn as UpdateManagedServiceCredentialRequestSchema, Mt as ListOrganizationsResponseSchema, N as ConnectProvidersResponseSchema, Nn as UpdateOrganizationMemberRequestSchema, Nt as ListProjectDeploymentsResponseSchema, O as CompleteProjectArtifactResponseSchema, On as UpdateAutoTopupRequestSchema, Ot as ListCredentialsResponseSchema, P as CreateApiKeyRequestSchema, Pn as UpdateOrganizationMemberResponseSchema, Pt as ListProjectFilesResponseSchema, Q as CredentialConsumerListQuerySchema, Qn as WorkflowRunInputsPutBodySchema, Qt as PresignProjectSourceResponseSchema, R as CreateCredentialsRequestSchema, Rn as UpdateProjectRequestSchema, Rt as ManagedServiceCredentialSchema, S as CatalogAppsPageResponseSchema, Sn as SubmitMarketingContactRequestSchema, Sr as resolveConnectAppSlug, St as InviteProjectMembersResponseSchema, T as ChannelConnectionSchema, Tn as TriggerListResponseSchema, Tr as slugifyAppName, Tt as ListAgentWorkspaceFilesResponseSchema, U as CreateOrganizationRequestSchema, Un as UserAvatarPatchSchema, Ut as OrganizationSidebarBrandingSchema, V as CreateCustomAppRequestSchema, Vn as UploadProjectSourceResponseSchema, Vt as OpenApiDiscoverResponseSchema, W as CreateOrganizationResponseSchema, Wn as UserAvatarSchema, Wt as PROJECT_PULL_STATE_RELATIVE_PATH, X as CredentialAssignmentListResponseSchema, Xn as WorkflowRunDetailResponseSchema, Xt as PresignOrgLogoResponseSchema, Y as CredentialAssignmentListQuerySchema, Yn as WorkflowCanvasSchema, Yt as PresignOrgLogoRequestSchema, Z as CredentialAssignmentRecordSchema, Zn as WorkflowRunHooksResponseSchema, Zt as PresignProjectSourceRequestSchema, _ as BillingUsageResponseSchema, _n as StartKeystrokeConnectionResultSchema, _t as HistoryRunListQuerySchema, a as AgentSessionDetailResponseSchema, an as ProjectSlugAvailabilityResponseSchema, ar as WorkspaceTriggerFileSchema, at as DeclineOrganizationInvitationResponseSchema, b as CatalogActionsPageResponseSchema, bn as StartOAuthConnectionInputSchema, bt as InviteOrganizationMembersResponseSchema, c as AgentSummaryListResponseSchema, cr as WorkspaceTriggerRunListResponseSchema, ct as ErrorResponseSchema, d as AssignCredentialBodySchema, dt as GetCredentialResponseSchema, en as PresignUserAvatarResponseSchema, er as WorkflowRunListResponseSchema, et as CredentialInstanceListResponseSchema, f as AutoTopupSummarySchema, fn as RecentResourceListResponseSchema, fr as deriveCustomAppDisplay, ft as GetCustomAppResponseSchema, g as BillingSummaryResponseSchema, gn as StartKeystrokeConnectionInputSchema, gt as HistoryRunDetailResponseSchema, h as BillingRedirectResponseSchema, hn as SlugAvailabilityResponseSchema, hr as listenPortFromPublicUrl, ht as HistoryRunCancelResponseSchema, i as AgentSessionChatStateResponseSchema, in as ProjectSettingsResponseSchema, ir as WorkspaceTriggerDetailSchema, it as DOCS_SEARCH_TOOL, j as ConnectAuthorizeUrlResponseSchema, jn as UpdateCredentialRequestSchema, jt as ListOrganizationMembersResponseSchema, k as ConfirmCheckoutRequestSchema, kn as UpdateChannelBindingBodySchema, kt as ListManagedServiceCredentialsResponseSchema, l as AgentTriggerSummaryListResponseSchema, ln as QueuedAgentPromptResponseSchema, lr as WorkspaceWorkflowOverviewSchema, lt as ExecuteKeystrokeToolRequestSchema, m as BillingInvoiceUrlResponseSchema, mn as SkillSummaryListResponseSchema, mr as isAcceptableInstallExit, mt as HealthResponseSchema, n as AcceptOrganizationInvitationResponseSchema, nn as ProjectReachabilityResponseSchema, nr as WorkflowSummaryDetailResponseSchema, o as AgentSessionListResponseSchema, on as PromptInputSchema, or as WorkspaceTriggerListResponseSchema, ot as DownloadActiveProjectArtifactResponseSchema, p as BillingActivityResponseSchema, pn as SkillSummaryDetailResponseSchema, pr as detectProjectPackageManagerFromSnapshot, pt as GraphqlDiscoverResponseSchema, q as CreateProjectResponseSchema, qn as WorkflowCanvasCredentialBindingsSchema, qt as PresignChatAttachmentRequestSchema, r as ActiveOrganizationResponseSchema, rn as ProjectResponseSchema, rr as WorkflowSummaryListResponseSchema, rt as DOCS_QUERY_TOOL, s as AgentSummaryDetailResponseSchema, sn as PromptResponseSchema, sr as WorkspaceTriggerOverviewSchema, st as DownloadActiveProjectSourceResponseSchema, t as ACTIVE_ORG_HEADER, tn as ProjectPullStateSchema, tr as WorkflowRunResponseSchema, tt as CredentialInstanceRecordSchema, u as AppSlugAvailabilityResponseSchema, un as QueuedRunResponseSchema, ur as buildConnectDeeplink, ut as GatewayAttachmentRecordSchema, v as BindChannelBodySchema, vn as StartMcpOAuthConnectionInputSchema, vr as parseAppSlug, vt as HistoryRunListResponseSchema, w as ChannelConnectionListResponseSchema, wn as TriggerDetailResponseSchema, wr as resolvePublicPlatformOrigin, wt as ListAgentMemoryFilesResponseSchema, x as CatalogAppDetailResponseSchema, xn as StartOAuthConnectionResultSchema, xt as InviteProjectMembersRequestSchema, y as CatalogActionDetailResponseSchema, yn as StartMcpOAuthConnectionResultSchema, yr as parseErrorResponse, yt as InviteOrganizationMembersRequestSchema, z as CreateCredentialsResponseSchema, zn as UpdateProjectSettingsRequestSchema, zt as ManagedServiceKindSchema } from "./dist-Bzry3J_e.mjs";
 import { i as packProjectArtifact, n as withMcpReadClient, r as mergeFilteredArtifact, t as mapInParallelBatches } from "./dist-Dfp6ywxz.mjs";
-import { _ as getPlatformUrl, c as detectPackageManager, d as resolveGithubPackagesToken, f as resolvePackageManager, g as getEffectiveApiTarget, h as getConfigDir, i as isReleaseAgeBlock, l as installDependencies$1, m as getCliConfigDir, n as resolveCliRoot, o as detectManagerFromLockfile, p as createCliConfig, s as buildPlaygroundWorkspace, t as readCliVersion, u as installPlaygroundDependencies, v as getWebUrl, x as resolvePlatformUrlForWebUrl, y as DEFAULT_PLATFORM_URL } from "./version-D4niTLnU.mjs";
+import { _ as resolvePlatformUrlForWebUrl, a as installPlaygroundDependencies, c as isNewerVersion, d as getConfigDir, f as getEffectiveApiTarget, h as DEFAULT_PLATFORM_URL, i as installDependencies$1, l as createCliConfig, m as getWebUrl, n as buildPlaygroundWorkspace, o as resolvePackageManager, p as getPlatformUrl, s as resolveCliRoot, t as readCliVersion, u as getCliConfigDir } from "./version-DEkbd-OE.mjs";
 import { createRequire } from "node:module";
 import { Command } from "commander";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
@@ -1743,7 +1743,7 @@ function createJwtTokenCache(mint) {
 	};
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._44333ccf96bb3c43fae673bd9e25a436/node_modules/better-auth/dist/version.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._122a35b1d4615e80ac3ce156f3d09434/node_modules/better-auth/dist/version.mjs
 const PACKAGE_VERSION = "1.6.11";
 //#endregion
 //#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.4.3/node_modules/better-call/dist/error.mjs
@@ -1868,7 +1868,7 @@ var BetterAuthError = class extends Error {
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._44333ccf96bb3c43fae673bd9e25a436/node_modules/better-auth/dist/plugins/device-authorization/client.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._122a35b1d4615e80ac3ce156f3d09434/node_modules/better-auth/dist/plugins/device-authorization/client.mjs
 const deviceAuthorizationClient = () => {
 	return {
 		id: "device-authorization",
@@ -2013,7 +2013,7 @@ let onMount = ($store, initialize) => {
 	});
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._44333ccf96bb3c43fae673bd9e25a436/node_modules/better-auth/dist/client/query.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._122a35b1d4615e80ac3ce156f3d09434/node_modules/better-auth/dist/client/query.mjs
 const isServer = () => typeof window === "undefined";
 const useAuthQuery = (initializedAtom, path, $fetch, options) => {
 	const value = /* @__PURE__ */ atom({
@@ -2107,7 +2107,7 @@ const useAuthQuery = (initializedAtom, path, $fetch, options) => {
 	return value;
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._44333ccf96bb3c43fae673bd9e25a436/node_modules/better-auth/dist/client/broadcast-channel.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._122a35b1d4615e80ac3ce156f3d09434/node_modules/better-auth/dist/client/broadcast-channel.mjs
 const kBroadcastChannel = Symbol.for("better-auth:broadcast-channel");
 const now$1 = () => Math.floor(Date.now() / 1e3);
 var WindowBroadcastChannel = class {
@@ -2150,7 +2150,7 @@ function getGlobalBroadcastChannel(name = "better-auth.message") {
 	return globalThis[kBroadcastChannel];
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._44333ccf96bb3c43fae673bd9e25a436/node_modules/better-auth/dist/client/focus-manager.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._122a35b1d4615e80ac3ce156f3d09434/node_modules/better-auth/dist/client/focus-manager.mjs
 const kFocusManager = Symbol.for("better-auth:focus-manager");
 var WindowFocusManager = class {
 	listeners = /* @__PURE__ */ new Set();
@@ -2179,7 +2179,7 @@ function getGlobalFocusManager() {
 	return globalThis[kFocusManager];
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._44333ccf96bb3c43fae673bd9e25a436/node_modules/better-auth/dist/client/online-manager.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._122a35b1d4615e80ac3ce156f3d09434/node_modules/better-auth/dist/client/online-manager.mjs
 const kOnlineManager = Symbol.for("better-auth:online-manager");
 var WindowOnlineManager = class {
 	listeners = /* @__PURE__ */ new Set();
@@ -2211,7 +2211,7 @@ function getGlobalOnlineManager() {
 	return globalThis[kOnlineManager];
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._44333ccf96bb3c43fae673bd9e25a436/node_modules/better-auth/dist/client/parser.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._122a35b1d4615e80ac3ce156f3d09434/node_modules/better-auth/dist/client/parser.mjs
 const PROTO_POLLUTION_PATTERNS = {
 	proto: /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/,
 	constructor: /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/,
@@ -2281,7 +2281,7 @@ function parseJSON(value, options = { strict: true }) {
 	return betterJSONParse(value, options);
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._44333ccf96bb3c43fae673bd9e25a436/node_modules/better-auth/dist/client/session-refresh.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._122a35b1d4615e80ac3ce156f3d09434/node_modules/better-auth/dist/client/session-refresh.mjs
 const now = () => Math.floor(Date.now() / 1e3);
 /**
 * Normalize $fetch response: `throw: true` returns data directly, otherwise `{ data, error }`.
@@ -2479,7 +2479,7 @@ Object.freeze({
 	}
 });
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._44333ccf96bb3c43fae673bd9e25a436/node_modules/better-auth/dist/utils/url.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._122a35b1d4615e80ac3ce156f3d09434/node_modules/better-auth/dist/utils/url.mjs
 function checkHasPath(url) {
 	try {
 		return (new URL(url).pathname.replace(/\/+$/, "") || "/") !== "/";
@@ -2551,7 +2551,7 @@ function getOrigin(url) {
 	}
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._44333ccf96bb3c43fae673bd9e25a436/node_modules/better-auth/dist/client/fetch-plugins.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._122a35b1d4615e80ac3ce156f3d09434/node_modules/better-auth/dist/client/fetch-plugins.mjs
 const redirectPlugin = {
 	id: "redirect",
 	name: "Redirect",
@@ -2566,7 +2566,7 @@ const redirectPlugin = {
 	} }
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._44333ccf96bb3c43fae673bd9e25a436/node_modules/better-auth/dist/client/session-atom.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._122a35b1d4615e80ac3ce156f3d09434/node_modules/better-auth/dist/client/session-atom.mjs
 function getSessionAtom($fetch, options) {
 	const $signal = /* @__PURE__ */ atom(false);
 	const session = useAuthQuery($signal, "/get-session", $fetch, { method: "GET" });
@@ -3053,7 +3053,7 @@ var betterFetch = async (url, options) => {
 	};
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._44333ccf96bb3c43fae673bd9e25a436/node_modules/better-auth/dist/client/config.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._122a35b1d4615e80ac3ce156f3d09434/node_modules/better-auth/dist/client/config.mjs
 const resolvePublicAuthUrl = (basePath) => {
 	if (typeof process === "undefined") return void 0;
 	const path = basePath ?? "/api/auth";
@@ -3151,12 +3151,12 @@ const getClientConfig = (options, loadEnv) => {
 	};
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._44333ccf96bb3c43fae673bd9e25a436/node_modules/better-auth/dist/utils/is-atom.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._122a35b1d4615e80ac3ce156f3d09434/node_modules/better-auth/dist/utils/is-atom.mjs
 function isAtom(value) {
 	return typeof value === "object" && value !== null && "get" in value && typeof value.get === "function" && "lc" in value && typeof value.lc === "number";
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._44333ccf96bb3c43fae673bd9e25a436/node_modules/better-auth/dist/client/proxy.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._122a35b1d4615e80ac3ce156f3d09434/node_modules/better-auth/dist/client/proxy.mjs
 function getMethod(path, knownPathMethods, args) {
 	const method = knownPathMethods[path];
 	const { fetchOptions, query: _query, ...body } = args || {};
@@ -3236,7 +3236,7 @@ function capitalizeFirstLetter(str) {
 	return str.charAt(0).toUpperCase() + str.slice(1);
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._44333ccf96bb3c43fae673bd9e25a436/node_modules/better-auth/dist/client/vanilla.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._122a35b1d4615e80ac3ce156f3d09434/node_modules/better-auth/dist/client/vanilla.mjs
 function createAuthClient(options) {
 	const { pluginPathMethods, pluginsActions, pluginsAtoms, $fetch, atomListeners, $store } = getClientConfig(options);
 	const resolvedHooks = {};
@@ -5242,7 +5242,7 @@ function unreachableTarget(context) {
 	return context?.serverUrl ?? context?.webUrl;
 }
 function unreachableServerMessage(targetUrl) {
-	return `Could not reach ${targetUrl ?? "the keystroke server"}. Is the server running? (keystroke dev or keystroke start)`;
+	return `Could not reach ${targetUrl ?? "the keystroke server"}.`;
 }
 function authApiOrigin(context) {
 	if (context?.platformUrl) return context.platformUrl;
@@ -6678,6 +6678,7 @@ function registerAuthCommand(program) {
 //#endregion
 //#region src/update/ensure-sdk-current.ts
 const KEYSTROKE_SCOPE = "@keystrokehq/";
+const REGISTRY_TIMEOUT_MS = 3e3;
 function shouldSkip() {
 	return Boolean(process.env.KEYSTROKE_SKIP_UPDATE || process.env.CI === "true" || process.env.CI === "1");
 }
@@ -6690,78 +6691,79 @@ function readPackageJson(root) {
 		return;
 	}
 }
-/** Local/workspace specs are left alone; everything else (ranges and exact pins) updates to latest. */
+/** Local/workspace specs are left alone; everything else (ranges and exact pins) must stay current. */
 function isLocalSdkSpec(spec) {
 	if (!spec) return true;
 	const trimmed = spec.trim();
 	return trimmed.startsWith("workspace:") || trimmed.startsWith("link:") || trimmed.startsWith("file:");
 }
-function listUpdatableKeystrokePackages(root) {
+function listManagedKeystrokePackages(root) {
 	const pkg = readPackageJson(root);
 	if (!pkg) return [];
 	const packages = [];
-	for (const [name, spec] of Object.entries(pkg.dependencies ?? {})) if (name.startsWith(KEYSTROKE_SCOPE) && !isLocalSdkSpec(spec)) packages.push({
-		name,
-		dev: false
-	});
-	for (const [name, spec] of Object.entries(pkg.devDependencies ?? {})) if (name.startsWith(KEYSTROKE_SCOPE) && !isLocalSdkSpec(spec)) packages.push({
-		name,
-		dev: true
-	});
+	for (const [name, spec] of Object.entries({
+		...pkg.dependencies,
+		...pkg.devDependencies
+	})) if (name.startsWith(KEYSTROKE_SCOPE) && !isLocalSdkSpec(spec)) packages.push({ name });
 	return packages;
 }
-function updateCommand(manager, packageName, dev) {
-	const spec = `${packageName}@latest`;
-	if (manager === "npm") return {
-		command: "npm",
-		args: dev ? [
-			"install",
-			"-D",
-			spec
-		] : ["install", spec]
-	};
-	return {
-		command: manager,
-		args: dev ? [
-			"add",
-			"-D",
-			spec
-		] : ["add", spec]
-	};
+function readInstalledVersion(root, packageName) {
+	const path = join(root, "node_modules", ...packageName.split("/"), "package.json");
+	if (!existsSync(path)) return;
+	try {
+		return JSON.parse(readFileSync(path, "utf8")).version?.trim() || void 0;
+	} catch {
+		return;
+	}
+}
+async function fetchLatestPackageVersion(packageName) {
+	const controller = new AbortController();
+	const timeout = setTimeout(() => controller.abort(), REGISTRY_TIMEOUT_MS);
+	try {
+		const response = await fetch(`https://registry.npmjs.org/${encodeURIComponent(packageName)}`, {
+			signal: controller.signal,
+			headers: { Accept: "application/json" }
+		});
+		if (!response.ok) return;
+		return (await response.json())["dist-tags"]?.latest?.trim() || void 0;
+	} catch {
+		return;
+	} finally {
+		clearTimeout(timeout);
+	}
 }
-function warnReleaseAgeBlock(packageName) {
-	process.stderr.write(`Warning: ${packageName}@latest is held back by your minimum-release-age setting; continuing with the currently installed version.\n`);
+function formatOutdatedLine(pkg) {
+	if (pkg.installed && pkg.latest) return `- ${pkg.name} (${pkg.installed} → ${pkg.latest})`;
+	if (pkg.latest) return `- ${pkg.name} (not installed → ${pkg.latest})`;
+	return `- ${pkg.name}`;
+}
+async function packagesNeedingUpdate(root, packages) {
+	return (await Promise.all(packages.map(async (pkg) => {
+		const installed = readInstalledVersion(root, pkg.name);
+		const latest = await fetchLatestPackageVersion(pkg.name);
+		if (!latest) return installed ? void 0 : {
+			name: pkg.name,
+			installed
+		};
+		if (!installed || isNewerVersion(latest, installed)) return {
+			name: pkg.name,
+			installed,
+			latest
+		};
+	}))).flatMap((pkg) => pkg ? [pkg] : []);
 }
 /**
-* Keep @keystrokehq/* project dependencies on latest before build/deploy.
-* The package manager no-ops when already current; minimum-release-age failures warn only.
+* Require @keystrokehq/* project dependencies to be on latest before build/deploy.
+* Checks the registry concurrently; throws instead of auto-installing (safe for CI).
 */
-function ensureSdkCurrent(root) {
+async function ensureSdkCurrent(root) {
 	if (shouldSkip()) return;
-	const packages = listUpdatableKeystrokePackages(root);
+	const packages = listManagedKeystrokePackages(root);
 	if (packages.length === 0) return;
-	const manager = detectManagerFromLockfile(root) ?? detectPackageManager();
-	const token = resolveGithubPackagesToken();
-	const env = token ? {
-		...process.env,
-		NODE_AUTH_TOKEN: token
-	} : process.env;
-	for (const pkg of packages) {
-		const { command, args } = updateCommand(manager, pkg.name, pkg.dev);
-		process.stderr.write(`Ensuring ${pkg.name} is up to date...\n`);
-		const result = spawnSync(command, args, {
-			cwd: root,
-			env,
-			encoding: "utf8"
-		});
-		if (result.status === 0) continue;
-		const output = `${result.stdout ?? ""}${result.stderr ?? ""}`;
-		if (isReleaseAgeBlock(output)) {
-			warnReleaseAgeBlock(pkg.name);
-			continue;
-		}
-		process.stderr.write(`Warning: failed to update ${pkg.name}; continuing.\n${output}`);
-	}
+	const outdated = await packagesNeedingUpdate(root, packages);
+	if (outdated.length === 0) return;
+	const lines = outdated.map(formatOutdatedLine).join("\n");
+	throw new Error(`Outdated @keystrokehq packages:\n${lines}\n\nPlease update your versions before continuing.`);
 }
 //#endregion
 //#region src/commands/build.ts
@@ -6769,7 +6771,7 @@ function registerBuildCommand(program) {
 	program.command("build").description("Build the keystroke project for production").option("--dir <path>", "Project directory", process.cwd()).action(async (options) => {
 		try {
 			const root = resolveProjectRoot(options.dir);
-			ensureSdkCurrent(root);
+			await ensureSdkCurrent(root);
 			const { buildApp } = await import("./dist-B8-vsCpf.mjs");
 			await buildApp({ root });
 			process.stdout.write(`Built ${root}\n`);
@@ -6929,7 +6931,7 @@ async function buildDeployArchive(client, root, projectId, filter) {
 }
 async function runDeploy(options) {
 	const root = resolveProjectRoot(options.dir);
-	ensureSdkCurrent(root);
+	await ensureSdkCurrent(root);
 	if (await runLint(root) !== 0) throw new Error("lint failed");
 	if (await runTypecheck(root) !== 0) throw new Error("typecheck failed");
 	const config = createCliConfig();
@@ -7691,8 +7693,14 @@ function registerInitCommand(program) {
 //#region src/commands/lint.ts
 function registerLintCommand(program) {
 	program.command("lint").description("Lint the project with the bundled oxlint").option("--dir <path>", "Project directory", process.cwd()).allowUnknownOption(true).argument("[args...]", "Extra arguments forwarded to oxlint").action(async (args, options) => {
-		const root = resolveProjectRoot(options.dir);
-		process.exitCode = await runLint(root, args.length > 0 ? args : void 0);
+		try {
+			const root = resolveProjectRoot(options.dir);
+			await ensureSdkCurrent(root);
+			process.exitCode = await runLint(root, args.length > 0 ? args : void 0);
+		} catch (error) {
+			process.stderr.write(`${formatCliError(error, "lint failed")}\n`);
+			process.exitCode = 1;
+		}
 	});
 }
 //#endregion
@@ -7720,8 +7728,14 @@ function registerTestCommand(program) {
 //#region src/commands/typecheck.ts
 function registerTypecheckCommand(program) {
 	program.command("typecheck").description("Type-check the project with the bundled TypeScript").option("--dir <path>", "Project directory", process.cwd()).action(async (options) => {
-		const root = resolveProjectRoot(options.dir);
-		process.exitCode = await runTypecheck(root);
+		try {
+			const root = resolveProjectRoot(options.dir);
+			await ensureSdkCurrent(root);
+			process.exitCode = await runTypecheck(root);
+		} catch (error) {
+			process.stderr.write(`${formatCliError(error, "typecheck failed")}\n`);
+			process.exitCode = 1;
+		}
 	});
 }
 //#endregion
@@ -8813,7 +8827,7 @@ function createProgram() {
 	return program;
 }
 async function runCli(argv) {
-	const { maybeAutoUpdate } = await import("./maybe-auto-update-B2QRoCE7.mjs");
+	const { maybeAutoUpdate } = await import("./maybe-auto-update-Du4nv2q8.mjs");
 	await maybeAutoUpdate(argv);
 	createProgram().parse(argv);
 }