@keystrokehq/cli 0.0.1

package/dist/import-module-CV84H5fZ-B_CBCmb4.mjs

@@ -0,0 +1,1747 @@
+#!/usr/bin/env node
+
+import { n as findProjectRoot } from "./project-config-D1qsQlO7.mjs";
+import { o as DeclaredCredentialRequirementSchema } from "./schedule-BXx3uXwr.mjs";
+import { a as WORKFLOW_MANIFEST_SCHEMA_VERSION, c as FlowGraphSchema, o as WorkflowCoreManifestSchema } from "./_manifest-JSRE3H8k.mjs";
+import { t as runWithConcurrency } from "./concurrency-gXn9Rw8x-DNl2YtrS.mjs";
+import { m as AgentManifestSchema, n as pollingTriggerManifestSchema, r as cronTriggerManifestSchema, t as webhookTriggerManifestSchema } from "./src-C0X6u_Mw.mjs";
+import { createRequire } from "node:module";
+import * as os from "node:os";
+import * as path$1 from "node:path";
+import { z } from "zod";
+import { pathToFileURL } from "node:url";
+import { execFile } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { promisify } from "node:util";
+//#region ../../packages/workflow-builder/dist/import-module-CV84H5fZ.mjs
+var DiscoveryError = class extends Error {
+	code;
+	filePath;
+	exportNames;
+	constructor(options) {
+		super(options.message);
+		this.name = "DiscoveryError";
+		this.code = options.code;
+		this.filePath = options.filePath;
+		this.exportNames = [...options.exportNames ?? []];
+	}
+};
+function createNamespaceStarExportDiscoveryError(filePath) {
+	return new DiscoveryError({
+		code: "namespace-star-export",
+		filePath,
+		message: `Unsupported namespace workflow re-export in ${filePath}. Use named re-exports instead.`
+	});
+}
+function createAmbiguousExportDiscoveryError(filePath, exportNames) {
+	return new DiscoveryError({
+		code: "ambiguous-export",
+		filePath,
+		exportNames: [...exportNames],
+		message: `Ambiguous workflow export(s) ${exportNames.map((exportName) => `"${exportName}"`).join(", ")} in ${filePath}`
+	});
+}
+function isDiscoveryError(error) {
+	return error instanceof DiscoveryError;
+}
+var DuplicateWorkflowIdError = class extends Error {
+	workflowId;
+	files;
+	bindingKeys;
+	constructor(options) {
+		super(`Duplicate workflow id "${options.workflowId}" found in ${options.files.join(" and ")}`);
+		this.name = "DuplicateWorkflowIdError";
+		this.workflowId = options.workflowId;
+		this.files = [...options.files];
+		this.bindingKeys = [...options.bindingKeys];
+	}
+};
+function isDuplicateWorkflowIdError(error) {
+	return error instanceof DuplicateWorkflowIdError;
+}
+function createDuplicateWorkflowIdFailure(artifacts, error) {
+	if (isDuplicateWorkflowIdError(error)) return {
+		kind: "duplicate-workflow-id",
+		workflowId: error.workflowId,
+		files: [...error.files],
+		bindingKeys: [...error.bindingKeys],
+		phase: "output",
+		error: error.message
+	};
+	const message = error instanceof Error ? error.message : String(error);
+	const duplicateId = message.match(/"([^"]+)"/)?.[1];
+	if (!duplicateId) throw new Error(`Unable to determine duplicate workflow id from error: ${message}`);
+	const duplicateArtifacts = artifacts.filter((artifact) => artifact.workflow.workflowId === duplicateId);
+	return {
+		kind: "duplicate-workflow-id",
+		workflowId: duplicateId,
+		files: duplicateArtifacts.map((artifact) => artifact.workflow.resolvedFilePath),
+		bindingKeys: duplicateArtifacts.map((artifact) => artifact.workflow.bindingKey),
+		phase: "output",
+		error: message
+	};
+}
+function createDiscoveryFailure(error) {
+	if (isDiscoveryError(error)) return {
+		kind: "discovery",
+		code: error.code,
+		filePath: error.filePath,
+		exportNames: [...error.exportNames],
+		error: error.message
+	};
+	return {
+		kind: "discovery",
+		code: "unknown-discovery-error",
+		filePath: "",
+		exportNames: [],
+		error: error instanceof Error ? error.message : String(error)
+	};
+}
+function createLoaderProtocolFailure(workflow, source, error, rawOutput) {
+	return {
+		kind: "loader-protocol",
+		workflow,
+		source,
+		error,
+		...rawOutput ? { rawOutput } : {}
+	};
+}
+const LOADER_SENTINEL = "__KEYSTROKE_WORKFLOW_LOADER__::";
+const OXC_PARSER_IMPORT_URL = pathToFileURL(createRequire(import.meta.url).resolve("oxc-parser")).href;
+function createWorkflowLoaderScript() {
+	return `
+import { Buffer } from 'node:buffer';
+import { readdirSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import path, { dirname, join } from 'node:path';
+import { performance } from 'node:perf_hooks';
+import { pathToFileURL } from 'node:url';
+import {
+  Workflow,
+  Agent,
+  Operation,
+  Step,
+  Tool,
+  Task,
+  CredentialSet,
+  Sandbox,
+  McpServer,
+  CronTrigger,
+  WebhookTrigger,
+  PollingTrigger,
+  cronTrigger,
+  webhookTrigger,
+  pollingTrigger,
+} from '@keystroke/workflow-core';
+import { getOfficialIntegrationMetadata } from '@keystroke/workflow-core/_runtime';
+import { analyzeSuspensions, analyzeWorkflowCredentials, isTabularSchema } from '@keystroke/workflow-core/flow-graph-toolkit';
+import { parseSync } from ${JSON.stringify(OXC_PARSER_IMPORT_URL)};
+
+Object.assign(globalThis, {
+  Workflow,
+  Agent,
+  Operation,
+  Step,
+  Tool,
+  Task,
+  CredentialSet,
+  Sandbox,
+  McpServer,
+  CronTrigger,
+  WebhookTrigger,
+  PollingTrigger,
+  cronTrigger,
+  webhookTrigger,
+  pollingTrigger,
+});
+
+const encodedInput = process.env.KEYSTROKE_WORKFLOW_LOADER_INPUT;
+const staticFlowModuleCache = new Map();
+const staticFlowResolutionCache = new Map();
+
+function serializeError(error) {
+  if (error instanceof Error && Array.isArray(error.issues)) {
+    const messages = error.issues.map(issue => issue.message).filter(Boolean);
+    if (messages.length > 0) {
+      return messages.join('; ');
+    }
+  }
+  return error instanceof Error ? error.message : String(error);
+}
+
+function writeJson(value) {
+  return new Promise((resolve, reject) => {
+    process.stdout.write('${LOADER_SENTINEL}' + JSON.stringify(value) + '\\n', (error) => {
+      if (error) {
+        reject(error);
+        return;
+      }
+
+      resolve();
+    });
+  });
+}
+
+async function emitError(bindingKey, phase, error) {
+  await writeJson({
+    bindingKey,
+    status: 'error',
+    phase,
+    error: serializeError(error),
+  });
+}
+
+function getCredentialRequirements(value) {
+  if (!value || typeof value.getCredentialRequirements !== 'function') {
+    return [];
+  }
+
+  const entries = value.getCredentialRequirements();
+  return Array.isArray(entries) ? entries : [];
+}
+
+function getAgentToolId(tool) {
+  if (tool instanceof Workflow) return tool.id;
+  const integrationMetadata = getOfficialIntegrationMetadata(tool);
+  return integrationMetadata
+    ? integrationMetadata.integrationId + '_' + tool.id
+    : tool.id;
+}
+
+/**
+ * Computes enrichment data for each agent tool (workflow + operation) by reaching
+ * into the live primitive instances. Workflow-core only emits primitive-level facts
+ * in toManifest(); cross-cutting enrichment (suspensions, credential conditionality,
+ * dispatch placement, tabular detection) is computed here.
+ *
+ * Returns a map keyed by the agent-tool-id (same id Agent.toManifest emits).
+ */
+async function computeAgentToolEnrichments(agent) {
+  const tools = Array.isArray(agent.tools) ? agent.tools : [];
+  const enrichments = {};
+  if (tools.length === 0) return enrichments;
+
+  for (const tool of tools) {
+    const toolId = getAgentToolId(tool);
+
+    if (tool instanceof Workflow) {
+      const suspensions = await analyzeSuspensions(tool);
+      const credentials = await analyzeWorkflowCredentials(tool);
+      const requiredCredentialIds = new Set(
+        credentials.required.map((credentialSet) => credentialSet.resolvedId)
+      );
+      const enrichment = {
+        invocation: suspensions.hasSuspensions ? 'yield' : 'sync',
+        suspensions: suspensions.reasons,
+        outputSchemaIsTabular: isTabularSchema(tool.output),
+      };
+      if (credentials.all.length > 0) {
+        enrichment.credentialSets = credentials.all.map((credentialSet) => ({
+          id: credentialSet.resolvedId,
+          required: requiredCredentialIds.has(credentialSet.resolvedId),
+        }));
+      }
+      enrichments[toolId] = enrichment;
+      continue;
+    }
+
+    if (tool instanceof Operation) {
+      const integrationMetadata = getOfficialIntegrationMetadata(tool);
+      const enrichment = {
+        dispatch: integrationMetadata?.hosted ? 'host' : 'sandbox',
+        outputSchemaIsTabular: isTabularSchema(tool.output),
+      };
+      enrichments[toolId] = enrichment;
+      continue;
+    }
+  }
+
+  return enrichments;
+}
+
+async function resolveLocalModulePath(fromFilePath, specifier) {
+  const basePath = path.resolve(path.dirname(fromFilePath), specifier);
+  const candidates = [
+    basePath,
+    basePath + '.ts',
+    basePath + '.tsx',
+    basePath + '.mts',
+    path.join(basePath, 'index.ts'),
+    path.join(basePath, 'index.tsx'),
+    path.join(basePath, 'index.mts'),
+  ];
+
+  for (const candidate of candidates) {
+    try {
+      await readFile(candidate, 'utf-8');
+      return candidate;
+    } catch {
+      // Try the next resolution candidate.
+    }
+  }
+
+  return null;
+}
+
+function toRelativeFilePath(projectRoot, filePath) {
+  return path.relative(path.resolve(projectRoot), path.resolve(filePath)).replaceAll('\\\\', '/');
+}
+
+async function buildLoaderCredentialAttribution(options) {
+  const flowGraph = await enrichFlowGraphStepBindings(options);
+  const attribution = buildCredentialsByCallsiteFingerprint({
+    flowGraph,
+    credentialsByBindingName: options.credentialsByBindingName,
+  });
+
+  return {
+    flowGraph,
+    credentialsByCallsiteFingerprint: attribution.credentialsByCallsiteFingerprint,
+    credentialAttributionWarnings: attribution.warnings,
+  };
+}
+
+async function enrichFlowGraphStepBindings(options) {
+  const bindingResolutions = await collectStepBindingResolutions(options);
+  if (bindingResolutions.size === 0) {
+    return options.flowGraph;
+  }
+
+  return {
+    ...options.flowGraph,
+    nodes: options.flowGraph.nodes.map((node) => {
+      if (
+        node.type !== 'step' ||
+        node.data.kind !== 'call' ||
+        node.data.callKind !== 'workflow-step'
+      ) {
+        return node;
+      }
+
+      const bindingName = node.data.exportName ?? node.data.stepName;
+      const resolution = bindingResolutions.get(bindingName);
+      if (!resolution) {
+        return node;
+      }
+
+      return {
+        ...node,
+        data: {
+          ...node.data,
+          callKind: resolution.callKind ?? node.data.callKind,
+          stepName: resolution.displayName ?? node.data.stepName,
+          exportName: resolution.exportName,
+          ...(resolution.description ? { description: resolution.description } : {}),
+          ...(resolution.inputSchema ? { inputSchema: resolution.inputSchema } : {}),
+          ...(resolution.outputSchema ? { outputSchema: resolution.outputSchema } : {}),
+          ...(resolution.credentialSets ? { credentialSets: resolution.credentialSets } : {}),
+          ...(resolution.requiredOAuthScopes
+            ? { requiredOAuthScopes: resolution.requiredOAuthScopes }
+            : {}),
+          ...(resolution.importSource ? { importSource: resolution.importSource } : {}),
+        },
+      };
+    }),
+  };
+}
+
+async function createStaticFlowResolver(options) {
+  const bindingResolutions = await collectStepBindingResolutions(options);
+  return (candidate) => bindingResolutions.get(candidate.calleeName);
+}
+
+function buildCredentialsByCallsiteFingerprint(params) {
+  const credentialsByCallsiteFingerprint = {};
+  const matchedBindingNames = new Set();
+
+  for (const node of params.flowGraph.nodes) {
+    if (node.type !== 'step' || node.data.kind !== 'call' || !node.data.callsiteFingerprint) {
+      continue;
+    }
+
+    const bindingNames = [
+      ...new Set(
+        [node.data.exportName, node.data.stepName].filter(
+          (bindingName) => typeof bindingName === 'string'
+        )
+      ),
+    ];
+    const entries = deduplicateCredentialRequirementEntries(
+      bindingNames.flatMap((bindingName) => {
+        const boundEntries = params.credentialsByBindingName[bindingName];
+        if (boundEntries?.length) {
+          matchedBindingNames.add(bindingName);
+        }
+        return boundEntries ?? [];
+      })
+    );
+
+    if (entries.length > 0) {
+      credentialsByCallsiteFingerprint[node.data.callsiteFingerprint] = entries;
+    }
+  }
+
+  const warnings = Object.entries(params.credentialsByBindingName)
+    .filter(([bindingName]) => !matchedBindingNames.has(bindingName))
+    .map(([bindingName, entries]) => ({
+      category: 'unmatched-callsite',
+      bindingName,
+      credentialSetIds: [...new Set(entries.map((entry) => entry.resolvedCredentialSetId))].sort(),
+    }));
+
+  return { credentialsByCallsiteFingerprint, warnings };
+}
+
+function deduplicateCredentialRequirementEntries(entries) {
+  const deduped = new Map();
+
+  for (const entry of entries) {
+    const sortedKeys = [...(entry.credentialKeys ?? [])].sort();
+    const sortedStoredKeys = [...(entry.storedCredentialKeys ?? [])].sort();
+    const sortedOptionalAuthKeys = [...(entry.optionalCredentialKeys ?? [])].sort();
+    const sortedOptionalStoredKeys = [...(entry.optionalStoredCredentialKeys ?? [])].sort();
+    const credentialRefKey = entry.credentialRef
+      ? entry.credentialRef.type === 'id'
+        ? 'id:' + entry.credentialRef.id
+        : 'name:' + entry.credentialRef.name
+      : '';
+    const key = [
+      entry.credentialSetId,
+      entry.scope ?? '',
+      entry.alias ?? '',
+      credentialRefKey,
+      entry.schemaFingerprint ?? '',
+      sortedKeys.join(','),
+      sortedOptionalAuthKeys.join(','),
+      sortedStoredKeys.join(','),
+      sortedOptionalStoredKeys.join(','),
+      typeof entry.resolveCacheMs === 'number' ? String(entry.resolveCacheMs) : '',
+      entry.onCredentialRevoked ?? '',
+    ].join('|');
+    if (!deduped.has(key)) {
+      deduped.set(key, {
+        ...entry,
+        credentialKeys: sortedKeys,
+        ...(sortedOptionalAuthKeys.length > 0
+          ? { optionalCredentialKeys: sortedOptionalAuthKeys }
+          : {}),
+        ...(sortedStoredKeys.length > 0 ? { storedCredentialKeys: sortedStoredKeys } : {}),
+        ...(sortedOptionalStoredKeys.length > 0
+          ? { optionalStoredCredentialKeys: sortedOptionalStoredKeys }
+          : {}),
+      });
+    }
+  }
+
+  return [...deduped.values()];
+}
+
+async function collectStepBindingResolutions(options) {
+  const sourceText = await readFile(options.filePath, 'utf-8');
+  const sourceFile = parseSourceFile(options.filePath, sourceText);
+  const runCalleeNames = collectRunCalleeNames(sourceFile.program);
+  const exportNamesByLocalName = new Map();
+  const importResolutionsByLocalName = new Map();
+
+  for (const statement of sourceFile.statements) {
+    if (statement.type === 'ImportDeclaration') {
+      const moduleSpecifier = literalString(statement.source);
+      if (!moduleSpecifier) {
+        continue;
+      }
+      const importResolutions = await createImportResolutions({
+        filePath: options.filePath,
+        projectRoot: options.projectRoot,
+        moduleSpecifier,
+        statement,
+        runCalleeNames,
+      });
+
+      for (const [localName, resolution] of importResolutions.entries()) {
+        importResolutionsByLocalName.set(localName, resolution);
+      }
+      continue;
+    }
+
+    if (isExportedDeclaration(statement)) {
+      for (const localName of getDeclaredBindingNames(statement)) {
+        addExportName(exportNamesByLocalName, localName, localName);
+      }
+      continue;
+    }
+
+    if (statement.type === 'ExportDefaultDeclaration') {
+      const localName = identifierName(statement.declaration);
+      if (localName) {
+        addExportName(exportNamesByLocalName, localName, 'default');
+      }
+      continue;
+    }
+
+    if (
+      statement.type === 'ExportNamedDeclaration' &&
+      !statement.source &&
+      Array.isArray(statement.specifiers)
+    ) {
+      for (const element of statement.specifiers) {
+        if (!isNode(element) || element.type !== 'ExportSpecifier') {
+          continue;
+        }
+        const localName = identifierName(element.local);
+        const exportName = identifierName(element.exported);
+        if (localName && exportName) {
+          addExportName(exportNamesByLocalName, localName, exportName);
+        }
+      }
+    }
+  }
+
+  const resolutions = new Map();
+  for (const [localName, resolution] of importResolutionsByLocalName.entries()) {
+    resolutions.set(localName, resolution);
+  }
+
+  for (const [localName, exportNames] of exportNamesByLocalName.entries()) {
+    if (exportNames.size !== 1) {
+      continue;
+    }
+
+    const exportName = [...exportNames][0];
+    if (!exportName) {
+      continue;
+    }
+
+    const existing = resolutions.get(localName);
+    if (existing?.importSource) {
+      resolutions.set(localName, { ...existing, exportName });
+      continue;
+    }
+
+    resolutions.set(localName, { exportName });
+  }
+
+  return resolutions;
+}
+
+async function createImportResolutions(options) {
+  const resolutions = new Map();
+  const resolvedPath = options.moduleSpecifier.startsWith('.')
+    ? await resolveLocalModulePath(options.filePath, options.moduleSpecifier)
+    : null;
+  const importSourceBase = {
+    kind: options.moduleSpecifier.startsWith('.') ? 'local' : 'module-import',
+    moduleSpecifier: options.moduleSpecifier,
+    ...(resolvedPath
+      ? { resolvedPath: toRelativeFilePath(options.projectRoot, resolvedPath) }
+      : {}),
+  };
+
+  for (const specifier of Array.isArray(options.statement.specifiers)
+    ? options.statement.specifiers
+    : []) {
+    if (!isNode(specifier)) {
+      continue;
+    }
+
+    if (specifier.type === 'ImportDefaultSpecifier') {
+      const localName = identifierName(specifier.local);
+      if (!localName) {
+        continue;
+      }
+      if (!options.runCalleeNames.has(localName)) {
+        continue;
+      }
+      resolutions.set(localName, await enrichImportResolution({
+        exportName: 'default',
+        importSource: {
+          ...importSourceBase,
+          importName: 'default',
+          localName,
+        },
+        resolvedPath,
+      }));
+      continue;
+    }
+
+    if (specifier.type === 'ImportSpecifier') {
+      const localName = identifierName(specifier.local);
+      const importName = identifierName(specifier.imported);
+      if (!localName || !importName) {
+        continue;
+      }
+      if (!options.runCalleeNames.has(localName)) {
+        continue;
+      }
+      resolutions.set(localName, await enrichImportResolution({
+        exportName: importName,
+        importSource: {
+          ...importSourceBase,
+          importName,
+          localName,
+        },
+        resolvedPath,
+      }));
+      continue;
+    }
+
+    if (specifier.type === 'ImportNamespaceSpecifier') {
+      const localName = identifierName(specifier.local);
+      if (!localName) {
+        continue;
+      }
+      if (!options.runCalleeNames.has(localName)) {
+        continue;
+      }
+      resolutions.set(localName, await enrichImportResolution({
+        exportName: localName,
+        importSource: {
+          ...importSourceBase,
+          kind: 'namespace-import',
+          localName,
+        },
+        resolvedPath,
+      }));
+    }
+  }
+
+  return resolutions;
+}
+
+async function enrichImportResolution(resolution) {
+  const importSource = resolution.importSource;
+  const fallback = {
+    ...resolution,
+    callKind: inferCallKindFromPath(resolution.resolvedPath),
+    displayName: resolution.exportName,
+  };
+  if (!importSource?.importName || !resolution.resolvedPath) {
+    return fallback;
+  }
+
+  try {
+    const moduleUrl = pathToFileURL(resolution.resolvedPath).href;
+    const cacheKey = moduleUrl + '#' + importSource.importName;
+    if (staticFlowResolutionCache.has(cacheKey)) {
+      return staticFlowResolutionCache.get(cacheKey) ?? fallback;
+    }
+
+    const mod = await importCachedModule(moduleUrl);
+    const instance = mod[importSource.importName];
+    if (!instance || typeof instance.toManifest !== 'function') {
+      if (isLocalTypedPrimitiveImport(resolution)) {
+        throw new Error(
+          'Could not resolve typed primitive export "' + importSource.importName + '" from ' + resolution.resolvedPath
+        );
+      }
+      staticFlowResolutionCache.set(cacheKey, null);
+      return fallback;
+    }
+
+    const manifest = compactManifestForFlowGraph(instance.toManifest());
+    const credentialRequirements =
+      typeof instance.getCredentialRequirements === 'function' ? instance.getCredentialRequirements() : [];
+    const inputSchema = getInputSchema(manifest);
+    const outputSchema = getOutputSchema(manifest);
+    const nestedRunSource =
+      typeof instance.getRunFunctionSource === 'function' ? instance.getRunFunctionSource() : undefined;
+
+    const enriched = {
+      ...resolution,
+      callKind: inferCallKindFromPath(resolution.resolvedPath, manifest),
+      displayName: manifest.name ?? instance.name ?? resolution.exportName,
+      description: manifest.description ?? instance.description,
+      manifest,
+      ...(inputSchema ? { inputSchema } : {}),
+      ...(outputSchema ? { outputSchema } : {}),
+      ...(Array.isArray(manifest.requiredOAuthScopes) && manifest.requiredOAuthScopes.length > 0
+        ? { requiredOAuthScopes: manifest.requiredOAuthScopes }
+        : {}),
+      ...(Array.isArray(credentialRequirements) && credentialRequirements.length > 0
+        ? { credentialSets: credentialRequirements.map(credentialRequirementToFlowGraphEntry) }
+        : Array.isArray(manifest.credentialSets) && manifest.credentialSets.length > 0
+          ? { credentialSets: manifest.credentialSets.map(manifestCredentialSetToFlowGraphEntry) }
+          : {}),
+      ...(nestedRunSource ? { nestedRunSource } : {}),
+    };
+    staticFlowResolutionCache.set(cacheKey, enriched);
+    return enriched;
+  } catch (error) {
+    if (isLocalTypedPrimitiveImport(resolution)) {
+      throw error;
+    }
+    return fallback;
+  }
+}
+
+function importCachedModule(moduleUrl) {
+  const cached = staticFlowModuleCache.get(moduleUrl);
+  if (cached) {
+    return cached;
+  }
+  const promise = import(moduleUrl);
+  staticFlowModuleCache.set(moduleUrl, promise);
+  return promise;
+}
+
+function compactManifestForFlowGraph(manifest) {
+  return {
+    ...(manifest.type ? { type: manifest.type } : {}),
+    ...(manifest.name ? { name: manifest.name } : {}),
+    ...(manifest.description ? { description: manifest.description } : {}),
+    ...(isJsonSchema(manifest.input) ? { input: manifest.input } : {}),
+    ...(isJsonSchema(manifest.output) ? { output: manifest.output } : {}),
+    ...(manifest.workflowSchemas
+      ? {
+          workflowSchemas: {
+            ...(isJsonSchema(manifest.workflowSchemas.input)
+              ? { input: manifest.workflowSchemas.input }
+              : {}),
+            ...(isJsonSchema(manifest.workflowSchemas.output)
+              ? { output: manifest.workflowSchemas.output }
+              : {}),
+          },
+        }
+      : {}),
+    ...(Array.isArray(manifest.requiredOAuthScopes) && manifest.requiredOAuthScopes.length > 0
+      ? { requiredOAuthScopes: [...manifest.requiredOAuthScopes] }
+      : {}),
+    ...(Array.isArray(manifest.credentialSets) && manifest.credentialSets.length > 0
+      ? { credentialSets: [...manifest.credentialSets] }
+      : {}),
+  };
+}
+
+function getInputSchema(manifest) {
+  const schema = manifest.workflowSchemas?.input ?? manifest.input;
+  return isJsonSchema(schema) ? schema : undefined;
+}
+
+function getOutputSchema(manifest) {
+  const schema = manifest.workflowSchemas?.output ?? manifest.output;
+  return isJsonSchema(schema) ? schema : undefined;
+}
+
+function isJsonSchema(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+function inferCallKindFromPath(filePath, manifest) {
+  if (!filePath) {
+    return manifest?.type === 'agent' ? 'agent' : 'workflow-step';
+  }
+  const lower = filePath.toLowerCase();
+  if (lower.endsWith('.agent.ts') || lower.endsWith('.agent.tsx') || lower.endsWith('.agent.mts') || manifest?.type === 'agent') {
+    return 'agent';
+  }
+  if (lower.endsWith('.workflow.ts') || lower.endsWith('.workflow.tsx') || lower.endsWith('.workflow.mts')) {
+    return 'child-workflow';
+  }
+  return 'workflow-step';
+}
+
+function collectRunCalleeNames(root) {
+  const names = new Set();
+  visitNode(root, (node) => {
+    if (node.type !== 'CallExpression' || !isNode(node.callee)) {
+      return;
+    }
+    const callee = node.callee;
+    if (callee.type !== 'MemberExpression') {
+      return;
+    }
+    if (identifierName(callee.property) !== 'run') {
+      return;
+    }
+    const objectName = identifierName(callee.object);
+    if (objectName) {
+      names.add(objectName);
+    }
+  });
+  return names;
+}
+
+function isLocalTypedPrimitiveImport(resolution) {
+  if (resolution.importSource?.kind !== 'local' || !resolution.resolvedPath) {
+    return false;
+  }
+  const lower = resolution.resolvedPath.toLowerCase();
+  return (
+    lower.endsWith('.step.ts') ||
+    lower.endsWith('.step.tsx') ||
+    lower.endsWith('.step.mts') ||
+    lower.endsWith('.operation.ts') ||
+    lower.endsWith('.operation.tsx') ||
+    lower.endsWith('.operation.mts') ||
+    lower.endsWith('.tool.ts') ||
+    lower.endsWith('.tool.tsx') ||
+    lower.endsWith('.tool.mts') ||
+    lower.endsWith('.agent.ts') ||
+    lower.endsWith('.agent.tsx') ||
+    lower.endsWith('.agent.mts') ||
+    lower.endsWith('.workflow.ts') ||
+    lower.endsWith('.workflow.tsx') ||
+    lower.endsWith('.workflow.mts')
+  );
+}
+
+function credentialRequirementToFlowGraphEntry(entry) {
+  return {
+    resolvedId: entry.resolvedCredentialSetId,
+    credentialKeys: [...(entry.credentialKeys ?? [])],
+    ...(entry.scope ? { scope: entry.scope } : {}),
+    ...(entry.alias ? { alias: entry.alias } : {}),
+    ...(entry.credentialRef ? { credentialRef: entry.credentialRef } : {}),
+    ...(Array.isArray(entry.optionalCredentialKeys) && entry.optionalCredentialKeys.length > 0
+      ? { optionalCredentialKeys: [...entry.optionalCredentialKeys] }
+      : {}),
+    ...(Array.isArray(entry.storedCredentialKeys) && entry.storedCredentialKeys.length > 0
+      ? { storedCredentialKeys: [...entry.storedCredentialKeys] }
+      : {}),
+    ...(Array.isArray(entry.optionalStoredCredentialKeys) && entry.optionalStoredCredentialKeys.length > 0
+      ? { optionalStoredCredentialKeys: [...entry.optionalStoredCredentialKeys] }
+      : {}),
+    ...(entry.proxy ? { proxy: entry.proxy } : {}),
+    ...(entry.needsRawSecret === true ? { needsRawSecret: true } : {}),
+    ...(entry.needsResolve === true ? { needsResolve: true } : {}),
+    ...(typeof entry.resolveCacheMs === 'number' && entry.resolveCacheMs > 0
+      ? { resolveCacheMs: entry.resolveCacheMs }
+      : {}),
+    ...(entry.onCredentialRevoked ? { onCredentialRevoked: entry.onCredentialRevoked } : {}),
+    ...(entry.schemaFingerprint ? { schemaFingerprint: entry.schemaFingerprint } : {}),
+  };
+}
+
+function manifestCredentialSetToFlowGraphEntry(entry) {
+  return {
+    resolvedId: entry.resolvedCredentialSetId,
+    credentialKeys: Array.isArray(entry.credentialKeys)
+      ? [...entry.credentialKeys]
+      : Object.keys(entry.auth?.properties ?? {}),
+    ...(entry.scope ? { scope: entry.scope } : {}),
+    ...(entry.alias ? { alias: entry.alias } : {}),
+    ...(entry.credentialRef ? { credentialRef: entry.credentialRef } : {}),
+    ...(Array.isArray(entry.optionalCredentialKeys) && entry.optionalCredentialKeys.length > 0
+      ? { optionalCredentialKeys: [...entry.optionalCredentialKeys] }
+      : {}),
+    ...(Array.isArray(entry.storedCredentialKeys) && entry.storedCredentialKeys.length > 0
+      ? { storedCredentialKeys: [...entry.storedCredentialKeys] }
+      : Object.keys(entry.stored?.properties ?? {}).length > 0
+        ? { storedCredentialKeys: Object.keys(entry.stored?.properties ?? {}) }
+        : {}),
+    ...(Array.isArray(entry.optionalStoredCredentialKeys) && entry.optionalStoredCredentialKeys.length > 0
+      ? { optionalStoredCredentialKeys: [...entry.optionalStoredCredentialKeys] }
+      : {}),
+    ...(entry.proxy ? { proxy: entry.proxy } : {}),
+    ...(entry.needsRawSecret === true ? { needsRawSecret: true } : {}),
+    ...(entry.needsResolve === true ? { needsResolve: true } : {}),
+    ...(typeof entry.resolveCacheMs === 'number' && entry.resolveCacheMs > 0
+      ? { resolveCacheMs: entry.resolveCacheMs }
+      : {}),
+    ...(entry.onCredentialRevoked ? { onCredentialRevoked: entry.onCredentialRevoked } : {}),
+    ...(entry.schemaFingerprint ? { schemaFingerprint: entry.schemaFingerprint } : {}),
+  };
+}
+
+function parseSourceFile(filePath, sourceText) {
+  const result = parseSync(filePath, sourceText, {
+    lang: filePath.endsWith('.tsx') ? 'tsx' : 'ts',
+    sourceType: 'module',
+    astType: 'ts',
+    preserveParens: true,
+  });
+  if (result.errors.length > 0) {
+    throw new Error('Failed to parse ' + filePath + ': ' + result.errors.map((error) => error.message).join('; '));
+  }
+  return {
+    program: result.program,
+    statements: result.program.body,
+  };
+}
+
+function visitNode(value, visitor) {
+  if (!isNode(value)) {
+    return;
+  }
+  visitor(value);
+  for (const child of Object.values(value)) {
+    if (Array.isArray(child)) {
+      for (const item of child) {
+        visitNode(item, visitor);
+      }
+      continue;
+    }
+    visitNode(child, visitor);
+  }
+}
+
+function isNode(value) {
+  return value && typeof value === 'object' && typeof value.type === 'string';
+}
+
+function identifierName(node) {
+  return isNode(node) && node.type === 'Identifier' && typeof node.name === 'string'
+    ? node.name
+    : undefined;
+}
+
+function literalString(node) {
+  return isNode(node) && node.type === 'Literal' && typeof node.value === 'string'
+    ? node.value
+    : undefined;
+}
+
+function isExportedDeclaration(statement) {
+  return (
+    statement.type === 'ExportNamedDeclaration' &&
+    isNode(statement.declaration) &&
+    ['VariableDeclaration', 'FunctionDeclaration', 'ClassDeclaration'].includes(statement.declaration.type)
+  );
+}
+
+function getVariableDeclarators(statement) {
+  const declaration =
+    statement.type === 'VariableDeclaration'
+      ? statement
+      : statement.type === 'ExportNamedDeclaration' && isNode(statement.declaration)
+        ? statement.declaration
+        : null;
+  if (!declaration || declaration.type !== 'VariableDeclaration') {
+    return [];
+  }
+  return Array.isArray(declaration.declarations)
+    ? declaration.declarations.filter((node) => isNode(node))
+    : [];
+}
+
+function getDeclaredBindingNames(statement) {
+  const declaration =
+    statement.type === 'ExportNamedDeclaration' && isNode(statement.declaration)
+      ? statement.declaration
+      : statement;
+
+  if (declaration.type === 'VariableDeclaration') {
+    return getVariableDeclarators(declaration)
+      .map((variable) => identifierName(variable.id))
+      .filter((name) => typeof name === 'string');
+  }
+
+  const name = identifierName(declaration.id);
+  return name ? [name] : [];
+}
+
+function addExportName(exportNamesByLocalName, localName, exportName) {
+  const exportNames = exportNamesByLocalName.get(localName) ?? new Set();
+  exportNames.add(exportName);
+  exportNamesByLocalName.set(localName, exportNames);
+}
+
+async function resolveStepCredentialsFromImports(flowGraph) {
+  for (const node of flowGraph.nodes) {
+    if (node.type !== 'step' || node.data.kind !== 'call') continue;
+    const importSource = node.data.importSource;
+    if (!importSource?.moduleSpecifier || !importSource?.importName) continue;
+
+    try {
+      const moduleUrl =
+        importSource.kind === 'local' && importSource.resolvedPath
+          ? pathToFileURL(path.resolve(process.cwd(), importSource.resolvedPath)).href
+          : importSource.moduleSpecifier;
+      const mod = await import(moduleUrl);
+      const instance = mod[importSource.importName];
+      if (!instance || typeof instance.getCredentialRequirements !== 'function') continue;
+
+      const reqs = instance.getCredentialRequirements();
+      if (Array.isArray(reqs) && reqs.length > 0) {
+        node.data.credentialSets = reqs.map((r) => ({
+          resolvedId: r.resolvedCredentialSetId,
+          credentialKeys: r.credentialKeys,
+          ...(Array.isArray(r.optionalCredentialKeys) && r.optionalCredentialKeys.length > 0
+            ? { optionalCredentialKeys: r.optionalCredentialKeys }
+            : {}),
+          ...(Array.isArray(r.storedCredentialKeys) && r.storedCredentialKeys.length > 0
+            ? { storedCredentialKeys: r.storedCredentialKeys }
+            : {}),
+          ...(Array.isArray(r.optionalStoredCredentialKeys) &&
+          r.optionalStoredCredentialKeys.length > 0
+            ? { optionalStoredCredentialKeys: r.optionalStoredCredentialKeys }
+            : {}),
+          ...(r.proxy ? { proxy: r.proxy } : {}),
+          ...(r.needsRawSecret === true ? { needsRawSecret: true } : {}),
+          ...(r.needsResolve === true ? { needsResolve: true } : {}),
+          ...(typeof r.resolveCacheMs === 'number' && r.resolveCacheMs > 0
+            ? { resolveCacheMs: r.resolveCacheMs }
+            : {}),
+          ...(r.onCredentialRevoked ? { onCredentialRevoked: r.onCredentialRevoked } : {}),
+          ...(r.schemaFingerprint ? { schemaFingerprint: r.schemaFingerprint } : {}),
+        }));
+      }
+    } catch {
+      // Module not resolvable — leave without credentials.
+    }
+  }
+}
+
+function discoverCredentialsByBindingName(mod) {
+  const result = {};
+
+  for (const [exportName, value] of Object.entries(mod)) {
+    if (value instanceof Step) {
+      const entries = getCredentialRequirements(value);
+      if (entries.length > 0) {
+        result[exportName] = entries;
+        if (value.name !== exportName) {
+          result[value.name] = entries;
+        }
+      }
+      continue;
+    }
+    if (value instanceof Agent) {
+      const entries = getCredentialRequirements(value);
+      if (entries.length > 0) {
+        result[exportName] = entries;
+        if (value.name !== exportName) {
+          result[value.name] = entries;
+        }
+      }
+      continue;
+    }
+  }
+  return result;
+}
+
+async function loadSiblingTriggerModules(workflowFilePath) {
+  const dir = dirname(workflowFilePath);
+  const results = [];
+  try {
+    const files = readdirSync(dir);
+    for (const file of files) {
+      if (file.endsWith('.trigger.ts') || file.endsWith('.trigger.js')) {
+        const fullPath = join(dir, file);
+        if (fullPath === workflowFilePath) continue;
+        try {
+          const mod = await import(pathToFileURL(fullPath).href);
+          results.push({ filePath: fullPath, exports: mod });
+        } catch {
+          // skip files that fail to import
+        }
+      }
+    }
+  } catch {
+    // skip if directory read fails
+  }
+  return results;
+}
+
+function isTriggerLike(value) {
+  return value != null && (typeof value === 'object' || typeof value === 'function')
+    && typeof value.toManifest === 'function' && typeof value.name === 'string';
+}
+
+function isBoundTriggerLike(value) {
+  return value != null && (typeof value === 'object' || typeof value === 'function')
+    && value.isBoundTrigger === true && value.trigger != null
+    && typeof value.trigger.toManifest === 'function' && typeof value.trigger.name === 'string';
+}
+
+function getTriggerCandidate(value) {
+  if (isTriggerLike(value)) {
+    return value;
+  }
+  if (isBoundTriggerLike(value)) {
+    return value.trigger;
+  }
+  return null;
+}
+
+
+function describeTriggerEntry(entry) {
+  if (entry && typeof entry === 'object') {
+    if ('isBoundTrigger' in entry && entry.isBoundTrigger === true && entry.trigger) {
+      return entry.trigger.name ?? '<unknown trigger>';
+    }
+    if ('name' in entry && typeof entry.name === 'string') {
+      return entry.name;
+    }
+  }
+  return '<unknown trigger>';
+}
+
+function findTriggerSource(entry, trigger, workflowMod, workflowFilePath, siblingModules) {
+  const triggerName = trigger.name;
+  // First, check if the trigger is re-exported from the workflow module (identity check)
+  for (const [name, exp] of Object.entries(workflowMod)) {
+    const candidate = getTriggerCandidate(exp);
+    if (exp === entry || exp === trigger || candidate === trigger) {
+      return { triggerExportName: name, sourceFilePath: workflowFilePath };
+    }
+  }
+
+  const siblingMatches = [];
+  for (const { filePath, exports: triggerMod } of siblingModules) {
+    for (const [name, exp] of Object.entries(triggerMod)) {
+      const candidate = getTriggerCandidate(exp);
+      if (exp === entry || exp === trigger || candidate === trigger || candidate?.name === triggerName) {
+        siblingMatches.push({ triggerExportName: name, sourceFilePath: filePath });
+        continue;
+      }
+
+      if (isBoundTriggerLike(exp) && exp.trigger.name === triggerName) {
+        siblingMatches.push({ triggerExportName: name, sourceFilePath: filePath });
+      }
+    }
+  }
+
+  if (siblingMatches.length > 1) {
+    const matchList = siblingMatches
+      .map((match) => String(match.triggerExportName) + ' (' + String(match.sourceFilePath) + ')')
+      .join(', ');
+    throw new Error(
+      'Ambiguous trigger source for "' + triggerName + '" in ' + workflowFilePath + '. Matching sibling exports: ' + matchList
+    );
+  }
+
+  if (siblingMatches.length === 1) {
+    return siblingMatches[0];
+  }
+
+  return { triggerExportName: undefined, sourceFilePath: workflowFilePath };
+}
+
+async function discoverTriggers(workflow, mod, workflowFilePath) {
+  const triggers = [];
+  const triggerEntries = workflow.triggers ?? [];
+  if (triggerEntries.length === 0) return triggers;
+
+  const siblingModules = await loadSiblingTriggerModules(workflowFilePath);
+
+  for (let triggerIndex = 0; triggerIndex < triggerEntries.length; triggerIndex++) {
+    const entry = triggerEntries[triggerIndex];
+    try {
+      const isBound = 'isBoundTrigger' in entry && entry.isBoundTrigger === true;
+      const trigger = isBound ? entry.trigger : entry;
+      const triggerManifest = trigger.toManifest();
+      const hasTransform = isBound && typeof entry.transform === 'function';
+      const hasFilter = isBound ? typeof entry.filter === 'function' : typeof trigger.filter === 'function';
+      const { triggerExportName, sourceFilePath } = findTriggerSource(entry, trigger, mod, workflowFilePath, siblingModules);
+      // For cron triggers, capture the static payload for runtime use
+      const staticPayload = triggerManifest.triggerType === 'cron' && 'payload' in trigger
+        ? trigger.payload
+        : undefined;
+      triggers.push({ triggerManifest, triggerExportName, sourceFilePath, hasTransform, hasFilter, staticPayload, triggerIndex });
+    } catch (error) {
+      const triggerName = describeTriggerEntry(entry);
+      const message = serializeError(error);
+      throw new Error(
+        'Failed to discover trigger "' + triggerName + '" for workflow "' + workflow.name + '": ' + message
+      );
+    }
+  }
+  return triggers;
+}
+
+async function loadOne(input) {
+  const importStartedAt = performance.now();
+  const moduleUrl = pathToFileURL(input.resolvedFilePath);
+  moduleUrl.searchParams.set('keystrokeLoader', input.cacheKey);
+
+  let importedModule;
+  try {
+    importedModule = await import(moduleUrl.href);
+  } catch (error) {
+    await emitError(input.bindingKey, 'import', error);
+    return;
+  }
+  const importMs = performance.now() - importStartedAt;
+
+
+
+  const resolvedBinding =
+    input.localExportName === 'default'
+      ? importedModule.default
+      : importedModule[input.localExportName];
+
+  if (resolvedBinding instanceof Agent) {
+    const manifestStartedAt = performance.now();
+    let manifest;
+    let toolEnrichments;
+    try {
+      manifest = resolvedBinding.toManifest();
+      toolEnrichments = await computeAgentToolEnrichments(resolvedBinding);
+    } catch (error) {
+      await emitError(input.bindingKey, 'manifest', error);
+      return;
+    }
+    const manifestMs = performance.now() - manifestStartedAt;
+
+    await writeJson({
+      bindingKey: input.bindingKey,
+      status: 'success',
+      isAgent: true,
+      manifest,
+      toolEnrichments,
+      timing: { importMs, manifestMs },
+    });
+    return;
+  }
+
+  if (resolvedBinding instanceof Task) {
+    const manifestStartedAt = performance.now();
+    let manifest;
+    try {
+      manifest = resolvedBinding.toManifest();
+    } catch (error) {
+      await emitError(input.bindingKey, 'manifest', error);
+      return;
+    }
+    const manifestMs = performance.now() - manifestStartedAt;
+
+    let triggers;
+    try {
+      triggers = await discoverTriggers(resolvedBinding, importedModule, input.resolvedFilePath);
+    } catch (error) {
+      await emitError(input.bindingKey, 'import', error);
+      return;
+    }
+
+    await writeJson({
+      bindingKey: input.bindingKey,
+      status: 'success',
+      isTask: true,
+      manifest,
+      triggers,
+      timing: { importMs, manifestMs },
+    });
+    return;
+  }
+
+  if (!(resolvedBinding instanceof Workflow)) {
+    await emitError(
+      input.bindingKey,
+      'import',
+      \`Discovered binding \${input.bindingKey} did not resolve to a Workflow, Agent, or Task instance\`
+    );
+    return;
+  }
+
+  const manifestStartedAt = performance.now();
+  let manifest;
+  try {
+    manifest = resolvedBinding.toManifest();
+  } catch (error) {
+    await emitError(input.bindingKey, 'manifest', error);
+    return;
+  }
+  const manifestMs = performance.now() - manifestStartedAt;
+
+  const flowGraphStartedAt = performance.now();
+  let flowGraph;
+  try {
+    const resolveCandidate = await createStaticFlowResolver({
+      filePath: input.resolvedFilePath,
+      projectRoot: process.cwd(),
+    });
+    flowGraph = await resolvedBinding.toFlowGraph({ resolveCandidate });
+  } catch (error) {
+    await emitError(input.bindingKey, 'flow-graph', error);
+    return;
+  }
+  const flowGraphMs = performance.now() - flowGraphStartedAt;
+
+  let triggers;
+  try {
+    triggers = await discoverTriggers(resolvedBinding, importedModule, input.resolvedFilePath);
+  } catch (error) {
+    await emitError(input.bindingKey, 'import', error);
+    return;
+  }
+  const attribution = await buildLoaderCredentialAttribution({
+    flowGraph,
+    filePath: input.resolvedFilePath,
+    projectRoot: process.cwd(),
+    credentialsByBindingName: discoverCredentialsByBindingName(importedModule),
+  });
+  await resolveStepCredentialsFromImports(attribution.flowGraph);
+
+  await writeJson({
+    bindingKey: input.bindingKey,
+    status: 'success',
+    manifest,
+    flowGraph: attribution.flowGraph,
+    triggers,
+    credentialsByCallsiteFingerprint: attribution.credentialsByCallsiteFingerprint,
+    credentialAttributionWarnings: attribution.credentialAttributionWarnings,
+    timing: {
+      importMs,
+      manifestMs,
+      flowGraphMs,
+    },
+  });
+}
+
+async function main() {
+  if (!encodedInput) {
+    await emitError('', 'import', 'Missing KEYSTROKE_WORKFLOW_LOADER_INPUT');
+    return;
+  }
+
+  try {
+    const payload = JSON.parse(Buffer.from(encodedInput, 'base64').toString('utf-8'));
+    const inputs = Array.isArray(payload) ? payload : [payload];
+    for (const input of inputs) {
+      try {
+        await loadOne(input);
+      } catch (error) {
+        await emitError(input.bindingKey ?? '', 'import', error);
+      }
+    }
+  } catch (error) {
+    await emitError('', 'import', error);
+  }
+}
+
+await main();
+// Importing integration packages (discoverIntegrationCredentials) can leave HTTP keep-alive
+// handles open; without an explicit exit, the subprocess would stay alive and execFile never returns.
+process.exit(0);
+`;
+}
+const execFileAsync = promisify(execFile);
+const TSX_IMPORT_PATH = pathToFileURL(createRequire(import.meta.url).resolve("tsx")).href;
+function resolveNodeBinary() {
+	const nodePath = process.env.KEYSTROKE_NODE_PATH;
+	if (nodePath) return nodePath;
+	if (path$1.basename(process.execPath) === "node") return process.execPath;
+	return "node";
+}
+function extractFirstLine(text) {
+	const line = text.split("\n")[0]?.trim() ?? text.trim();
+	return line.length > 200 ? `${line.slice(0, 200)}…` : line;
+}
+const LoadedTriggerManifestSchema = z.union([
+	cronTriggerManifestSchema,
+	pollingTriggerManifestSchema,
+	webhookTriggerManifestSchema
+]);
+const LoadedWorkflowTriggerSchema = z.object({
+	triggerManifest: LoadedTriggerManifestSchema,
+	triggerExportName: z.string().optional(),
+	sourceFilePath: z.string().optional(),
+	hasTransform: z.boolean(),
+	hasFilter: z.boolean(),
+	staticPayload: z.unknown().optional(),
+	triggerIndex: z.number()
+});
+const LoaderTimingSchema = z.object({
+	importMs: z.number(),
+	manifestMs: z.number(),
+	flowGraphMs: z.number()
+});
+const DeclaredCredentialEntrySchema = DeclaredCredentialRequirementSchema;
+const CredentialsByCallsiteFingerprintSchema = z.record(z.string(), z.array(DeclaredCredentialEntrySchema));
+const CredentialAttributionWarningSchema = z.object({
+	category: z.literal("unmatched-callsite"),
+	bindingName: z.string(),
+	credentialSetIds: z.array(z.string())
+});
+const LoaderSuccessSchema = z.object({
+	status: z.literal("success"),
+	manifest: z.unknown(),
+	flowGraph: FlowGraphSchema,
+	triggers: z.array(LoadedWorkflowTriggerSchema).optional().default([]),
+	credentialsByCallsiteFingerprint: CredentialsByCallsiteFingerprintSchema.optional().default({}),
+	credentialAttributionWarnings: z.array(CredentialAttributionWarningSchema).optional().default([]),
+	timing: LoaderTimingSchema
+});
+const LoaderFailureSchema = z.object({
+	status: z.literal("error"),
+	phase: z.enum([
+		"import",
+		"manifest",
+		"flow-graph"
+	]),
+	error: z.string().min(1)
+});
+const AgentToolSuspensionReasonSchema = z.object({
+	kind: z.enum([
+		"wait",
+		"hook",
+		"child-workflow-suspending",
+		"agent",
+		"long-step"
+	]),
+	location: z.unknown().optional(),
+	detail: z.string(),
+	stepId: z.string().optional(),
+	hookName: z.string().optional(),
+	authoredWorkflowId: z.string().optional()
+});
+const AgentToolEnrichmentSchema = z.object({
+	invocation: z.enum(["sync", "yield"]).optional(),
+	suspensions: z.array(AgentToolSuspensionReasonSchema).optional(),
+	outputSchemaIsTabular: z.boolean().optional(),
+	dispatch: z.enum(["sandbox", "host"]).optional(),
+	/** Workflow tools: derived from analyzeWorkflowCredentials. Replaces operation-derived credentialSets when present. */
+	credentialSets: z.array(z.object({
+		id: z.string(),
+		required: z.boolean()
+	})).optional()
+});
+const LoaderAgentSuccessSchema = z.object({
+	status: z.literal("success"),
+	isAgent: z.literal(true),
+	manifest: AgentManifestSchema,
+	toolEnrichments: z.record(z.string(), AgentToolEnrichmentSchema).optional().default({}),
+	timing: z.object({
+		importMs: z.number(),
+		manifestMs: z.number()
+	})
+});
+const LoaderTaskSuccessSchema = z.object({
+	status: z.literal("success"),
+	isTask: z.literal(true),
+	manifest: z.unknown(),
+	triggers: z.array(LoadedWorkflowTriggerSchema).optional().default([]),
+	timing: z.object({
+		importMs: z.number(),
+		manifestMs: z.number()
+	})
+});
+const LoaderResultSchema = z.discriminatedUnion("status", [LoaderSuccessSchema, LoaderFailureSchema]);
+const WORKFLOW_LOADER_SCRIPT = createWorkflowLoaderScript();
+var WorkflowMetadataLoadError = class extends Error {
+	phase;
+	constructor(phase, message) {
+		super(message);
+		this.name = "WorkflowMetadataLoadError";
+		this.phase = phase;
+	}
+};
+var WorkflowLoaderProtocolError = class extends Error {
+	source;
+	rawOutput;
+	constructor(source, message, rawOutput) {
+		super(message);
+		this.name = "WorkflowLoaderProtocolError";
+		this.source = source;
+		this.rawOutput = rawOutput;
+	}
+};
+async function loadWorkflowMetadata(discoveredWorkflow) {
+	const projectRoot = await resolveLoaderProjectRoot(discoveredWorkflow.resolvedFilePath);
+	try {
+		const { stdout } = await execFileAsync(resolveNodeBinary(), [
+			"--import",
+			TSX_IMPORT_PATH,
+			"--input-type=module",
+			"--eval",
+			WORKFLOW_LOADER_SCRIPT
+		], {
+			cwd: projectRoot,
+			env: {
+				...process.env,
+				KEYSTROKE_WORKFLOW_LOADER_INPUT: Buffer.from(JSON.stringify({
+					bindingKey: discoveredWorkflow.bindingKey,
+					resolvedFilePath: discoveredWorkflow.resolvedFilePath,
+					localExportName: discoveredWorkflow.localExportName,
+					cacheKey: randomUUID()
+				})).toString("base64")
+			},
+			maxBuffer: 10 * 1024 * 1024
+		});
+		return parseLoaderOutput(stdout, discoveredWorkflow);
+	} catch (error) {
+		const failure = error;
+		const stdout = (failure.stdout ?? "").trim();
+		if (stdout.length > 0) return parseLoaderOutput(stdout, discoveredWorkflow);
+		const stderr = (failure.stderr ?? "").trim();
+		const exportLabel = discoveredWorkflow.localExportName;
+		if (stderr.length > 0) throw new WorkflowLoaderProtocolError("stderr", `Workflow loader crashed for export "${exportLabel}".`, stderr);
+		const rawMessage = (failure.message ?? "").trim();
+		throw new WorkflowLoaderProtocolError("process", rawMessage.length > 0 ? `Export "${exportLabel}" failed: ${extractFirstLine(rawMessage)}` : `Export "${exportLabel}" failed with no output.`, rawMessage || void 0);
+	}
+}
+function isAgentLoadResult(result) {
+	return result.ok && "agentMetadata" in result;
+}
+function isWorkflowLoadResult(result) {
+	return result.ok && "metadata" in result;
+}
+function isTaskLoadResult(result) {
+	return result.ok && "taskMetadata" in result;
+}
+async function loadWorkflowMetadataBatch(workflows, options) {
+	if (workflows.length === 0) return [];
+	if (workflows.length === 1 && workflows[0]) return [await loadSingleAsBatchResult(workflows[0])];
+	const byProjectRoot = /* @__PURE__ */ new Map();
+	for (const workflow of workflows) {
+		const projectRoot = await resolveLoaderProjectRoot(workflow.resolvedFilePath);
+		const group = byProjectRoot.get(projectRoot);
+		if (group) group.push(workflow);
+		else byProjectRoot.set(projectRoot, [workflow]);
+	}
+	return loadViaSubprocessShards(byProjectRoot, options?.concurrency);
+}
+async function loadViaSubprocessShards(byProjectRoot, concurrency) {
+	const shardCount = resolveWorkflowMetadataLoaderShardCount(Array.from(byProjectRoot.values()).reduce((total, group) => total + group.length, 0), concurrency);
+	const batches = [];
+	for (const [projectRoot, group] of byProjectRoot) {
+		const shardSize = Math.max(1, Math.ceil(group.length / shardCount));
+		for (let i = 0; i < group.length; i += shardSize) batches.push({
+			index: batches.length,
+			projectRoot,
+			workflows: group.slice(i, i + shardSize)
+		});
+	}
+	const batchResults = Array.from({ length: batches.length });
+	await runWithConcurrency(batches, shardCount, async (batch) => {
+		batchResults[batch.index] = await runBatchSubprocess(batch.projectRoot, batch.workflows);
+	});
+	const results = [];
+	for (const batch of batchResults) {
+		if (!batch) continue;
+		results.push(...batch);
+	}
+	return results;
+}
+function resolveWorkflowMetadataLoaderShardCount(workflowCount, concurrency) {
+	if (workflowCount <= 0) return 1;
+	if (concurrency !== void 0) {
+		if (!Number.isFinite(concurrency) || concurrency < 1) return 1;
+		return Math.min(Math.floor(concurrency), workflowCount);
+	}
+	return Math.min((os.availableParallelism?.() ?? os.cpus().length) || 4, 8, workflowCount);
+}
+async function loadSingleAsBatchResult(workflow) {
+	try {
+		const result = await loadWorkflowMetadata(workflow);
+		if ("flowGraph" in result) return {
+			ok: true,
+			bindingKey: workflow.bindingKey,
+			metadata: result
+		};
+		if ("manifest" in result && result.manifest.type === "task") return {
+			ok: true,
+			bindingKey: workflow.bindingKey,
+			taskMetadata: result
+		};
+		return {
+			ok: true,
+			bindingKey: workflow.bindingKey,
+			agentMetadata: result
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			bindingKey: workflow.bindingKey,
+			error: error instanceof Error ? error : new Error(String(error))
+		};
+	}
+}
+async function runBatchSubprocess(projectRoot, workflows) {
+	const workflowsByKey = /* @__PURE__ */ new Map();
+	const inputs = workflows.map((w) => {
+		workflowsByKey.set(w.bindingKey, w);
+		return {
+			bindingKey: w.bindingKey,
+			resolvedFilePath: w.resolvedFilePath,
+			localExportName: w.localExportName,
+			cacheKey: randomUUID()
+		};
+	});
+	let stdout = "";
+	let stderr = "";
+	try {
+		stdout = (await execFileAsync(resolveNodeBinary(), [
+			"--import",
+			TSX_IMPORT_PATH,
+			"--input-type=module",
+			"--eval",
+			WORKFLOW_LOADER_SCRIPT
+		], {
+			cwd: projectRoot,
+			env: {
+				...process.env,
+				KEYSTROKE_WORKFLOW_LOADER_INPUT: Buffer.from(JSON.stringify(inputs)).toString("base64")
+			},
+			maxBuffer: 50 * 1024 * 1024
+		})).stdout;
+	} catch (error) {
+		const failure = error;
+		stdout = (failure.stdout ?? "").trim();
+		stderr = (failure.stderr ?? "").trim();
+		if (stdout.length === 0 && stderr.length > 0) return workflows.map((w) => ({
+			ok: false,
+			bindingKey: w.bindingKey,
+			error: new WorkflowLoaderProtocolError("stderr", `Workflow loader crashed for batch.`, stderr)
+		}));
+		if (stdout.length === 0) {
+			const rawMessage = (failure.message ?? "").trim();
+			return workflows.map((w) => ({
+				ok: false,
+				bindingKey: w.bindingKey,
+				error: new WorkflowLoaderProtocolError("process", rawMessage.length > 0 ? `Batch loader failed: ${extractFirstLine(rawMessage)}` : "Batch loader failed with no output.", rawMessage || void 0)
+			}));
+		}
+	}
+	return parseBatchOutput(stdout, workflowsByKey);
+}
+function parseBatchOutput(output, workflowsByKey) {
+	const results = [];
+	const seenKeys = /* @__PURE__ */ new Set();
+	let searchStart = 0;
+	while (true) {
+		const sentinelIndex = output.indexOf(LOADER_SENTINEL, searchStart);
+		if (sentinelIndex === -1) break;
+		const envelopeStart = sentinelIndex + 31;
+		const newlineIndex = output.indexOf("\n", envelopeStart);
+		const envelopeStr = newlineIndex === -1 ? output.slice(envelopeStart).trim() : output.slice(envelopeStart, newlineIndex).trim();
+		searchStart = newlineIndex === -1 ? output.length : newlineIndex + 1;
+		let bindingKey = "";
+		try {
+			const parsedJson = JSON.parse(envelopeStr);
+			bindingKey = typeof parsedJson.bindingKey === "string" ? parsedJson.bindingKey : "";
+			seenKeys.add(bindingKey);
+			const workflow = workflowsByKey.get(bindingKey);
+			if (!workflow) continue;
+			if (parsedJson.isAgent === true) {
+				const agentResult = LoaderAgentSuccessSchema.parse(parsedJson);
+				results.push({
+					ok: true,
+					bindingKey,
+					agentMetadata: {
+						manifest: agentResult.manifest,
+						toolEnrichments: agentResult.toolEnrichments,
+						timing: agentResult.timing
+					}
+				});
+				continue;
+			}
+			if (parsedJson.isTask === true) {
+				const taskResult = LoaderTaskSuccessSchema.parse(parsedJson);
+				results.push({
+					ok: true,
+					bindingKey,
+					taskMetadata: {
+						manifest: taskResult.manifest,
+						triggers: taskResult.triggers.map((t) => ({
+							...t,
+							sourceFilePath: t.sourceFilePath || workflow.resolvedFilePath
+						})),
+						timing: taskResult.timing
+					}
+				});
+				continue;
+			}
+			const parsedResult = LoaderResultSchema.parse(parsedJson);
+			if (parsedResult.status === "error") {
+				results.push({
+					ok: false,
+					bindingKey,
+					error: new WorkflowMetadataLoadError(parsedResult.phase, parsedResult.error)
+				});
+				continue;
+			}
+			const workflowResult = parsedResult;
+			const manifest = normalizeWorkflowManifest(workflowResult.manifest, workflow);
+			results.push({
+				ok: true,
+				bindingKey,
+				metadata: {
+					manifest,
+					flowGraph: workflowResult.flowGraph,
+					triggers: workflowResult.triggers.map((t) => ({
+						...t,
+						sourceFilePath: t.sourceFilePath || workflow.resolvedFilePath
+					})),
+					credentialsByCallsiteFingerprint: workflowResult.credentialsByCallsiteFingerprint,
+					credentialAttributionWarnings: workflowResult.credentialAttributionWarnings,
+					timing: workflowResult.timing
+				}
+			});
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			results.push({
+				ok: false,
+				bindingKey,
+				error: new WorkflowLoaderProtocolError("stdout", `Invalid batch loader response: ${message}`, envelopeStr)
+			});
+		}
+	}
+	for (const [bindingKey] of workflowsByKey) if (!seenKeys.has(bindingKey)) results.push({
+		ok: false,
+		bindingKey,
+		error: new WorkflowLoaderProtocolError("process", `No response received for "${bindingKey}" from batch loader.`, void 0)
+	});
+	return results;
+}
+async function resolveLoaderProjectRoot(filePath) {
+	try {
+		return await findProjectRoot(path$1.dirname(filePath)) ?? path$1.dirname(filePath);
+	} catch {
+		return path$1.dirname(filePath);
+	}
+}
+function parseLoaderOutput(output, discoveredWorkflow) {
+	try {
+		const sentinelIndex = output.lastIndexOf(LOADER_SENTINEL);
+		if (sentinelIndex === -1) throw new WorkflowLoaderProtocolError("stdout", "Workflow loader did not emit the expected structured response sentinel.", output);
+		const envelope = output.slice(sentinelIndex + 31).trim();
+		const parsedJson = JSON.parse(envelope);
+		if (parsedJson.isAgent === true) {
+			const agentResult = LoaderAgentSuccessSchema.parse(parsedJson);
+			return {
+				manifest: agentResult.manifest,
+				toolEnrichments: agentResult.toolEnrichments,
+				timing: agentResult.timing
+			};
+		}
+		if (parsedJson.isTask === true) {
+			const taskResult = LoaderTaskSuccessSchema.parse(parsedJson);
+			return {
+				manifest: taskResult.manifest,
+				triggers: taskResult.triggers.map((t) => ({
+					...t,
+					sourceFilePath: t.sourceFilePath || discoveredWorkflow.resolvedFilePath
+				})),
+				timing: taskResult.timing
+			};
+		}
+		const parsedResult = LoaderResultSchema.parse(parsedJson);
+		if (parsedResult.status === "error") throw new WorkflowMetadataLoadError(parsedResult.phase, parsedResult.error);
+		const workflowResult = parsedResult;
+		return {
+			manifest: normalizeWorkflowManifest(workflowResult.manifest, discoveredWorkflow),
+			flowGraph: workflowResult.flowGraph,
+			triggers: workflowResult.triggers.map((t) => ({
+				...t,
+				sourceFilePath: t.sourceFilePath || discoveredWorkflow.resolvedFilePath
+			})),
+			credentialsByCallsiteFingerprint: workflowResult.credentialsByCallsiteFingerprint,
+			credentialAttributionWarnings: workflowResult.credentialAttributionWarnings,
+			timing: workflowResult.timing
+		};
+	} catch (error) {
+		if (error instanceof WorkflowMetadataLoadError || error instanceof WorkflowLoaderProtocolError) throw error;
+		throw new WorkflowLoaderProtocolError("stdout", `Invalid workflow loader response: ${error instanceof Error ? error.message : String(error)}`, output);
+	}
+}
+function normalizeWorkflowManifest(manifest, discoveredWorkflow) {
+	const parsedManifest = WorkflowCoreManifestSchema.parse(manifest);
+	return WorkflowCoreManifestSchema.parse({
+		...parsedManifest,
+		schemaVersion: WORKFLOW_MANIFEST_SCHEMA_VERSION,
+		exportName: parsedManifest.exportName ?? discoveredWorkflow.exportName,
+		buildInfo: parsedManifest.buildInfo ?? {
+			timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+			builderVersion: "workflow-builder",
+			generatedBy: "local-build",
+			nodeVersion: process.version,
+			platform: process.platform,
+			sourceChecksumAlgorithm: "sha256",
+			sourceChecksum: "0".repeat(64),
+			generatedFiles: []
+		}
+	});
+}
+//#endregion
+export { createDiscoveryFailure as a, createNamespaceStarExportDiscoveryError as c, isWorkflowLoadResult as d, loadWorkflowMetadataBatch as f, createAmbiguousExportDiscoveryError as i, isAgentLoadResult as l, WorkflowLoaderProtocolError as n, createDuplicateWorkflowIdFailure as o, WorkflowMetadataLoadError as r, createLoaderProtocolFailure as s, DuplicateWorkflowIdError as t, isTaskLoadResult as u };