@keystrokehq/cli 0.0.1 → 0.0.2

package/dist/hosted-action-dispatcher-registry-TOVzMhUR.mjs

@@ -0,0 +1,126 @@
+#!/usr/bin/env node
+
+//#region ../../packages/core/src/operation/integration-metadata-registry.ts
+const REGISTRY_KEY$1 = "__ks_official_integration_metadata_registry";
+function getRegistry() {
+	const g = globalThis;
+	if (!g[REGISTRY_KEY$1]) g[REGISTRY_KEY$1] = /* @__PURE__ */ new WeakMap();
+	return g[REGISTRY_KEY$1];
+}
+/** Register by instance identity. Parameters use `object` so consumers are not blocked when `.d.ts` bundles duplicate `Operation` (e.g. `_runtime` vs `./operation`). */
+function registerOfficialIntegrationOperation(operation, metadata) {
+	getRegistry().set(operation, Object.freeze({ ...metadata }));
+}
+function getOfficialIntegrationMetadata(operation) {
+	return getRegistry().get(operation);
+}
+//#endregion
+//#region ../../packages/core/src/internal/execution-scope.ts
+const SCOPE_STACK_KEY = "__ks_execution_scope_stack__";
+function getScopeStack() {
+	const g = globalThis;
+	if (!g[SCOPE_STACK_KEY]) g[SCOPE_STACK_KEY] = [];
+	return g[SCOPE_STACK_KEY];
+}
+function getCurrentScope() {
+	const stack = getScopeStack();
+	return stack[stack.length - 1] ?? getDefaultScope();
+}
+const DEFAULT_SCOPE_KEY = "__ks_execution_scope_default__";
+function getDefaultScope() {
+	const g = globalThis;
+	if (!g[DEFAULT_SCOPE_KEY]) g[DEFAULT_SCOPE_KEY] = { stepContextProviders: [] };
+	return g[DEFAULT_SCOPE_KEY];
+}
+function getExecutionScopeWorkflowRuntime() {
+	return getCurrentScope().workflowRuntimeProvider?.();
+}
+function setExecutionScopeWorkflowRuntime(provider) {
+	const scope = getCurrentScope();
+	scope.workflowRuntimeProvider = provider;
+}
+function pushExecutionScopeStepContext(provider) {
+	const scope = getCurrentScope();
+	scope.stepContextProviders = [...scope.stepContextProviders, provider];
+}
+function clearExecutionScopeStepContexts() {
+	const scope = getCurrentScope();
+	scope.stepContextProviders = [];
+}
+function getExecutionScopeStepContextProvider() {
+	return getCurrentScope().stepContextProviders.at(-1);
+}
+function setExecutionScopeStepCredentialResolver(resolver) {
+	const scope = getCurrentScope();
+	scope.stepCredentialResolver = resolver;
+}
+function getExecutionScopeStepCredentialResolver() {
+	return getCurrentScope().stepCredentialResolver;
+}
+//#endregion
+//#region ../../packages/core/src/workflow/context-registry.ts
+function registerRuntime(registry) {
+	setExecutionScopeWorkflowRuntime(registry.getRuntime);
+}
+function clearRuntime() {
+	setExecutionScopeWorkflowRuntime(void 0);
+}
+function getRegisteredRuntime() {
+	return getExecutionScopeWorkflowRuntime();
+}
+//#endregion
+//#region ../../packages/core/src/operation/context-registry.ts
+function getCurrentRegistry() {
+	const provider = getExecutionScopeStepContextProvider();
+	if (!provider) return;
+	return { getOperationContext: provider };
+}
+function registerOperationContext(registry) {
+	pushExecutionScopeStepContext(registry.getOperationContext);
+}
+function clearOperationContext() {
+	clearExecutionScopeStepContexts();
+}
+function getRegisteredOperationContext(operation) {
+	return getCurrentRegistry()?.getOperationContext(operation);
+}
+//#endregion
+//#region ../../packages/core/src/operation/credential-resolver-registry.ts
+function registerOperationCredentialResolver(resolver) {
+	setExecutionScopeStepCredentialResolver(resolver.resolveOperationCredentials);
+}
+function clearOperationCredentialResolver() {
+	setExecutionScopeStepCredentialResolver(void 0);
+}
+function getRegisteredOperationCredentialResolver() {
+	const resolveOperationCredentials = getExecutionScopeStepCredentialResolver();
+	if (!resolveOperationCredentials) return;
+	return { resolveOperationCredentials };
+}
+async function resolveRegisteredOperationCredentials(operation, partialContext) {
+	return getRegisteredOperationCredentialResolver()?.resolveOperationCredentials(operation, partialContext);
+}
+//#endregion
+//#region ../../packages/core/src/operation/hosted-action-dispatcher-registry.ts
+const REGISTRY_KEY = "__ks_hosted_action_dispatcher";
+const EXECUTION_POLICY_KEY = "__ks_hosted_action_execution_policy";
+function registerHostedActionDispatcher(dispatcher) {
+	globalThis[REGISTRY_KEY] = dispatcher;
+}
+function clearHostedActionDispatcher() {
+	globalThis[REGISTRY_KEY] = void 0;
+}
+function getRegisteredHostedActionDispatcher() {
+	return globalThis[REGISTRY_KEY];
+}
+function registerHostedActionExecutionPolicy(policy) {
+	globalThis[EXECUTION_POLICY_KEY] = policy;
+}
+function clearHostedActionExecutionPolicy() {
+	globalThis[EXECUTION_POLICY_KEY] = void 0;
+}
+function getHostedActionExecutionPolicy() {
+	return globalThis[EXECUTION_POLICY_KEY] ?? "permissive";
+}
+//#endregion
+export { registerOfficialIntegrationOperation as _, registerHostedActionDispatcher as a, registerOperationCredentialResolver as c, getRegisteredOperationContext as d, registerOperationContext as f, getOfficialIntegrationMetadata as g, registerRuntime as h, getRegisteredHostedActionDispatcher as i, resolveRegisteredOperationCredentials as l, getRegisteredRuntime as m, clearHostedActionExecutionPolicy as n, registerHostedActionExecutionPolicy as o, clearRuntime as p, getHostedActionExecutionPolicy as r, clearOperationCredentialResolver as s, clearHostedActionDispatcher as t, clearOperationContext as u };

package/dist/iam-command-utils-CNC8JfZ5.mjs

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+
+import { D as throwReportedCliExit, f as getHttpStatus, h as toErrorMessage, t as ui } from "./keystroke.mjs";
+import { a as writeJsonError } from "./output-q4KljAhu.mjs";
+//#region src/lib/iam-command-utils.ts
+function requireOrganizationId(ctx) {
+	if (ctx.organizationId) return ctx.organizationId;
+	const message = "Organization context is required. Pass --org or run `keystroke org switch`.";
+	if (ctx.jsonMode) writeJsonError(message, {
+		code: "ORG_REQUIRED",
+		hint: "Pass --org <organization-id> or run `keystroke org switch`."
+	});
+	ui.error(message);
+	throwReportedCliExit(message);
+}
+function isIamJsonMode(options, ctx) {
+	return options.json === true || ctx.jsonMode;
+}
+function requireConfirmation({ confirmed, message, ctx }) {
+	if (confirmed === true) return;
+	const fullMessage = `${message} Re-run with --confirm to proceed.`;
+	if (ctx.jsonMode) writeJsonError(fullMessage, {
+		code: "CONFIRMATION_REQUIRED",
+		hint: "Pass --confirm to confirm this mutation."
+	});
+	ui.error(fullMessage);
+	throwReportedCliExit(fullMessage);
+}
+async function handleIamError(error, ctx, fallback) {
+	const status = getHttpStatus(error);
+	const apiBody = await readApiErrorBody(error);
+	const code = apiBody?.code ?? apiBody?.errorCode;
+	let message = fallback;
+	let hint;
+	let errorCode;
+	if (status === 403 && fallback === "Failed to create organization") {
+		message = `${fallback}: system.create_org is required.`;
+		hint = "Use credentials owned by a Keystroke platform admin.";
+		errorCode = "SYSTEM_PERMISSION_REQUIRED";
+	} else if (status === 403) {
+		message = `${fallback}: org.manage_members permission is required.`;
+		hint = "Use credentials for an organization owner/admin, or a user with an action grant.";
+		errorCode = "ORG_PERMISSION_REQUIRED";
+	} else if (status === 409 && code === "LAST_OWNER") {
+		message = `${fallback}: another owner must be added before this operation can proceed.`;
+		hint = "Add or promote another owner first.";
+		errorCode = "LAST_OWNER";
+	} else {
+		message = `${fallback}: ${apiBody?.message ?? apiBody?.error ?? toErrorMessage(error)}`;
+		errorCode = code ?? (status ? `HTTP_${status}` : void 0);
+	}
+	if (ctx.jsonMode) writeJsonError(message, {
+		code: errorCode,
+		hint,
+		cause: error
+	});
+	ui.error(message);
+	if (hint) ui.hint(hint);
+	throwReportedCliExit(message, { cause: error });
+}
+async function readApiErrorBody(error) {
+	if (!error || typeof error !== "object" || !("response" in error)) return null;
+	const response = error.response;
+	if (typeof response?.clone !== "function") return null;
+	try {
+		return await response.clone().json();
+	} catch {
+		return null;
+	}
+}
+//#endregion
+export { requireOrganizationId as i, isIamJsonMode as n, requireConfirmation as r, handleIamError as t };

package/dist/{import-module-CV84H5fZ-B_CBCmb4.mjs → import-module-DDPnzlJ1-CYJD2n2b.mjs}

@@ -1,10 +1,12 @@
 #!/usr/bin/env node
 
-import { n as findProjectRoot } from "./project-config-D1qsQlO7.mjs";
-import { o as DeclaredCredentialRequirementSchema } from "./schedule-BXx3uXwr.mjs";
-import { a as WORKFLOW_MANIFEST_SCHEMA_VERSION, c as FlowGraphSchema, o as WorkflowCoreManifestSchema } from "./_manifest-JSRE3H8k.mjs";
-import { t as runWithConcurrency } from "./concurrency-gXn9Rw8x-DNl2YtrS.mjs";
-import { m as AgentManifestSchema, n as pollingTriggerManifestSchema, r as cronTriggerManifestSchema, t as webhookTriggerManifestSchema } from "./src-C0X6u_Mw.mjs";
+import { n as findProjectRoot } from "./project-config-opj6DsPF.mjs";
+import { a as idNoSpacesString, c as optionalDescriptionString, f as trimmedNonEmptyString, i as descriptionString, l as optionalTrimmedNonEmptyString, n as createStructuralSchema, o as jsonSchemaObject, s as jsonValueSchema, t as anyZodSchemaSchema } from "./schema-kbMHVnhm.mjs";
+import { m as CredentialSetManifestSchema, n as DeclaredCredentialRequirementSchema } from "./credential-requirements-DjDFthio.mjs";
+import { a as FlowGraphSchema, n as WORKFLOW_MANIFEST_SCHEMA_VERSION, r as WorkflowCoreManifestSchema } from "./workflow-manifest-CAW5FlX0.mjs";
+import { n as IANATimezoneSchema, r as ScheduleSchema } from "./schedule-BRN4hzQM.mjs";
+import { n as TriggerRuntimeDescriptorSchema, r as triggerBaseConfigSchema } from "./schemas-DsvCZfF0.mjs";
+import { t as runWithConcurrency } from "./concurrency-gXn9Rw8x-BTlfau8D.mjs";
 import { createRequire } from "node:module";
 import * as os from "node:os";
 import * as path$1 from "node:path";
@@ -13,7 +15,390 @@ import { pathToFileURL } from "node:url";
 import { execFile } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { promisify } from "node:util";
-//#region ../../packages/workflow-builder/dist/import-module-CV84H5fZ.mjs
+//#region ../../packages/core/src/mcp-server/schemas.ts
+const credentialSetInstanceSchema$2 = createStructuralSchema([
+	"id",
+	"auth",
+	"needsResolve"
+], "a CredentialSet instance");
+const McpTransportSchema = z.discriminatedUnion("type", [
+	z.object({
+		type: z.literal("stdio"),
+		command: trimmedNonEmptyString("Command"),
+		args: z.array(z.string()).optional(),
+		env: z.record(z.string(), z.string()).optional()
+	}),
+	z.object({
+		type: z.literal("http"),
+		url: trimmedNonEmptyString("URL"),
+		headers: z.record(z.string(), z.string()).optional()
+	}),
+	z.object({
+		type: z.literal("sse"),
+		url: trimmedNonEmptyString("URL"),
+		headers: z.record(z.string(), z.string()).optional()
+	})
+]);
+z.object({
+	id: trimmedNonEmptyString("MCP server ID"),
+	name: optionalTrimmedNonEmptyString("MCP server name"),
+	description: optionalDescriptionString("MCP server description"),
+	transport: McpTransportSchema,
+	credentialSets: z.array(credentialSetInstanceSchema$2).optional(),
+	credentials: z.function().optional()
+});
+const McpServerManifestSchema = z.object({
+	manifestVersion: z.literal(1),
+	type: z.literal("mcpServer"),
+	id: z.string().min(1),
+	name: z.string().min(1),
+	description: z.string().optional(),
+	transport: McpTransportSchema,
+	credentialSets: z.array(CredentialSetManifestSchema),
+	credentialInjection: z.object({
+		env: z.record(z.string(), z.object({
+			credentialSetId: z.string().min(1),
+			key: z.string().min(1)
+		})).optional(),
+		headers: z.record(z.string(), z.object({
+			credentialSetId: z.string().min(1),
+			key: z.string().min(1)
+		})).optional()
+	}).optional()
+});
+//#endregion
+//#region ../../packages/core/src/messaging-gateway/schemas.ts
+const credentialSetInstanceSchema$1 = createStructuralSchema([
+	"id",
+	"auth",
+	"needsResolve"
+], "a CredentialSet instance");
+const MessagingGatewayModeSchema = z.enum(["platform", "custom"]);
+const MessagingGatewayCredentialScopeSchema = z.enum(["organization", "project"]);
+z.object({
+	id: idNoSpacesString("MessagingGateway id"),
+	name: optionalDescriptionString("MessagingGateway name"),
+	description: optionalDescriptionString("MessagingGateway description"),
+	provider: z.string().min(1, "MessagingGateway provider is required"),
+	mode: MessagingGatewayModeSchema,
+	credentialSet: credentialSetInstanceSchema$1,
+	credentialScope: MessagingGatewayCredentialScopeSchema.optional(),
+	appRef: z.string().min(1).optional()
+});
+const MessagingGatewayManifestSchema = z.object({
+	manifestVersion: z.literal(1),
+	type: z.literal("messaging-gateway"),
+	id: z.string().min(1),
+	name: z.string().min(1),
+	description: z.string().optional(),
+	provider: z.string().min(1),
+	mode: MessagingGatewayModeSchema,
+	credentialSet: CredentialSetManifestSchema,
+	credentialScope: MessagingGatewayCredentialScopeSchema.optional(),
+	appRef: z.string().min(1).optional()
+});
+//#endregion
+//#region ../../packages/core/src/sandbox/schemas.ts
+/**
+* `workdir` must be `/workspace` or a subdirectory so it lands inside the
+* persistent bind mount used by `bootSandbox`. Anything outside `/workspace`
+* is ephemeral today (and not captured by future snapshots' instance state).
+*/
+const WorkdirSchema = z.string().trim().min(1).refine((value) => value === "/workspace" || value.startsWith("/workspace/"), { error: "workdir must be \"/workspace\" or a subdirectory of \"/workspace\"" });
+const SandboxRuntimeSchema = z.object({
+	/**
+	* Commands the runtime executes inside the sandbox on EVERY boot, after
+	* `setupCommands` (and after a snapshot warm-boot, where setupCommands are
+	* skipped). Use for `git pull`, `pnpm build`, or anything that should
+	* refresh on each invocation. Each command runs with `cwd = workdir`.
+	*/
+	runCommands: z.array(z.string().trim().min(1)).default([]),
+	env: z.record(z.string(), z.string()).default({}),
+	workdir: WorkdirSchema.optional()
+});
+const SandboxFileSourceSchema = z.discriminatedUnion("type", [z.object({
+	type: z.literal("git"),
+	/** Remote git URL to clone. */
+	url: trimmedNonEmptyString("Git URL"),
+	/** Branch to clone. Omit for default branch. */
+	branch: z.string().optional(),
+	/**
+	* Where to clone inside the VM. Relative paths resolve against the
+	* sandbox `workdir`; absolute paths must stay under `/workspace`. Omit
+	* to default to `<workdir>/<repo-basename>`.
+	*/
+	target: z.string().optional()
+}), z.object({
+	type: z.literal("local"),
+	/** Source path on the host (the dev's machine), resolved against project root. */
+	path: trimmedNonEmptyString("Local path"),
+	/**
+	* Where the file/dir lands inside the VM. Relative paths resolve
+	* against the sandbox `workdir`; absolute paths must stay under
+	* `/workspace`. Omit to default to `<workdir>/<basename(path)>`.
+	*/
+	target: z.string().optional()
+})]);
+z.object({
+	id: optionalTrimmedNonEmptyString("Sandbox ID"),
+	name: optionalTrimmedNonEmptyString("Sandbox name"),
+	description: optionalDescriptionString("Sandbox description"),
+	runtime: SandboxRuntimeSchema.optional(),
+	fileSources: z.array(SandboxFileSourceSchema).optional(),
+	setupCommands: z.array(z.string()).optional()
+});
+const SandboxManifestSchema = z.object({
+	manifestVersion: z.literal(1),
+	type: z.literal("sandbox"),
+	id: z.string().min(1),
+	name: z.string().min(1),
+	description: z.string().optional(),
+	runtime: SandboxRuntimeSchema,
+	fileSources: z.array(SandboxFileSourceSchema),
+	setupCommands: z.array(z.string())
+});
+//#endregion
+//#region ../../packages/core/src/agent/types.ts
+const AGENT_RUNTIME_KIND_DECLARATIVE = "declarative";
+const AGENT_RUNTIME_KIND_RUNNABLE = "runnable";
+//#endregion
+//#region ../../packages/core/src/agent/schemas.ts
+const AgentThinkingLevelSchema = z.enum([
+	"off",
+	"minimal",
+	"low",
+	"medium",
+	"high",
+	"xhigh"
+]);
+const mcpServerInstanceSchema = createStructuralSchema([
+	"id",
+	"transport",
+	"credentialSets"
+], "a McpServer instance");
+const sandboxInstanceSchema = createStructuralSchema([
+	"id",
+	"runtime",
+	"fileSources",
+	"setupCommands"
+], "a Sandbox instance");
+const messagingGatewayInstanceSchema = createStructuralSchema([
+	"id",
+	"provider",
+	"mode",
+	"credentialSet"
+], "a MessagingGateway instance");
+const SkillSourceSchema = z.object({ path: z.string() });
+const AgentHooksSchema = z.object({
+	onToolStart: z.function().optional(),
+	onToolEnd: z.function().optional(),
+	onStep: z.function().optional()
+}).strict();
+const AgentToolSourceKindSchema = z.enum(["operation", "workflow"]);
+const AgentToolCredentialSetReferenceSchema = z.object({
+	id: z.string(),
+	required: z.boolean()
+});
+z.object({
+	id: trimmedNonEmptyString("Agent ID"),
+	name: trimmedNonEmptyString("Agent name"),
+	description: optionalDescriptionString("Agent description"),
+	systemPrompt: z.string().min(1, { error: "System prompt is required" }),
+	model: trimmedNonEmptyString("Model"),
+	thinkingLevel: AgentThinkingLevelSchema.optional(),
+	input: anyZodSchemaSchema.optional(),
+	output: anyZodSchemaSchema.optional(),
+	tools: z.array(z.unknown()).optional(),
+	mcpServers: z.array(mcpServerInstanceSchema).optional(),
+	sandbox: sandboxInstanceSchema.optional(),
+	skills: z.array(SkillSourceSchema).optional(),
+	enableMemory: z.boolean().default(true),
+	enableDatabase: z.boolean().default(true),
+	messaging: z.array(messagingGatewayInstanceSchema).optional(),
+	maxSteps: z.number().int().nonnegative().optional(),
+	hooks: AgentHooksSchema.optional(),
+	run: z.function().optional(),
+	stream: z.function().optional()
+});
+const AgentManifestSchema = z.object({
+	manifestVersion: z.literal(1),
+	type: z.literal("agent"),
+	id: z.string().min(1),
+	authoredAgentId: z.string().min(1),
+	name: z.string().min(1),
+	runtimeKind: z.enum([AGENT_RUNTIME_KIND_DECLARATIVE, AGENT_RUNTIME_KIND_RUNNABLE]),
+	description: z.string().optional(),
+	systemPrompt: z.string(),
+	model: z.string(),
+	thinkingLevel: AgentThinkingLevelSchema,
+	input: jsonSchemaObject,
+	output: jsonSchemaObject,
+	maxSteps: z.number(),
+	credentialSets: z.array(CredentialSetManifestSchema).optional(),
+	tools: z.array(z.object({
+		id: z.string(),
+		displayName: z.string(),
+		description: z.string().optional(),
+		sourceKind: AgentToolSourceKindSchema,
+		authoredOperationId: z.string().optional(),
+		authoredWorkflowId: z.string().optional(),
+		integrationId: z.string().optional(),
+		largeResultMode: z.enum(["reject", "ref"]).optional(),
+		midSessionSnapshot: z.boolean().optional(),
+		credentialSets: z.array(AgentToolCredentialSetReferenceSchema).optional()
+	})),
+	skills: z.array(SkillSourceSchema).optional(),
+	enableMemory: z.boolean().default(true),
+	enableDatabase: z.boolean().default(true),
+	mcpServers: z.array(McpServerManifestSchema),
+	sandbox: SandboxManifestSchema.optional(),
+	messaging: z.array(MessagingGatewayManifestSchema).optional()
+});
+triggerBaseConfigSchema.extend({
+	input: anyZodSchemaSchema,
+	payload: z.custom((value) => {
+		return jsonValueSchema.safeParse(value).success;
+	}, "Expected a JSON-serializable payload"),
+	schedule: ScheduleSchema,
+	timezone: IANATimezoneSchema.optional()
+});
+const cronTriggerRuntimeSchema = TriggerRuntimeDescriptorSchema.extend({
+	input: jsonSchemaObject,
+	payloadMode: z.literal("static"),
+	schedule: z.string(),
+	timezone: z.string().optional()
+});
+const cronTriggerManifestSchema = z.object({
+	manifestVersion: z.literal(1),
+	type: z.literal("trigger"),
+	triggerType: z.literal("cron"),
+	name: trimmedNonEmptyString("Trigger name"),
+	description: descriptionString("Trigger description"),
+	enabled: z.boolean(),
+	modeDefault: z.enum(["managed", "subscribable"]),
+	executionIdentityPolicy: triggerBaseConfigSchema.shape.executionIdentityPolicy,
+	credentialSets: z.array(CredentialSetManifestSchema).optional(),
+	runtime: cronTriggerRuntimeSchema,
+	/** Static payload for cron triggers — the workflow input when this trigger fires */
+	payload: jsonValueSchema.optional()
+});
+z.object({
+	lastPolledAt: z.string().optional(),
+	lastResponse: z.unknown().optional()
+});
+triggerBaseConfigSchema.extend({
+	poll: z.function(),
+	filter: z.function().optional(),
+	idempotencyKey: z.function().optional(),
+	response: anyZodSchemaSchema,
+	schedule: ScheduleSchema
+});
+const pollingTriggerRuntimeSchema = TriggerRuntimeDescriptorSchema.extend({
+	response: jsonSchemaObject,
+	schedule: z.string(),
+	state: z.object({
+		lastPolledAt: z.literal(true),
+		lastResponse: z.literal(true)
+	})
+});
+const pollingTriggerManifestSchema = z.object({
+	manifestVersion: z.literal(1),
+	type: z.literal("trigger"),
+	triggerType: z.literal("polling"),
+	name: trimmedNonEmptyString("Trigger name"),
+	description: descriptionString("Trigger description"),
+	enabled: z.boolean(),
+	modeDefault: z.enum(["managed", "subscribable"]),
+	executionIdentityPolicy: triggerBaseConfigSchema.shape.executionIdentityPolicy,
+	credentialSets: z.array(CredentialSetManifestSchema).optional(),
+	runtime: pollingTriggerRuntimeSchema
+});
+//#endregion
+//#region ../../packages/core/src/trigger/webhook/schemas.ts
+const WebhookMethodSchema = z.enum([
+	"PATCH",
+	"POST",
+	"PUT"
+]);
+z.object({
+	method: z.string(),
+	path: z.string(),
+	query: z.record(z.string(), z.union([
+		z.string(),
+		z.array(z.string()),
+		z.undefined()
+	])),
+	headers: z.record(z.string(), z.string().optional()),
+	rawBody: z.string()
+});
+const WebhookResponseConfigSchema = z.object({
+	ignoredBody: jsonValueSchema.optional(),
+	ignoredStatus: z.number().int().positive().optional(),
+	successBody: jsonValueSchema.optional(),
+	successStatus: z.number().int().positive().optional()
+});
+/**
+* Custom webhook trigger paths describe the suffix that a request URL has
+* after the organization id. The router serves these triggers at
+* `/api/v1/webhooks/{orgId}{path}` (e.g. `path: '/orders'` → request
+* `/api/v1/webhooks/{orgId}/orders`). Authors must therefore supply only the
+* trailing path segment, not the `/webhooks/` prefix that the route already
+* provides.
+*/
+const webhookPathSchema = z.string().trim().min(1, { error: "Webhook path cannot be empty" }).max(50, { error: "Webhook path cannot exceed 50 characters" }).refine((s) => !/\s/.test(s), { error: "Webhook path cannot contain spaces or whitespace" }).refine((s) => s.startsWith("/"), { error: "Webhook path must start with /" }).refine((s) => s.length > 1, { error: "Webhook path must include a path segment after the leading \"/\"" }).refine((s) => !/^\/webhooks(\/|$)/i.test(s), { error: "Webhook path must not start with \"/webhooks\". Provide just the suffix that follows the organization id in the URL — e.g. use \"/orders\" for a webhook served at \"/api/v1/webhooks/{orgId}/orders\"." });
+const credentialSetInstanceSchema = createStructuralSchema([
+	"id",
+	"auth",
+	"needsResolve"
+], "a CredentialSet instance");
+const webhookCustomSourceConfigSchema = z.object({
+	type: z.literal("custom"),
+	method: WebhookMethodSchema,
+	path: webhookPathSchema,
+	verify: z.function().optional(),
+	response: WebhookResponseConfigSchema.optional(),
+	credentialSets: z.array(credentialSetInstanceSchema).optional()
+});
+const webhookAppSourceConfigSchema = z.object({
+	type: z.literal("app"),
+	appRef: trimmedNonEmptyString("appRef")
+});
+const webhookSourceConfigSchema = z.discriminatedUnion("type", [webhookCustomSourceConfigSchema, webhookAppSourceConfigSchema]);
+const webhookCustomSourceManifestSchema = z.object({
+	type: z.literal("custom"),
+	method: WebhookMethodSchema,
+	path: z.string().min(1).max(1024),
+	response: WebhookResponseConfigSchema.optional()
+});
+const webhookAppSourceManifestSchema = z.object({
+	type: z.literal("app"),
+	appRef: trimmedNonEmptyString("appRef")
+});
+const WebhookSourceManifestSchema = z.discriminatedUnion("type", [webhookCustomSourceManifestSchema, webhookAppSourceManifestSchema]);
+triggerBaseConfigSchema.omit({ credentialSets: true }).extend({
+	source: webhookSourceConfigSchema,
+	payload: anyZodSchemaSchema.optional(),
+	filter: z.function().optional(),
+	idempotencyKey: z.function().optional()
+});
+const webhookTriggerRuntimeSchema = TriggerRuntimeDescriptorSchema.extend({
+	source: WebhookSourceManifestSchema,
+	payload: jsonSchemaObject
+});
+const webhookTriggerManifestSchema = z.object({
+	manifestVersion: z.literal(1),
+	type: z.literal("trigger"),
+	triggerType: z.literal("webhook"),
+	name: trimmedNonEmptyString("Trigger name"),
+	description: descriptionString("Trigger description"),
+	enabled: z.boolean(),
+	modeDefault: z.enum(["managed", "subscribable"]),
+	executionIdentityPolicy: triggerBaseConfigSchema.shape.executionIdentityPolicy,
+	credentialSets: z.array(CredentialSetManifestSchema).optional(),
+	runtime: webhookTriggerRuntimeSchema
+});
+//#endregion
+//#region ../../packages/workflow-builder/dist/import-module-DDPnzlJ1.mjs
 var DiscoveryError = class extends Error {
 	code;
 	filePath;
@@ -132,9 +517,9 @@ import {
   cronTrigger,
   webhookTrigger,
   pollingTrigger,
-} from '@keystroke/workflow-core';
-import { getOfficialIntegrationMetadata } from '@keystroke/workflow-core/_runtime';
-import { analyzeSuspensions, analyzeWorkflowCredentials, isTabularSchema } from '@keystroke/workflow-core/flow-graph-toolkit';
+} from '@keystrokehq/core';
+import { getOfficialIntegrationMetadata } from '@keystrokehq/core/_runtime';
+import { analyzeSuspensions, analyzeWorkflowCredentials, isTabularSchema } from '@keystrokehq/core/flow-graph-toolkit';
 import { parseSync } from ${JSON.stringify(OXC_PARSER_IMPORT_URL)};
 
 Object.assign(globalThis, {
@@ -210,7 +595,7 @@ function getAgentToolId(tool) {
 
 /**
  * Computes enrichment data for each agent tool (workflow + operation) by reaching
- * into the live primitive instances. Workflow-core only emits primitive-level facts
+ * into the live primitive instances. core only emits primitive-level facts
  * in toManifest(); cross-cutting enrichment (suspensions, credential conditionality,
  * dispatch placement, tabular detection) is computed here.
  *

package/dist/{init-DpMCotSK.mjs → init-C0sps8R7.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { t as createTypedCommand } from "./commander-DfTVqQ-3.mjs";
+import { t as createTypedCommand } from "./commander-DZ3F3CVq.mjs";
 import { z } from "zod";
 //#region src/commands/init/init.command.ts
 const InitOptionsSchema = z.object({
@@ -38,7 +38,7 @@ function createInitCommand() {
 		description: "Initialize a Keystroke project (creates keystroke.config.ts)",
 		schema: InitOptionsSchema,
 		optionsConfig: INIT_OPTIONS_CONFIG,
-		loadHandler: async () => (await import("./init.handler-CPRnif52.mjs")).handleInit
+		loadHandler: async () => (await import("./init.handler-DSW6XFZn.mjs")).handleInit
 	});
 }
 //#endregion