@keystrokehq/cli 0.0.1

package/dist/_manifest-JSRE3H8k.mjs

@@ -0,0 +1,385 @@
+#!/usr/bin/env node
+
+import { F as schemaToJsonSchema, S as SourceLocationSchema, V as SHA256HashSchema, a as CredentialRequirementsSchema, c as IntegrationScopeSchema, f as TriggerTypeSchema, h as WorkflowStepEntrySchema, l as ResolvedCredentialSetSchema, p as TriggerUploadDataSchema, t as DurationSchema, v as CallKindSchema, x as ImportSourceSchema, y as CallsiteFingerprintSchema, z as JsonSchemaSchema } from "./schedule-BXx3uXwr.mjs";
+import { z } from "zod";
+import { createHash } from "node:crypto";
+//#region ../../packages/workflow-core/src/artifacts/flow-graph-schema.ts
+const DecisionKindSchema = z.enum([
+	"if",
+	"switch",
+	"ternary"
+]);
+const ParallelKindSchema = z.enum([
+	"all",
+	"race",
+	"allSettled",
+	"any"
+]);
+const LoopKindSchema = z.enum([
+	"for",
+	"for-of",
+	"for-in",
+	"while",
+	"do-while"
+]);
+const ExitKindSchema = z.enum(["return", "throw"]);
+const FlowBranchKindSchema = z.enum([
+	"then",
+	"else",
+	"parallel-branch"
+]);
+const FlowNodeTypeSchema = z.enum([
+	"entry",
+	"step",
+	"code-block",
+	"decision",
+	"merge",
+	"fork",
+	"join",
+	"parallel-map",
+	"loop",
+	"exit"
+]);
+const FlowEdgeTypeSchema = z.enum([
+	"default",
+	"true-branch",
+	"false-branch",
+	"merge",
+	"loop-entry",
+	"loop-back",
+	"parallel",
+	"return"
+]);
+const FlowStatementSchema = z.object({
+	kind: z.string().min(1),
+	label: z.string().min(1),
+	sourceText: z.string().min(1)
+});
+const EntryNodeDataSchema = z.object({ kind: z.literal("entry") });
+const StepNodeDataSchema = z.object({
+	kind: z.literal("call"),
+	callKind: CallKindSchema,
+	stepName: z.string().min(1),
+	callsiteFingerprint: CallsiteFingerprintSchema.optional(),
+	exportName: z.string().min(1).optional(),
+	stepId: z.string().min(1).optional(),
+	awaited: z.boolean().optional(),
+	dynamic: z.boolean().optional(),
+	recursive: z.boolean().optional(),
+	importSource: ImportSourceSchema.optional(),
+	outputBinding: z.string().min(1).optional(),
+	description: z.string().optional(),
+	inputSchema: JsonSchemaSchema.optional(),
+	outputSchema: JsonSchemaSchema.optional(),
+	source: SourceLocationSchema.optional(),
+	astKind: z.string().min(1).optional(),
+	scopeOverride: IntegrationScopeSchema.optional(),
+	credentialSets: z.array(ResolvedCredentialSetSchema).optional(),
+	requiredOAuthScopes: z.array(z.string()).optional()
+});
+const CodeBlockNodeDataSchema = z.object({
+	kind: z.literal("code-block"),
+	statements: z.array(FlowStatementSchema)
+});
+const DecisionNodeDataSchema = z.object({
+	kind: z.literal("decision"),
+	decisionKind: DecisionKindSchema.optional(),
+	source: SourceLocationSchema.optional(),
+	astKind: z.string().min(1).optional(),
+	conditionText: z.string().optional()
+});
+const MergeNodeDataSchema = z.object({
+	kind: z.literal("merge"),
+	source: SourceLocationSchema.optional()
+});
+const ForkNodeDataSchema = z.object({
+	kind: z.literal("fork"),
+	parallelKind: ParallelKindSchema.optional(),
+	preStatements: z.array(FlowStatementSchema).optional(),
+	source: SourceLocationSchema.optional(),
+	astKind: z.string().min(1).optional()
+});
+const JoinNodeDataSchema = z.object({
+	kind: z.literal("join"),
+	outputBinding: z.string().min(1).optional(),
+	source: SourceLocationSchema.optional()
+});
+const ParallelMapNodeDataSchema = z.object({
+	kind: z.literal("parallel-map"),
+	parallelKind: ParallelKindSchema.optional(),
+	iterationExpression: z.string().optional(),
+	stepNames: z.array(z.string()).optional(),
+	outputBinding: z.string().min(1).optional(),
+	preStatements: z.array(FlowStatementSchema).optional(),
+	source: SourceLocationSchema.optional(),
+	astKind: z.string().min(1).optional()
+});
+const LoopNodeDataSchema = z.object({
+	kind: z.literal("loop"),
+	loopKind: LoopKindSchema.optional(),
+	source: SourceLocationSchema.optional(),
+	astKind: z.string().min(1).optional(),
+	conditionText: z.string().optional()
+});
+const ExitNodeDataSchema = z.object({
+	kind: z.literal("exit"),
+	exitKind: ExitKindSchema,
+	sourceText: z.string().optional(),
+	source: SourceLocationSchema.optional(),
+	astKind: z.string().min(1).optional()
+});
+const FlowNodeDataSchema = z.discriminatedUnion("kind", [
+	EntryNodeDataSchema,
+	StepNodeDataSchema,
+	CodeBlockNodeDataSchema,
+	DecisionNodeDataSchema,
+	MergeNodeDataSchema,
+	ForkNodeDataSchema,
+	JoinNodeDataSchema,
+	ParallelMapNodeDataSchema,
+	LoopNodeDataSchema,
+	ExitNodeDataSchema
+]);
+const FlowEdgeDataSchema = z.object({ branchKind: FlowBranchKindSchema.optional() }).catchall(z.unknown());
+const FlowPositionSchema = z.object({
+	x: z.number().finite(),
+	y: z.number().finite()
+});
+const FlowNodeSchema = z.object({
+	id: z.string().min(1),
+	type: FlowNodeTypeSchema,
+	label: z.string(),
+	position: FlowPositionSchema,
+	data: FlowNodeDataSchema
+});
+const FlowEdgeSchema = z.object({
+	id: z.string().min(1),
+	source: z.string().min(1),
+	target: z.string().min(1),
+	type: FlowEdgeTypeSchema,
+	label: z.string().optional(),
+	data: FlowEdgeDataSchema.optional()
+});
+const FlowGraphSchema = z.object({
+	nodes: z.array(FlowNodeSchema),
+	edges: z.array(FlowEdgeSchema),
+	entryPoint: z.string().min(1),
+	exitPoints: z.array(z.string().min(1)),
+	generatedAt: z.iso.datetime(),
+	diagnostics: z.array(z.string())
+});
+//#endregion
+//#region ../../packages/workflow-core/src/artifacts/schema-fingerprint.ts
+/**
+* schema-fingerprint.ts
+*
+* Computes a deterministic fingerprint (hash) of a credential set's schema.
+* Used as a persistence-layer identity stamp: the workflow-builder stamps each
+* credential requirement with its fingerprint at build time, the server stamps
+* each vault row with the fingerprint at upload time, and the executor's
+* credential resolver compares the two at read time so schema drift surfaces
+* as a `CredentialSchemaMismatchError` rather than a silent decode into a
+* stale shape.
+*
+* The fingerprint is deterministic: identical JSON schemas always produce the
+* same hash regardless of property ordering, timestamps, or other
+* non-structural differences.
+*
+* @remarks
+* This is the *persistence* fingerprint. The construction-time registry in
+* `credential-set/registry.ts` uses a different (Zod-structural) fingerprint
+* purely for in-process identity collision detection; the two fingerprints
+* serve different purposes and do not need to match.
+*/
+/**
+* Compute a deterministic fingerprint for a JSON schema object.
+*
+* The schema is the output of `schemaToJsonSchema(zodSchema)` — a plain JSON
+* object describing the shape of the Zod schema.
+*
+* Properties are sorted recursively before hashing to ensure deterministic
+* output regardless of insertion order.
+*
+* @example
+* ```ts
+* const auth = schemaToJsonSchema(credentialSet.auth);
+* const stored = credentialSet.stored ? schemaToJsonSchema(credentialSet.stored) : undefined;
+* const fingerprint = computeSchemaFingerprint(auth, stored);
+* ```
+*
+* @see CredentialSchemaMismatchError
+*/
+function computeSchemaFingerprint(authSchema, storedSchema) {
+	const normalized = sortDeep({
+		auth: authSchema,
+		...storedSchema ? { stored: storedSchema } : {}
+	});
+	const json = JSON.stringify(normalized);
+	return createHash("sha256").update(json).digest("hex").substring(0, 16);
+}
+function sortDeep(value) {
+	if (value === null || value === void 0) return value;
+	if (Array.isArray(value)) return value.map(sortDeep);
+	if (typeof value === "object") {
+		const sorted = {};
+		for (const key of Object.keys(value).sort()) sorted[key] = sortDeep(value[key]);
+		return sorted;
+	}
+	return value;
+}
+//#endregion
+//#region ../../packages/workflow-core/src/artifacts/workflow-manifest.ts
+const WORKFLOW_MANIFEST_GENERATOR = "local-build";
+const WORKFLOW_MANIFEST_SCHEMA_VERSION = "1.0.0";
+/** Shared identity fields for a workflow. Single source of truth for name/description/tags validation. */
+const WorkflowIdentitySchema = z.object({
+	name: z.string().trim().min(1).max(255),
+	description: z.string().trim().min(1).optional(),
+	tags: z.array(z.string()).optional()
+});
+z.object({
+	name: z.string().trim().min(1).max(255),
+	description: z.string().trim().min(1).optional(),
+	tags: z.array(z.string()).optional()
+});
+const WorkflowIOSchema = z.object({
+	input: JsonSchemaSchema.nullable(),
+	output: JsonSchemaSchema.nullable()
+});
+const BuildInfoSchema = z.object({
+	timestamp: z.iso.datetime(),
+	builderVersion: z.string().min(1),
+	generatedBy: z.literal(WORKFLOW_MANIFEST_GENERATOR),
+	gitCommit: z.string().optional(),
+	gitBranch: z.string().optional(),
+	gitIsDirty: z.boolean().optional(),
+	nodeVersion: z.string().min(1),
+	platform: z.string().min(1),
+	sourceChecksumAlgorithm: z.enum(["sha256"]),
+	sourceChecksum: z.string().length(64),
+	generatedFiles: z.array(z.string().min(1))
+});
+/** Trigger binding data included in workflow manifests. */
+const WorkflowTriggerBindingSchema = z.object({
+	triggerName: z.string().min(1),
+	triggerType: TriggerTypeSchema,
+	hasTransform: z.boolean(),
+	hasFilter: z.boolean(),
+	narrowedFrom: z.string().optional(),
+	lineage: z.array(z.string()).optional()
+});
+/** What a Workflow primitive knows about itself at construction time. Every field is real — no placeholders. */
+const WorkflowCoreManifestSchema = WorkflowIdentitySchema.extend({
+	schemaVersion: z.literal(WORKFLOW_MANIFEST_SCHEMA_VERSION),
+	id: z.string().min(1),
+	exportName: z.string().min(1),
+	workflowSchemas: WorkflowIOSchema,
+	workflowGlobals: JsonSchemaSchema.optional(),
+	timeout: DurationSchema.optional(),
+	buildInfo: BuildInfoSchema,
+	triggers: z.array(WorkflowTriggerBindingSchema).optional()
+});
+/** Categorized dependency tracking for workflow manifests */
+const ManifestDependenciesSchema = z.object({
+	/** Local source files: relative path (from project root) -> SHA256 content hash */
+	localFiles: z.record(z.string(), z.string()),
+	/** npm packages: package name -> declared version from package.json */
+	packages: z.record(z.string(), z.string()),
+	/** Workspace packages: @keystroke/* name -> version specifier */
+	workspacePackages: z.record(z.string(), z.string()),
+	/** Node.js built-in module specifiers (e.g., "node:fs") */
+	builtins: z.array(z.string())
+});
+/** Complete build-enriched manifest. Extends core with steps, dependencies, and credentials discovered by the build pipeline. */
+const WorkflowManifestSchema = WorkflowCoreManifestSchema.extend({
+	workflowSource: SourceLocationSchema.optional(),
+	dependencies: ManifestDependenciesSchema,
+	hasCycles: z.boolean().optional(),
+	credentials: CredentialRequirementsSchema.optional(),
+	sandboxes: z.array(z.record(z.string(), z.unknown())).optional(),
+	steps: z.record(z.string(), WorkflowStepEntrySchema)
+});
+z.object({
+	organizationId: z.string(),
+	workflowId: z.string(),
+	bundle: z.instanceof(Uint8Array).optional(),
+	manifest: WorkflowManifestSchema,
+	sourcePath: z.string().optional(),
+	triggers: z.array(TriggerUploadDataSchema).optional(),
+	bundleSize: z.number().optional(),
+	bundleHash: SHA256HashSchema.optional(),
+	skipVersionBump: z.boolean().optional(),
+	projectRoot: z.string().optional(),
+	projectId: z.uuid(),
+	flowJson: FlowGraphSchema.optional(),
+	deploymentSnapshotOnly: z.boolean().optional()
+});
+//#endregion
+//#region ../../packages/workflow-core/src/shared/declared-credential-requirements.ts
+function readSchemaKeys(schema, propertyKey) {
+	if (schema === null || typeof schema !== "object") return [];
+	const candidate = schema[propertyKey];
+	if (candidate === null || typeof candidate !== "object" || Array.isArray(candidate)) return [];
+	return Object.keys(candidate).sort();
+}
+/**
+* Returns sorted keys that are NOT listed in the JSON Schema `required` array.
+*/
+function readOptionalJsonSchemaKeys(schema) {
+	if (schema === null || typeof schema !== "object") return [];
+	const record = schema;
+	const properties = record.properties;
+	if (properties === null || typeof properties !== "object" || Array.isArray(properties)) return [];
+	const requiredSet = new Set(Array.isArray(record.required) ? record.required : []);
+	return Object.keys(properties).filter((key) => !requiredSet.has(key)).sort();
+}
+function toDeclaredCredentialRequirement(credentialSet) {
+	const optionalAuthKeys = credentialSet.optionalCredentialKeys;
+	const optionalStoredKeys = credentialSet.optionalStoredCredentialKeys;
+	const schemaFingerprint = computeSchemaFingerprint(schemaToJsonSchema(credentialSet.auth), credentialSet.stored ? schemaToJsonSchema(credentialSet.stored) : void 0);
+	const onCredentialRevoked = credentialSet.onCredentialRevoked;
+	return {
+		credentialSetId: credentialSet.id,
+		...credentialSet.namespace ? { namespace: credentialSet.namespace } : {},
+		resolvedCredentialSetId: credentialSet.resolvedCredentialSetId,
+		credentialKeys: [...credentialSet.credentialKeys],
+		...optionalAuthKeys.length > 0 ? { optionalCredentialKeys: [...optionalAuthKeys] } : {},
+		storedCredentialKeys: [...credentialSet.storedCredentialKeys],
+		...optionalStoredKeys.length > 0 ? { optionalStoredCredentialKeys: [...optionalStoredKeys] } : {},
+		schemaFingerprint,
+		...credentialSet.needsResolve ? { needsResolve: true } : {},
+		...credentialSet.resolveCacheMs > 0 ? { resolveCacheMs: credentialSet.resolveCacheMs } : {},
+		...onCredentialRevoked ? { onCredentialRevoked } : {},
+		...credentialSet.proxy ? { proxy: credentialSet.proxy } : {},
+		...credentialSet.needsRawSecret === true ? { needsRawSecret: true } : {}
+	};
+}
+function toDeclaredCredentialRequirements(credentialSets) {
+	return credentialSets.map(toDeclaredCredentialRequirement);
+}
+function manifestToDeclaredCredentialRequirement(credentialSet) {
+	const authKeys = readSchemaKeys(credentialSet.auth, "properties");
+	const optionalAuthKeys = readOptionalJsonSchemaKeys(credentialSet.auth);
+	const storedSchema = credentialSet.stored ?? credentialSet.auth;
+	const storedKeys = readSchemaKeys(storedSchema, "properties");
+	const optionalStoredKeys = readOptionalJsonSchemaKeys(storedSchema);
+	const schemaFingerprint = credentialSet.auth ? computeSchemaFingerprint(credentialSet.auth, credentialSet.stored) : void 0;
+	const onCredentialRevoked = credentialSet.onCredentialRevoked;
+	return {
+		credentialSetId: credentialSet.id,
+		...credentialSet.namespace ? { namespace: credentialSet.namespace } : {},
+		resolvedCredentialSetId: credentialSet.resolvedCredentialSetId,
+		credentialKeys: authKeys,
+		...optionalAuthKeys.length > 0 ? { optionalCredentialKeys: optionalAuthKeys } : {},
+		storedCredentialKeys: storedKeys,
+		...optionalStoredKeys.length > 0 ? { optionalStoredCredentialKeys: optionalStoredKeys } : {},
+		...schemaFingerprint ? { schemaFingerprint } : {},
+		...credentialSet.needsResolve ? { needsResolve: true } : {},
+		...typeof credentialSet.resolveCacheMs === "number" && credentialSet.resolveCacheMs > 0 ? { resolveCacheMs: credentialSet.resolveCacheMs } : {},
+		...onCredentialRevoked ? { onCredentialRevoked } : {},
+		...credentialSet.proxy ? { proxy: credentialSet.proxy } : {},
+		...credentialSet.needsRawSecret === true ? { needsRawSecret: true } : {}
+	};
+}
+//#endregion
+export { WORKFLOW_MANIFEST_SCHEMA_VERSION as a, FlowGraphSchema as c, WORKFLOW_MANIFEST_GENERATOR as i, readOptionalJsonSchemaKeys as n, WorkflowCoreManifestSchema as o, toDeclaredCredentialRequirements as r, WorkflowManifestSchema as s, manifestToDeclaredCredentialRequirement as t };