@keystrokehq/cli 0.0.11 → 0.0.12

package/dist/{import-module-DDPnzlJ1-BIBSgOhK.mjs → import-module-DEI7R8Yh-Xz-KAPvB.mjs}

@@ -1,12 +1,10 @@
 #!/usr/bin/env node
 
-import { n as findProjectRoot } from "./project-config-D9eFU8Jk.mjs";
-import { a as idNoSpacesString, c as optionalDescriptionString, f as trimmedNonEmptyString, i as descriptionString, l as optionalTrimmedNonEmptyString, n as createStructuralSchema, o as jsonSchemaObject, s as jsonValueSchema, t as anyZodSchemaSchema } from "./schema-B-Wgo4rJ.mjs";
-import { m as CredentialSetManifestSchema, n as DeclaredCredentialRequirementSchema } from "./credential-requirements-BCW8aQWS.mjs";
-import { a as FlowGraphSchema, n as WORKFLOW_MANIFEST_SCHEMA_VERSION, r as WorkflowCoreManifestSchema } from "./workflow-manifest-BfL74mjp.mjs";
-import { n as IANATimezoneSchema, r as ScheduleSchema } from "./schedule-BWAI6qLx.mjs";
-import { n as TriggerRuntimeDescriptorSchema, r as triggerBaseConfigSchema } from "./schemas-9FmGqrPT.mjs";
-import { t as runWithConcurrency } from "./concurrency-gXn9Rw8x-CnBnF2cg.mjs";
+import { n as findProjectRoot } from "./project-config-CJGSh2RQ.mjs";
+import { c as optionalDescriptionString, i as createStructuralSchema, l as optionalTrimmedNonEmptyString, o as idNoSpacesString, r as anyZodSchemaSchema, s as jsonSchemaObject, t as CredentialSetManifestSchema, u as trimmedNonEmptyString } from "./schemas-DodkHgnS.mjs";
+import { n as DeclaredCredentialRequirementSchema } from "./credential-requirements-FtBk5JVB.mjs";
+import { a as FlowGraphSchema, i as WorkflowCoreManifestSchema, n as WORKFLOW_MANIFEST_SCHEMA_VERSION } from "./workflow-build-manifest-OPFqFD6f.mjs";
+import { t as runWithConcurrency } from "./concurrency-gXn9Rw8x-CaI6Vtbu.mjs";
 import { createRequire } from "node:module";
 import * as os from "node:os";
 import * as path$1 from "node:path";
@@ -15,11 +13,12 @@ import { z } from "zod";
 import { execFile } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { promisify } from "node:util";
+import { cronTriggerManifestSchema, pollingTriggerManifestSchema, webhookTriggerManifestSchema } from "@keystrokehq/core/trigger";
 //#region ../../packages/core/src/mcp-server/schemas.ts
-const credentialSetInstanceSchema$2 = createStructuralSchema([
+const credentialSetInstanceSchema$1 = createStructuralSchema([
 	"id",
 	"auth",
-	"needsResolve"
+	"connections"
 ], "a CredentialSet instance");
 const McpTransportSchema = z.discriminatedUnion("type", [
 	z.object({
@@ -44,7 +43,7 @@ z.object({
 	name: optionalTrimmedNonEmptyString("MCP server name"),
 	description: optionalDescriptionString("MCP server description"),
 	transport: McpTransportSchema,
-	credentialSets: z.array(credentialSetInstanceSchema$2).optional(),
+	credentialSets: z.array(credentialSetInstanceSchema$1).optional(),
 	credentials: z.function().optional()
 });
 const McpServerManifestSchema = z.object({
@@ -68,10 +67,10 @@ const McpServerManifestSchema = z.object({
 });
 //#endregion
 //#region ../../packages/core/src/messaging-gateway/schemas.ts
-const credentialSetInstanceSchema$1 = createStructuralSchema([
+const credentialSetInstanceSchema = createStructuralSchema([
 	"id",
 	"auth",
-	"needsResolve"
+	"connections"
 ], "a CredentialSet instance");
 const MessagingGatewayModeSchema = z.enum(["platform", "custom"]);
 const MessagingGatewayCredentialScopeSchema = z.enum(["organization", "project"]);
@@ -81,7 +80,7 @@ z.object({
 	description: optionalDescriptionString("MessagingGateway description"),
 	provider: z.string().min(1, "MessagingGateway provider is required"),
 	mode: MessagingGatewayModeSchema,
-	credentialSet: credentialSetInstanceSchema$1,
+	credentialSet: credentialSetInstanceSchema,
 	credentialScope: MessagingGatewayCredentialScopeSchema.optional(),
 	appRef: z.string().min(1).optional()
 });
@@ -254,151 +253,8 @@ const AgentManifestSchema = z.object({
 	sandbox: SandboxManifestSchema.optional(),
 	messaging: z.array(MessagingGatewayManifestSchema).optional()
 });
-triggerBaseConfigSchema.extend({
-	input: anyZodSchemaSchema,
-	payload: z.custom((value) => {
-		return jsonValueSchema.safeParse(value).success;
-	}, "Expected a JSON-serializable payload"),
-	schedule: ScheduleSchema,
-	timezone: IANATimezoneSchema.optional()
-});
-const cronTriggerRuntimeSchema = TriggerRuntimeDescriptorSchema.extend({
-	input: jsonSchemaObject,
-	payloadMode: z.literal("static"),
-	schedule: z.string(),
-	timezone: z.string().optional()
-});
-const cronTriggerManifestSchema = z.object({
-	manifestVersion: z.literal(1),
-	type: z.literal("trigger"),
-	triggerType: z.literal("cron"),
-	name: trimmedNonEmptyString("Trigger name"),
-	description: descriptionString("Trigger description"),
-	enabled: z.boolean(),
-	modeDefault: z.enum(["managed", "subscribable"]),
-	executionIdentityPolicy: triggerBaseConfigSchema.shape.executionIdentityPolicy,
-	credentialSets: z.array(CredentialSetManifestSchema).optional(),
-	runtime: cronTriggerRuntimeSchema,
-	/** Static payload for cron triggers — the workflow input when this trigger fires */
-	payload: jsonValueSchema.optional()
-});
-z.object({
-	lastPolledAt: z.string().optional(),
-	lastResponse: z.unknown().optional()
-});
-triggerBaseConfigSchema.extend({
-	poll: z.function(),
-	filter: z.function().optional(),
-	idempotencyKey: z.function().optional(),
-	response: anyZodSchemaSchema,
-	schedule: ScheduleSchema
-});
-const pollingTriggerRuntimeSchema = TriggerRuntimeDescriptorSchema.extend({
-	response: jsonSchemaObject,
-	schedule: z.string(),
-	state: z.object({
-		lastPolledAt: z.literal(true),
-		lastResponse: z.literal(true)
-	})
-});
-const pollingTriggerManifestSchema = z.object({
-	manifestVersion: z.literal(1),
-	type: z.literal("trigger"),
-	triggerType: z.literal("polling"),
-	name: trimmedNonEmptyString("Trigger name"),
-	description: descriptionString("Trigger description"),
-	enabled: z.boolean(),
-	modeDefault: z.enum(["managed", "subscribable"]),
-	executionIdentityPolicy: triggerBaseConfigSchema.shape.executionIdentityPolicy,
-	credentialSets: z.array(CredentialSetManifestSchema).optional(),
-	runtime: pollingTriggerRuntimeSchema
-});
-//#endregion
-//#region ../../packages/core/src/trigger/webhook/schemas.ts
-const WebhookMethodSchema = z.enum([
-	"PATCH",
-	"POST",
-	"PUT"
-]);
-z.object({
-	method: z.string(),
-	path: z.string(),
-	query: z.record(z.string(), z.union([
-		z.string(),
-		z.array(z.string()),
-		z.undefined()
-	])),
-	headers: z.record(z.string(), z.string().optional()),
-	rawBody: z.string()
-});
-const WebhookResponseConfigSchema = z.object({
-	ignoredBody: jsonValueSchema.optional(),
-	ignoredStatus: z.number().int().positive().optional(),
-	successBody: jsonValueSchema.optional(),
-	successStatus: z.number().int().positive().optional()
-});
-/**
-* Custom webhook trigger paths describe the suffix that a request URL has
-* after the organization id. The router serves these triggers at
-* `/api/v1/webhooks/{orgId}{path}` (e.g. `path: '/orders'` → request
-* `/api/v1/webhooks/{orgId}/orders`). Authors must therefore supply only the
-* trailing path segment, not the `/webhooks/` prefix that the route already
-* provides.
-*/
-const webhookPathSchema = z.string().trim().min(1, { error: "Webhook path cannot be empty" }).max(50, { error: "Webhook path cannot exceed 50 characters" }).refine((s) => !/\s/.test(s), { error: "Webhook path cannot contain spaces or whitespace" }).refine((s) => s.startsWith("/"), { error: "Webhook path must start with /" }).refine((s) => s.length > 1, { error: "Webhook path must include a path segment after the leading \"/\"" }).refine((s) => !/^\/webhooks(\/|$)/i.test(s), { error: "Webhook path must not start with \"/webhooks\". Provide just the suffix that follows the organization id in the URL — e.g. use \"/orders\" for a webhook served at \"/api/v1/webhooks/{orgId}/orders\"." });
-const credentialSetInstanceSchema = createStructuralSchema([
-	"id",
-	"auth",
-	"needsResolve"
-], "a CredentialSet instance");
-const webhookCustomSourceConfigSchema = z.object({
-	type: z.literal("custom"),
-	method: WebhookMethodSchema,
-	path: webhookPathSchema,
-	verify: z.function().optional(),
-	response: WebhookResponseConfigSchema.optional(),
-	credentialSets: z.array(credentialSetInstanceSchema).optional()
-});
-const webhookAppSourceConfigSchema = z.object({
-	type: z.literal("app"),
-	appRef: trimmedNonEmptyString("appRef")
-});
-const webhookSourceConfigSchema = z.discriminatedUnion("type", [webhookCustomSourceConfigSchema, webhookAppSourceConfigSchema]);
-const webhookCustomSourceManifestSchema = z.object({
-	type: z.literal("custom"),
-	method: WebhookMethodSchema,
-	path: z.string().min(1).max(1024),
-	response: WebhookResponseConfigSchema.optional()
-});
-const webhookAppSourceManifestSchema = z.object({
-	type: z.literal("app"),
-	appRef: trimmedNonEmptyString("appRef")
-});
-const WebhookSourceManifestSchema = z.discriminatedUnion("type", [webhookCustomSourceManifestSchema, webhookAppSourceManifestSchema]);
-triggerBaseConfigSchema.omit({ credentialSets: true }).extend({
-	source: webhookSourceConfigSchema,
-	payload: anyZodSchemaSchema.optional(),
-	filter: z.function().optional(),
-	idempotencyKey: z.function().optional()
-});
-const webhookTriggerRuntimeSchema = TriggerRuntimeDescriptorSchema.extend({
-	source: WebhookSourceManifestSchema,
-	payload: jsonSchemaObject
-});
-const webhookTriggerManifestSchema = z.object({
-	manifestVersion: z.literal(1),
-	type: z.literal("trigger"),
-	triggerType: z.literal("webhook"),
-	name: trimmedNonEmptyString("Trigger name"),
-	description: descriptionString("Trigger description"),
-	enabled: z.boolean(),
-	modeDefault: z.enum(["managed", "subscribable"]),
-	executionIdentityPolicy: triggerBaseConfigSchema.shape.executionIdentityPolicy,
-	credentialSets: z.array(CredentialSetManifestSchema).optional(),
-	runtime: webhookTriggerRuntimeSchema
-});
 //#endregion
-//#region ../../packages/workflow-builder/dist/import-module-DDPnzlJ1.mjs
+//#region ../../packages/workflow-builder/dist/import-module-DEI7R8Yh.mjs
 var DiscoveryError = class extends Error {
 	code;
 	filePath;
@@ -518,9 +374,8 @@ import {
   webhookTrigger,
   pollingTrigger,
 } from '@keystrokehq/core';
-import { getOfficialIntegrationMetadata } from '@keystrokehq/core/_runtime';
-import { analyzeSuspensions, analyzeWorkflowCredentials, isTabularSchema } from '@keystrokehq/core/flow-graph-toolkit';
 import { parseSync } from ${JSON.stringify(OXC_PARSER_IMPORT_URL)};
+import { z } from 'zod';
 
 Object.assign(globalThis, {
   Workflow,
@@ -543,10 +398,98 @@ Object.assign(globalThis, {
 const encodedInput = process.env.KEYSTROKE_WORKFLOW_LOADER_INPUT;
 const staticFlowModuleCache = new Map();
 const staticFlowResolutionCache = new Map();
+const OFFICIAL_OPERATION_METADATA_REGISTRY_KEY = '__ks_official_integration_metadata_registry';
+
+function getOfficialOperationMetadata(operation) {
+  const registry = globalThis[OFFICIAL_OPERATION_METADATA_REGISTRY_KEY];
+  return registry && typeof registry.get === 'function' ? registry.get(operation) : undefined;
+}
+
+async function analyzeSuspensions(workflow) {
+  return analyzeSuspensionsFromGraph(await workflow.toFlowGraph());
+}
+
+function analyzeSuspensionsFromGraph(graph) {
+  const reasons = [];
+  for (const node of graph.nodes) {
+    if (node.type !== 'step' || node.data.kind !== 'call') continue;
+    const data = node.data;
+    if (data.callKind === 'hook') {
+      reasons.push({ kind: 'hook', location: data.source, detail: data.stepName, hookName: data.stepName });
+    }
+    if (data.callKind === 'agent') {
+      reasons.push({ kind: 'agent', location: data.source, detail: data.stepName });
+    }
+    if (data.callKind === 'child-workflow') {
+      reasons.push({
+        kind: 'child-workflow-suspending',
+        location: data.source,
+        detail: data.stepName,
+        authoredWorkflowId: data.stepId,
+      });
+    }
+  }
+  const classification = reasons.length === 0 ? 'A' : reasons.every((reason) => reason.kind === 'wait') ? 'B' : 'C';
+  return { hasSuspensions: reasons.length > 0, reasons, classification };
+}
+
+async function analyzeWorkflowCredentials(workflow) {
+  return analyzeWorkflowCredentialsFromGraph(await workflow.toFlowGraph(), {
+    runSource: typeof workflow.getRunFunctionSource === 'function' ? workflow.getRunFunctionSource() : undefined,
+  });
+}
+
+function analyzeWorkflowCredentialsFromGraph(graph, options = {}) {
+  const all = dedupeCredentialSets(
+    graph.nodes.flatMap((node) =>
+      node.type === 'step' && node.data.kind === 'call' ? (node.data.credentialSets ?? []) : []
+    )
+  );
+  const guardedCredentialIds = extractHasCredentialSetIds(options.runSource);
+  const conditional = dedupeCredentialSets(
+    all.filter((credentialSet) => isGuardedByHasCredentialSet(credentialSet, guardedCredentialIds))
+  );
+  const conditionalIds = new Set(conditional.map((credentialSet) => credentialSet.resolvedId));
+  const required = all.filter((credentialSet) => !conditionalIds.has(credentialSet.resolvedId));
+  return { required, conditional, all };
+}
+
+function isTabularSchema(schema) {
+  return schema instanceof z.ZodArray && schema.element instanceof z.ZodObject && Object.keys(schema.element.shape).length > 0;
+}
+
+function dedupeCredentialSets(credentialSets) {
+  const byId = new Map();
+  for (const credentialSet of credentialSets) {
+    byId.set(credentialSet.resolvedId, credentialSet);
+  }
+  return [...byId.values()];
+}
+
+function extractHasCredentialSetIds(source) {
+  const ids = new Set();
+  if (!source) return ids;
+  const pattern = new RegExp("\\\\.hasCredentialSet\\\\(\\\\s*['\\"\\\\x60]([^'\\"\\\\x60]+)['\\"\\\\x60]\\\\s*\\\\)", "g");
+  let match = pattern.exec(source);
+  while (match) {
+    const id = match[1];
+    if (id) ids.add(id);
+    match = pattern.exec(source);
+  }
+  return ids;
+}
+
+function isGuardedByHasCredentialSet(credentialSet, guardedIds) {
+  if (guardedIds.size === 0) return false;
+  const shortId = credentialSet.resolvedId.includes(':')
+    ? credentialSet.resolvedId.split(':').at(-1)
+    : credentialSet.resolvedId;
+  return guardedIds.has(credentialSet.resolvedId) || (shortId ? guardedIds.has(shortId) : false);
+}
 
 function serializeError(error) {
   if (error instanceof Error && Array.isArray(error.issues)) {
-    const messages = error.issues.map(issue => issue.message).filter(Boolean);
+    const messages = error.issues.map((issue) => issue.message).filter(Boolean);
     if (messages.length > 0) {
       return messages.join('; ');
     }
@@ -587,10 +530,8 @@ function getCredentialRequirements(value) {
 
 function getAgentToolId(tool) {
   if (tool instanceof Workflow) return tool.id;
-  const integrationMetadata = getOfficialIntegrationMetadata(tool);
-  return integrationMetadata
-    ? integrationMetadata.integrationId + '_' + tool.id
-    : tool.id;
+  const integrationMetadata = getOfficialOperationMetadata(tool);
+  return integrationMetadata ? integrationMetadata.integrationId + '_' + tool.id : tool.id;
 }
 
 /**
@@ -631,13 +572,12 @@ async function computeAgentToolEnrichments(agent) {
     }
 
     if (tool instanceof Operation) {
-      const integrationMetadata = getOfficialIntegrationMetadata(tool);
+      const integrationMetadata = getOfficialOperationMetadata(tool);
       const enrichment = {
         dispatch: integrationMetadata?.hosted ? 'host' : 'sandbox',
         outputSchemaIsTabular: isTabularSchema(tool.output),
       };
       enrichments[toolId] = enrichment;
-      continue;
     }
   }
 
@@ -771,7 +711,7 @@ function buildCredentialsByCallsiteFingerprint(params) {
     .map(([bindingName, entries]) => ({
       category: 'unmatched-callsite',
       bindingName,
-      credentialSetIds: [...new Set(entries.map((entry) => entry.resolvedCredentialSetId))].sort(),
+      credentialSetIds: [...new Set(entries.map((entry) => entry.credentialSetId))].sort(),
     }));
 
   return { credentialsByCallsiteFingerprint, warnings };
@@ -800,7 +740,9 @@ function deduplicateCredentialRequirementEntries(entries) {
       sortedOptionalAuthKeys.join(','),
       sortedStoredKeys.join(','),
       sortedOptionalStoredKeys.join(','),
-      typeof entry.resolveCacheMs === 'number' ? String(entry.resolveCacheMs) : '',
+      typeof entry.dynamicResolutionCacheMs === 'number'
+        ? String(entry.dynamicResolutionCacheMs)
+        : '',
       entry.onCredentialRevoked ?? '',
     ].join('|');
     if (!deduped.has(key)) {
@@ -936,15 +878,18 @@ async function createImportResolutions(options) {
       if (!options.runCalleeNames.has(localName)) {
         continue;
       }
-      resolutions.set(localName, await enrichImportResolution({
-        exportName: 'default',
-        importSource: {
-          ...importSourceBase,
-          importName: 'default',
-          localName,
-        },
-        resolvedPath,
-      }));
+      resolutions.set(
+        localName,
+        await enrichImportResolution({
+          exportName: 'default',
+          importSource: {
+            ...importSourceBase,
+            importName: 'default',
+            localName,
+          },
+          resolvedPath,
+        })
+      );
       continue;
     }
 
@@ -957,15 +902,18 @@ async function createImportResolutions(options) {
       if (!options.runCalleeNames.has(localName)) {
         continue;
       }
-      resolutions.set(localName, await enrichImportResolution({
-        exportName: importName,
-        importSource: {
-          ...importSourceBase,
-          importName,
-          localName,
-        },
-        resolvedPath,
-      }));
+      resolutions.set(
+        localName,
+        await enrichImportResolution({
+          exportName: importName,
+          importSource: {
+            ...importSourceBase,
+            importName,
+            localName,
+          },
+          resolvedPath,
+        })
+      );
       continue;
     }
 
@@ -977,15 +925,18 @@ async function createImportResolutions(options) {
       if (!options.runCalleeNames.has(localName)) {
         continue;
       }
-      resolutions.set(localName, await enrichImportResolution({
-        exportName: localName,
-        importSource: {
-          ...importSourceBase,
-          kind: 'namespace-import',
-          localName,
-        },
-        resolvedPath,
-      }));
+      resolutions.set(
+        localName,
+        await enrichImportResolution({
+          exportName: localName,
+          importSource: {
+            ...importSourceBase,
+            kind: 'namespace-import',
+            localName,
+          },
+          resolvedPath,
+        })
+      );
     }
   }
 
@@ -1015,7 +966,10 @@ async function enrichImportResolution(resolution) {
     if (!instance || typeof instance.toManifest !== 'function') {
       if (isLocalTypedPrimitiveImport(resolution)) {
         throw new Error(
-          'Could not resolve typed primitive export "' + importSource.importName + '" from ' + resolution.resolvedPath
+          'Could not resolve typed primitive export "' +
+            importSource.importName +
+            '" from ' +
+            resolution.resolvedPath
         );
       }
       staticFlowResolutionCache.set(cacheKey, null);
@@ -1024,11 +978,15 @@ async function enrichImportResolution(resolution) {
 
     const manifest = compactManifestForFlowGraph(instance.toManifest());
     const credentialRequirements =
-      typeof instance.getCredentialRequirements === 'function' ? instance.getCredentialRequirements() : [];
+      typeof instance.getCredentialRequirements === 'function'
+        ? instance.getCredentialRequirements()
+        : [];
     const inputSchema = getInputSchema(manifest);
     const outputSchema = getOutputSchema(manifest);
     const nestedRunSource =
-      typeof instance.getRunFunctionSource === 'function' ? instance.getRunFunctionSource() : undefined;
+      typeof instance.getRunFunctionSource === 'function'
+        ? instance.getRunFunctionSource()
+        : undefined;
 
     const enriched = {
       ...resolution,
@@ -1115,10 +1073,19 @@ function inferCallKindFromPath(filePath, manifest) {
     return manifest?.type === 'agent' ? 'agent' : 'workflow-step';
   }
   const lower = filePath.toLowerCase();
-  if (lower.endsWith('.agent.ts') || lower.endsWith('.agent.tsx') || lower.endsWith('.agent.mts') || manifest?.type === 'agent') {
+  if (
+    lower.endsWith('.agent.ts') ||
+    lower.endsWith('.agent.tsx') ||
+    lower.endsWith('.agent.mts') ||
+    manifest?.type === 'agent'
+  ) {
     return 'agent';
   }
-  if (lower.endsWith('.workflow.ts') || lower.endsWith('.workflow.tsx') || lower.endsWith('.workflow.mts')) {
+  if (
+    lower.endsWith('.workflow.ts') ||
+    lower.endsWith('.workflow.tsx') ||
+    lower.endsWith('.workflow.mts')
+  ) {
     return 'child-workflow';
   }
   return 'workflow-step';
@@ -1171,7 +1138,7 @@ function isLocalTypedPrimitiveImport(resolution) {
 
 function credentialRequirementToFlowGraphEntry(entry) {
   return {
-    resolvedId: entry.resolvedCredentialSetId,
+    resolvedId: entry.credentialSetId,
     credentialKeys: [...(entry.credentialKeys ?? [])],
     ...(entry.scope ? { scope: entry.scope } : {}),
     ...(entry.alias ? { alias: entry.alias } : {}),
@@ -1182,14 +1149,15 @@ function credentialRequirementToFlowGraphEntry(entry) {
     ...(Array.isArray(entry.storedCredentialKeys) && entry.storedCredentialKeys.length > 0
       ? { storedCredentialKeys: [...entry.storedCredentialKeys] }
       : {}),
-    ...(Array.isArray(entry.optionalStoredCredentialKeys) && entry.optionalStoredCredentialKeys.length > 0
+    ...(Array.isArray(entry.optionalStoredCredentialKeys) &&
+    entry.optionalStoredCredentialKeys.length > 0
       ? { optionalStoredCredentialKeys: [...entry.optionalStoredCredentialKeys] }
       : {}),
     ...(entry.proxy ? { proxy: entry.proxy } : {}),
     ...(entry.needsRawSecret === true ? { needsRawSecret: true } : {}),
-    ...(entry.needsResolve === true ? { needsResolve: true } : {}),
-    ...(typeof entry.resolveCacheMs === 'number' && entry.resolveCacheMs > 0
-      ? { resolveCacheMs: entry.resolveCacheMs }
+    ...(entry.needsDynamicResolution === true ? { needsDynamicResolution: true } : {}),
+    ...(typeof entry.dynamicResolutionCacheMs === 'number' && entry.dynamicResolutionCacheMs > 0
+      ? { dynamicResolutionCacheMs: entry.dynamicResolutionCacheMs }
       : {}),
     ...(entry.onCredentialRevoked ? { onCredentialRevoked: entry.onCredentialRevoked } : {}),
     ...(entry.schemaFingerprint ? { schemaFingerprint: entry.schemaFingerprint } : {}),
@@ -1198,7 +1166,7 @@ function credentialRequirementToFlowGraphEntry(entry) {
 
 function manifestCredentialSetToFlowGraphEntry(entry) {
   return {
-    resolvedId: entry.resolvedCredentialSetId,
+    resolvedId: entry.id,
     credentialKeys: Array.isArray(entry.credentialKeys)
       ? [...entry.credentialKeys]
       : Object.keys(entry.auth?.properties ?? {}),
@@ -1213,14 +1181,15 @@ function manifestCredentialSetToFlowGraphEntry(entry) {
       : Object.keys(entry.stored?.properties ?? {}).length > 0
         ? { storedCredentialKeys: Object.keys(entry.stored?.properties ?? {}) }
         : {}),
-    ...(Array.isArray(entry.optionalStoredCredentialKeys) && entry.optionalStoredCredentialKeys.length > 0
+    ...(Array.isArray(entry.optionalStoredCredentialKeys) &&
+    entry.optionalStoredCredentialKeys.length > 0
       ? { optionalStoredCredentialKeys: [...entry.optionalStoredCredentialKeys] }
       : {}),
     ...(entry.proxy ? { proxy: entry.proxy } : {}),
     ...(entry.needsRawSecret === true ? { needsRawSecret: true } : {}),
-    ...(entry.needsResolve === true ? { needsResolve: true } : {}),
-    ...(typeof entry.resolveCacheMs === 'number' && entry.resolveCacheMs > 0
-      ? { resolveCacheMs: entry.resolveCacheMs }
+    ...(entry.needsDynamicResolution === true ? { needsDynamicResolution: true } : {}),
+    ...(typeof entry.dynamicResolutionCacheMs === 'number' && entry.dynamicResolutionCacheMs > 0
+      ? { dynamicResolutionCacheMs: entry.dynamicResolutionCacheMs }
       : {}),
     ...(entry.onCredentialRevoked ? { onCredentialRevoked: entry.onCredentialRevoked } : {}),
     ...(entry.schemaFingerprint ? { schemaFingerprint: entry.schemaFingerprint } : {}),
@@ -1235,7 +1204,9 @@ function parseSourceFile(filePath, sourceText) {
     preserveParens: true,
   });
   if (result.errors.length > 0) {
-    throw new Error('Failed to parse ' + filePath + ': ' + result.errors.map((error) => error.message).join('; '));
+    throw new Error(
+      'Failed to parse ' + filePath + ': ' + result.errors.map((error) => error.message).join('; ')
+    );
   }
   return {
     program: result.program,
@@ -1279,7 +1250,9 @@ function isExportedDeclaration(statement) {
   return (
     statement.type === 'ExportNamedDeclaration' &&
     isNode(statement.declaration) &&
-    ['VariableDeclaration', 'FunctionDeclaration', 'ClassDeclaration'].includes(statement.declaration.type)
+    ['VariableDeclaration', 'FunctionDeclaration', 'ClassDeclaration'].includes(
+      statement.declaration.type
+    )
   );
 }
 
@@ -1338,7 +1311,7 @@ async function resolveStepCredentialsFromImports(flowGraph) {
       const reqs = instance.getCredentialRequirements();
       if (Array.isArray(reqs) && reqs.length > 0) {
         node.data.credentialSets = reqs.map((r) => ({
-          resolvedId: r.resolvedCredentialSetId,
+          resolvedId: r.credentialSetId,
           credentialKeys: r.credentialKeys,
           ...(Array.isArray(r.optionalCredentialKeys) && r.optionalCredentialKeys.length > 0
             ? { optionalCredentialKeys: r.optionalCredentialKeys }
@@ -1352,9 +1325,9 @@ async function resolveStepCredentialsFromImports(flowGraph) {
             : {}),
           ...(r.proxy ? { proxy: r.proxy } : {}),
           ...(r.needsRawSecret === true ? { needsRawSecret: true } : {}),
-          ...(r.needsResolve === true ? { needsResolve: true } : {}),
-          ...(typeof r.resolveCacheMs === 'number' && r.resolveCacheMs > 0
-            ? { resolveCacheMs: r.resolveCacheMs }
+          ...(r.needsDynamicResolution === true ? { needsDynamicResolution: true } : {}),
+          ...(typeof r.dynamicResolutionCacheMs === 'number' && r.dynamicResolutionCacheMs > 0
+            ? { dynamicResolutionCacheMs: r.dynamicResolutionCacheMs }
             : {}),
           ...(r.onCredentialRevoked ? { onCredentialRevoked: r.onCredentialRevoked } : {}),
           ...(r.schemaFingerprint ? { schemaFingerprint: r.schemaFingerprint } : {}),
@@ -1388,7 +1361,6 @@ function discoverCredentialsByBindingName(mod) {
           result[value.name] = entries;
         }
       }
-      continue;
     }
   }
   return result;
@@ -1418,14 +1390,23 @@ async function loadSiblingTriggerModules(workflowFilePath) {
 }
 
 function isTriggerLike(value) {
-  return value != null && (typeof value === 'object' || typeof value === 'function')
-    && typeof value.toManifest === 'function' && typeof value.name === 'string';
+  return (
+    value != null &&
+    (typeof value === 'object' || typeof value === 'function') &&
+    typeof value.toManifest === 'function' &&
+    typeof value.name === 'string'
+  );
 }
 
 function isBoundTriggerLike(value) {
-  return value != null && (typeof value === 'object' || typeof value === 'function')
-    && value.isBoundTrigger === true && value.trigger != null
-    && typeof value.trigger.toManifest === 'function' && typeof value.trigger.name === 'string';
+  return (
+    value != null &&
+    (typeof value === 'object' || typeof value === 'function') &&
+    value.isBoundTrigger === true &&
+    value.trigger != null &&
+    typeof value.trigger.toManifest === 'function' &&
+    typeof value.trigger.name === 'string'
+  );
 }
 
 function getTriggerCandidate(value) {
@@ -1438,7 +1419,6 @@ function getTriggerCandidate(value) {
   return null;
 }
 
-
 function describeTriggerEntry(entry) {
   if (entry && typeof entry === 'object') {
     if ('isBoundTrigger' in entry && entry.isBoundTrigger === true && entry.trigger) {
@@ -1465,7 +1445,12 @@ function findTriggerSource(entry, trigger, workflowMod, workflowFilePath, siblin
   for (const { filePath, exports: triggerMod } of siblingModules) {
     for (const [name, exp] of Object.entries(triggerMod)) {
       const candidate = getTriggerCandidate(exp);
-      if (exp === entry || exp === trigger || candidate === trigger || candidate?.name === triggerName) {
+      if (
+        exp === entry ||
+        exp === trigger ||
+        candidate === trigger ||
+        candidate?.name === triggerName
+      ) {
         siblingMatches.push({ triggerExportName: name, sourceFilePath: filePath });
         continue;
       }
@@ -1481,7 +1466,12 @@ function findTriggerSource(entry, trigger, workflowMod, workflowFilePath, siblin
       .map((match) => String(match.triggerExportName) + ' (' + String(match.sourceFilePath) + ')')
       .join(', ');
     throw new Error(
-      'Ambiguous trigger source for "' + triggerName + '" in ' + workflowFilePath + '. Matching sibling exports: ' + matchList
+      'Ambiguous trigger source for "' +
+        triggerName +
+        '" in ' +
+        workflowFilePath +
+        '. Matching sibling exports: ' +
+        matchList
     );
   }
 
@@ -1506,18 +1496,40 @@ async function discoverTriggers(workflow, mod, workflowFilePath) {
       const trigger = isBound ? entry.trigger : entry;
       const triggerManifest = trigger.toManifest();
       const hasTransform = isBound && typeof entry.transform === 'function';
-      const hasFilter = isBound ? typeof entry.filter === 'function' : typeof trigger.filter === 'function';
-      const { triggerExportName, sourceFilePath } = findTriggerSource(entry, trigger, mod, workflowFilePath, siblingModules);
+      const hasFilter = isBound
+        ? typeof entry.filter === 'function'
+        : typeof trigger.filter === 'function';
+      const { triggerExportName, sourceFilePath } = findTriggerSource(
+        entry,
+        trigger,
+        mod,
+        workflowFilePath,
+        siblingModules
+      );
       // For cron triggers, capture the static payload for runtime use
-      const staticPayload = triggerManifest.triggerType === 'cron' && 'payload' in trigger
-        ? trigger.payload
-        : undefined;
-      triggers.push({ triggerManifest, triggerExportName, sourceFilePath, hasTransform, hasFilter, staticPayload, triggerIndex });
+      const staticPayload =
+        triggerManifest.triggerType === 'cron' && 'payload' in trigger
+          ? trigger.payload
+          : undefined;
+      triggers.push({
+        triggerManifest,
+        triggerExportName,
+        sourceFilePath,
+        hasTransform,
+        hasFilter,
+        staticPayload,
+        triggerIndex,
+      });
     } catch (error) {
       const triggerName = describeTriggerEntry(entry);
       const message = serializeError(error);
       throw new Error(
-        'Failed to discover trigger "' + triggerName + '" for workflow "' + workflow.name + '": ' + message
+        'Failed to discover trigger "' +
+          triggerName +
+          '" for workflow "' +
+          workflow.name +
+          '": ' +
+          message
       );
     }
   }
@@ -2027,7 +2039,7 @@ function parseBatchOutput(output, workflowsByKey) {
 				continue;
 			}
 			const workflowResult = parsedResult;
-			const manifest = normalizeWorkflowManifest(workflowResult.manifest, workflow);
+			const manifest = normalizeWorkflowBuildManifest(workflowResult.manifest, workflow);
 			results.push({
 				ok: true,
 				bindingKey,
@@ -2095,7 +2107,7 @@ function parseLoaderOutput(output, discoveredWorkflow) {
 		if (parsedResult.status === "error") throw new WorkflowMetadataLoadError(parsedResult.phase, parsedResult.error);
 		const workflowResult = parsedResult;
 		return {
-			manifest: normalizeWorkflowManifest(workflowResult.manifest, discoveredWorkflow),
+			manifest: normalizeWorkflowBuildManifest(workflowResult.manifest, discoveredWorkflow),
 			flowGraph: workflowResult.flowGraph,
 			triggers: workflowResult.triggers.map((t) => ({
 				...t,
@@ -2110,22 +2122,12 @@ function parseLoaderOutput(output, discoveredWorkflow) {
 		throw new WorkflowLoaderProtocolError("stdout", `Invalid workflow loader response: ${error instanceof Error ? error.message : String(error)}`, output);
 	}
 }
-function normalizeWorkflowManifest(manifest, discoveredWorkflow) {
+function normalizeWorkflowBuildManifest(manifest, discoveredWorkflow) {
 	const parsedManifest = WorkflowCoreManifestSchema.parse(manifest);
 	return WorkflowCoreManifestSchema.parse({
 		...parsedManifest,
 		schemaVersion: WORKFLOW_MANIFEST_SCHEMA_VERSION,
-		exportName: parsedManifest.exportName ?? discoveredWorkflow.exportName,
-		buildInfo: parsedManifest.buildInfo ?? {
-			timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-			builderVersion: "workflow-builder",
-			generatedBy: "local-build",
-			nodeVersion: process.version,
-			platform: process.platform,
-			sourceChecksumAlgorithm: "sha256",
-			sourceChecksum: "0".repeat(64),
-			generatedFiles: []
-		}
+		exportName: parsedManifest.exportName ?? discoveredWorkflow.exportName
 	});
 }
 //#endregion