@keystrokehq/cli 0.0.11 → 0.0.13

package/dist/{upload.handler-BFDM6n_6.mjs → upload.handler-DemogvI1.mjs}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 
 import { N as throwReportedCliExit, a as getProcessEnv, n as ui, x as toErrorMessage } from "./keystroke.mjs";
-import { t as assertWorkflowProjectRoot } from "./project-config-D9eFU8Jk.mjs";
+import { t as assertWorkflowProjectRoot } from "./project-config-CJGSh2RQ.mjs";
 import { a as writeJsonError, i as writeJson } from "./output-CGdYhH0p.mjs";
-import { i as requireClient } from "./context-1VgRbzr-.mjs";
-import { a as readManifestsFromOutDir, t as collectCredentialFingerprintMapFromProjectDist } from "./dist-DvO0q6Fo.mjs";
-import { t as requireWorkflowsDir } from "./resolve-project-C6UAOfAG.mjs";
-import { a as verifyCredentialResolvable, i as validateManualCredentialWithHook, n as resolveCredentialValuesFromEnv, r as uploadCredential, t as groupCredentialRequirements } from "./credentials-DAQfKqn0.mjs";
-import { t as getIntegrationCatalog } from "./integration-catalog-DtNWaMvh.mjs";
-import { t as readCredentialEnvMap } from "./credential-env-map-C23GV6LN.mjs";
-import { n as renderCredentialSchemaMismatchText, r as writeCredentialSchemaMismatchJson, t as isCredentialSchemaMismatchErrorLike } from "./credential-schema-mismatch-DM9Y91jL.mjs";
+import { i as requireClient } from "./context-DQ4IA0yO.mjs";
+import { a as readManifestsFromOutDir, t as collectCredentialFingerprintMapFromProjectDist } from "./dist-BMkNN03r.mjs";
+import { t as requireWorkflowsDir } from "./resolve-project-bVPMcs-y.mjs";
+import { t as getIntegrationCatalog } from "./integration-catalog-BRrJIAVz.mjs";
+import { t as readCredentialEnvMap } from "./credential-env-map-D0zgoUl0.mjs";
+import { a as verifyCredentialResolvable, i as validateManualCredentialWithHook, n as resolveCredentialValuesFromEnv, r as uploadCredential, t as groupCredentialRequirements } from "./credentials-Bu1MBiCL.mjs";
+import { n as renderCredentialSchemaMismatchText, r as writeCredentialSchemaMismatchJson, t as isCredentialSchemaMismatchErrorLike } from "./credential-schema-mismatch-8pqwvswO.mjs";
 import * as path$1 from "node:path";
 import { confirm, isCancel } from "@clack/prompts";
 //#region src/commands/credentials/upload/upload.handler.ts
@@ -23,12 +23,88 @@ function quoteCliArg(value) {
 	return /\s/.test(value) ? `"${value.replace(/"/g, "\\\"")}"` : value;
 }
 function getCredentialDisplayName(catalog, credentialSetId) {
-	const info = catalog.byResolvedCredentialSetId.get(credentialSetId);
+	const info = catalog.byCredentialDefinitionId.get(credentialSetId);
 	if (info?.role === "connection" && info.integrationPublicId) return info.integrationPublicId;
 	return credentialSetId;
 }
+function isUploadConnectionKind(kind) {
+	return kind === "manual" || kind === "credentials-exchange";
+}
+function toUploadConnectionSelection(connection) {
+	if (!isUploadConnectionKind(connection.kind)) return null;
+	return {
+		id: connection.id,
+		kind: connection.kind,
+		label: connection.label ?? connection.id,
+		...connection.instructions ? { instructions: connection.instructions } : {},
+		...connection.fields ? { fields: connection.fields } : {},
+		...connection.recommended === true ? { recommended: true } : {},
+		...connection.advanced === true ? { advanced: true } : {},
+		...connection.generated === true ? { generated: true } : {}
+	};
+}
+function formatUploadConnectionChoices(entry) {
+	const uploadConnections = entry.connections.map(toUploadConnectionSelection).filter((connection) => connection !== null);
+	if (uploadConnections.length === 0) return "No manual or credentials-exchange upload paths are available for this integration.";
+	return `Available upload connection IDs: ${uploadConnections.map((connection) => `${connection.id}${connection.recommended ? " (recommended)" : ""}`).join(", ")}.`;
+}
+function selectUploadConnection(params) {
+	const { entry, requestedCredentialConnectionId } = params;
+	if (requestedCredentialConnectionId) {
+		const selected = entry.connections.find((connection) => connection.id === requestedCredentialConnectionId);
+		if (!selected) throw new Error(`Credential connection "${requestedCredentialConnectionId}" is not defined for "${entry.publicId}". ${formatUploadConnectionChoices(entry)}`);
+		const uploadSelection = toUploadConnectionSelection(selected);
+		if (!uploadSelection) throw new Error(`Credential connection "${selected.id}" for "${entry.publicId}" is "${selected.kind}", not an uploadable manual or credentials-exchange path. ${formatUploadConnectionChoices(entry)}`);
+		return uploadSelection;
+	}
+	return entry.connections.map(toUploadConnectionSelection).find((connection) => connection?.recommended === true) ?? entry.connections.map(toUploadConnectionSelection).find((connection) => connection?.kind === "manual") ?? entry.connections.map(toUploadConnectionSelection).find((connection) => connection !== null) ?? null;
+}
+function getInputKeysFromJsonSchema(schema) {
+	if (!schema || typeof schema !== "object") return [];
+	const properties = schema.properties;
+	if (!properties || typeof properties !== "object" || Array.isArray(properties)) return [];
+	return Object.keys(properties);
+}
+function getFieldKey(field) {
+	const key = field.key;
+	return typeof key === "string" && key.length > 0 ? key : null;
+}
+function getConnectionInputKeys(entry, connection) {
+	if (!connection) return [...entry.credentialSet.storedKeys];
+	const manifestConnection = entry.connections.find((candidate) => candidate.id === connection.id);
+	const fieldKeys = connection.fields?.map(getFieldKey).filter((key) => key !== null);
+	if (fieldKeys && fieldKeys.length > 0) return fieldKeys;
+	const inputKeys = getInputKeysFromJsonSchema(manifestConnection?.input);
+	return inputKeys.length > 0 ? inputKeys : [...entry.credentialSet.storedKeys];
+}
+function connectionToJson(connection) {
+	if (!connection) return void 0;
+	return {
+		id: connection.id,
+		kind: connection.kind,
+		label: connection.label,
+		...connection.instructions ? { instructions: connection.instructions } : {},
+		...connection.fields ? { fields: connection.fields } : {},
+		...connection.recommended === true ? { recommended: true } : {},
+		...connection.advanced === true ? { advanced: true } : {},
+		...connection.generated === true ? { generated: true } : {}
+	};
+}
+function renderConnectionHints(connection) {
+	if (!connection) return;
+	ui.text(`    connection: ${connection.label} (id: ${connection.id}, kind: ${connection.kind})`);
+	if (connection.instructions) ui.text(`    instructions: ${connection.instructions}`);
+	if (connection.fields && connection.fields.length > 0) {
+		const labels = connection.fields.map((field) => {
+			const key = getFieldKey(field);
+			const label = typeof field.label === "string" ? field.label : key;
+			return key ? `${key}${label && label !== key ? ` (${label})` : ""}` : null;
+		}).filter((field) => field !== null);
+		if (labels.length > 0) ui.text(`    fields: ${labels.join(", ")}`);
+	}
+}
 function isCatalogCredentialSet(catalog, credentialSetId) {
-	return catalog.byResolvedCredentialSetId.has(credentialSetId);
+	return catalog.byCredentialDefinitionId.has(credentialSetId);
 }
 function buildMissingSchemaFingerprintMessage(params) {
 	return `Cannot upload non-official credential set "${params.credentialSetId}" because the CLI could not discover its schema fingerprint from local build artifacts. Run \`keystroke workflows build\` in "${params.projectRoot}" and retry. Use --path to point at the owning Keystroke project if needed.`;
@@ -68,7 +144,8 @@ function renderSkippedCredentials(skipped) {
 	if (skipped.length === 0) return;
 	ui.br();
 	ui.warn(`Skipped ${skipped.length} credential set(s) — env vars not found:`);
-	for (const item of skipped) ui.text(`  - ${item.displayName} (missing: ${item.missingEnvVars.join(", ")})`);
+	for (const item of skipped) if (item.reason) ui.text(`  - ${item.displayName} (${item.reason})`);
+	else ui.text(`  - ${item.displayName} (missing: ${(item.missingEnvVars ?? []).join(", ")})`);
 }
 function renderSummary(results) {
 	const created = results.filter((r) => r.action === "created").length;
@@ -164,7 +241,7 @@ async function handleCredentialsUpload(options, ctx) {
 			ui.error(`Missing env vars for ${credentialSetId}. Set: ${expectedEnvVars.join(", ")}`);
 			throwReportedCliExit(`Missing env vars for ${credentialSetId}. Set: ${expectedEnvVars.join(", ")}`);
 		}
-		const info = catalog.byResolvedCredentialSetId.get(credentialSetId);
+		const info = catalog.byCredentialDefinitionId.get(credentialSetId);
 		toUpload = [{
 			credentialSetId,
 			displayName: getCredentialDisplayName(catalog, credentialSetId),
@@ -172,7 +249,8 @@ async function handleCredentialsUpload(options, ctx) {
 			keys,
 			values,
 			...fingerprintByCredentialSetId.get(credentialSetId) ? { schemaFingerprint: fingerprintByCredentialSetId.get(credentialSetId) } : {},
-			...info?.connectionKind ? { connectionKind: info.connectionKind } : {}
+			...info?.connectionKind ? { connectionKind: info.connectionKind } : {},
+			...options.credentialConnectionId ? { credentialConnectionId: options.credentialConnectionId } : {}
 		}];
 	} else if (isExplicitIntegrationMode) {
 		const integrationId = options.integration?.trim().toLowerCase();
@@ -182,8 +260,17 @@ async function handleCredentialsUpload(options, ctx) {
 			throwReportedCliExit(integrationId ? `Official integration "${integrationId}" is not supported for direct upload.` : "--integration is required for official integration upload");
 		}
 		const publicId = entry.publicId;
-		const credentialSetId = entry.credentialSet.resolvedCredentialSetId;
-		const storedKeys = entry.credentialSet.storedKeys;
+		const credentialSetId = entry.credentialSet.credentialDefinitionId;
+		const selectedConnection = selectUploadConnection({
+			entry,
+			requestedCredentialConnectionId: options.credentialConnectionId
+		});
+		if (!selectedConnection) {
+			ui.error(`Official integration "${publicId}" does not support credential upload.`);
+			ui.hint("Use `keystroke connect` for OAuth-only integrations.");
+			throwReportedCliExit(`Official integration "${publicId}" does not support credential upload.`);
+		}
+		const storedKeys = getConnectionInputKeys(entry, selectedConnection);
 		const authKeys = entry.credentialSet.authKeys;
 		const keyToEnv = envMap?.[credentialSetId];
 		const values = resolveCredentialValuesFromEnv(storedKeys, getProcessEnv(), keyToEnv);
@@ -199,7 +286,9 @@ async function handleCredentialsUpload(options, ctx) {
 			keys: [...storedKeys],
 			verifyKeys: [...authKeys],
 			values,
-			connectionKind: entry.connectionKind
+			credentialConnectionId: selectedConnection.id,
+			connection: selectedConnection,
+			connectionKind: selectedConnection.kind
 		}];
 	} else {
 		const manifests = await readManifestsFromOutDir(projectRoot);
@@ -218,7 +307,20 @@ async function handleCredentialsUpload(options, ctx) {
 				const keyToEnv = envMap?.[group.credentialSetId];
 				const values = resolveCredentialValuesFromEnv(group.keys, env, keyToEnv);
 				if (values) {
-					const info = catalog.byResolvedCredentialSetId.get(group.credentialSetId);
+					const info = catalog.byCredentialDefinitionId.get(group.credentialSetId);
+					const catalogEntry = info?.role === "connection" && info.integrationPublicId ? catalog.lookupByPublicId(info.integrationPublicId) : void 0;
+					const selectedConnection = catalogEntry ? selectUploadConnection({
+						entry: catalogEntry,
+						requestedCredentialConnectionId: options.credentialConnectionId
+					}) : null;
+					if (catalogEntry && !selectedConnection) {
+						skipped.push({
+							credentialSetId: group.credentialSetId,
+							displayName: getCredentialDisplayName(catalog, group.credentialSetId),
+							reason: "no uploadable connection; use keystroke connect for OAuth-only integrations"
+						});
+						continue;
+					}
 					toUpload.push({
 						credentialSetId: group.credentialSetId,
 						displayName: getCredentialDisplayName(catalog, group.credentialSetId),
@@ -226,7 +328,9 @@ async function handleCredentialsUpload(options, ctx) {
 						keys: group.keys,
 						values,
 						...fingerprintByCredentialSetId.get(group.credentialSetId) ? { schemaFingerprint: fingerprintByCredentialSetId.get(group.credentialSetId) } : {},
-						...info?.connectionKind ? { connectionKind: info.connectionKind } : {}
+						...selectedConnection ? { credentialConnectionId: selectedConnection.id } : {},
+						...selectedConnection ? { connection: selectedConnection } : {},
+						...selectedConnection?.kind ? { connectionKind: selectedConnection.kind } : info?.connectionKind ? { connectionKind: info.connectionKind } : {}
 					});
 				} else {
 					const missingEnvVars = resolveExpectedEnvVarNames(group.credentialSetId, group.keys, envMap);
@@ -262,6 +366,8 @@ async function handleCredentialsUpload(options, ctx) {
 				items: toUpload.map((item) => ({
 					credentialSetId: item.credentialSetId,
 					displayName: item.displayName,
+					...item.credentialConnectionId ? { credentialConnectionId: item.credentialConnectionId } : {},
+					...item.connection ? { connection: connectionToJson(item.connection) } : {},
 					scope,
 					keys: item.keys,
 					envVars: Object.fromEntries(resolveEnvVarStatus(item.keys, item.credentialSetId, envMap, env).map((s) => [s.key, {
@@ -277,6 +383,7 @@ async function handleCredentialsUpload(options, ctx) {
 		for (const item of toUpload) {
 			const envDetails = resolveEnvVarStatus(item.keys, item.credentialSetId, envMap, env).map((s) => `${s.envVar} (${s.present ? "set" : "missing"})`).join(", ");
 			ui.text(`  - ${item.displayName} (${item.keys.length} key(s)): ${envDetails}`);
+			renderConnectionHints(item.connection);
 		}
 		renderSkippedCredentials(skipped);
 		return;
@@ -289,6 +396,7 @@ async function handleCredentialsUpload(options, ctx) {
 			try {
 				const exchangeResponse = await client.credentials.exchange({
 					credentialSetId: item.credentialSetId,
+					...item.credentialConnectionId ? { credentialConnectionId: item.credentialConnectionId } : {},
 					input: item.values,
 					scope,
 					...projectId ? { projectId } : {},
@@ -307,6 +415,7 @@ async function handleCredentialsUpload(options, ctx) {
 				results.push({
 					requestedCredentialSetId: item.displayName,
 					uploadedCredentialSetId: exchangeResponse.credentialSetId,
+					credentialConnectionId: exchangeResponse.credentialConnectionId,
 					action: "created",
 					scope,
 					verified: true,
@@ -356,6 +465,7 @@ async function handleCredentialsUpload(options, ctx) {
 				organizationId,
 				projectId,
 				credentialSetId: item.credentialSetId,
+				...item.credentialConnectionId ? { credentialConnectionId: item.credentialConnectionId } : {},
 				name: credName,
 				values: item.values,
 				updateExisting: options.update,
@@ -383,6 +493,7 @@ async function handleCredentialsUpload(options, ctx) {
 			results.push({
 				requestedCredentialSetId: item.displayName,
 				uploadedCredentialSetId: result.credentialSetId,
+				...item.credentialConnectionId ? { credentialConnectionId: item.credentialConnectionId } : {},
 				action: result.action,
 				scope,
 				verified,

package/dist/{users.get.handler-CzaYM2bi.mjs → users.get.handler-B20PMSbl.mjs}

@@ -2,7 +2,7 @@
 
 import { n as ui } from "./keystroke.mjs";
 import { i as writeJson } from "./output-CGdYhH0p.mjs";
-import { i as requireClient } from "./context-1VgRbzr-.mjs";
+import { i as requireClient } from "./context-DQ4IA0yO.mjs";
 import { n as isIamJsonMode, t as handleIamError } from "./iam-command-utils-ByLX0A-V.mjs";
 //#region src/commands/admin/users.get.handler.ts
 async function handleAdminUsersGet(options, ctx) {

package/dist/{users.list.handler-CpOWwzBb.mjs → users.list.handler-BplFTjv3.mjs}

@@ -2,7 +2,7 @@
 
 import { n as ui } from "./keystroke.mjs";
 import { i as writeJson } from "./output-CGdYhH0p.mjs";
-import { i as requireClient } from "./context-1VgRbzr-.mjs";
+import { i as requireClient } from "./context-DQ4IA0yO.mjs";
 import { n as isIamJsonMode, t as handleIamError } from "./iam-command-utils-ByLX0A-V.mjs";
 import Table from "cli-table3";
 //#region src/commands/admin/users.list.handler.ts

package/dist/{users.set-role.handler-BjiSNP2d.mjs → users.set-role.handler-wdmI6o3G.mjs}

@@ -2,7 +2,7 @@
 
 import { n as ui } from "./keystroke.mjs";
 import { i as writeJson } from "./output-CGdYhH0p.mjs";
-import { i as requireClient } from "./context-1VgRbzr-.mjs";
+import { i as requireClient } from "./context-DQ4IA0yO.mjs";
 import { n as isIamJsonMode, r as requireConfirmation, t as handleIamError } from "./iam-command-utils-ByLX0A-V.mjs";
 //#region src/commands/admin/users.set-role.handler.ts
 async function handleAdminUsersSetRole(options, ctx) {

package/dist/{utils-C_qCshBA.mjs → utils-DpEtybzI.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
-import { i as readProjectConfig } from "./project-config-D9eFU8Jk.mjs";
-import { h as resolveBuildOutputDir } from "./layout-CXkZEsXI.mjs";
+import { i as readProjectConfig } from "./project-config-CJGSh2RQ.mjs";
+import { h as resolveBuildOutputDir } from "./layout-DRf9qUf8.mjs";
 import path from "node:path";
 //#region ../../packages/project-config/src/utils.ts
 function resolveConfiguredBuildOutputDir(projectRoot, buildConfig) {

package/dist/{validate.handler-BtDSKAFY.mjs → validate.handler-DSAvNgns.mjs}

@@ -3,9 +3,9 @@
 import { N as throwReportedCliExit, n as ui, x as toErrorMessage } from "./keystroke.mjs";
 import { d as trackProject } from "./dist-BF6r1hfv.mjs";
 import { i as writeJson } from "./output-CGdYhH0p.mjs";
-import { t as requireWorkflowsDir } from "./resolve-project-C6UAOfAG.mjs";
-import { s as build, t as WorkflowNotFoundError } from "./workflow-build-Z2_jkOsZ.mjs";
-import { t as createBuildProgress } from "./build-progress-DigAP-BN.mjs";
+import { t as requireWorkflowsDir } from "./resolve-project-bVPMcs-y.mjs";
+import { s as build, t as WorkflowNotFoundError } from "./workflow-build-Cmu1TOFu.mjs";
+import { t as createBuildProgress } from "./build-progress-CITED2tv.mjs";
 import { mkdtemp, rm } from "node:fs/promises";
 import * as os from "node:os";
 import * as path$1 from "node:path";

package/dist/{workflow-build-Z2_jkOsZ.mjs → workflow-build-Cmu1TOFu.mjs}

@@ -3,19 +3,19 @@
 import { i as __toESM, n as __exportAll } from "./chunk-CH6r78ws.mjs";
 import { d as originalConsole, f as ANSI, n as ui, p as style, u as logger, x as toErrorMessage } from "./keystroke.mjs";
 import { a as getKeystrokeTmpDir } from "./dist-BF6r1hfv.mjs";
-import { t as assertWorkflowProjectRoot } from "./project-config-D9eFU8Jk.mjs";
-import { a as FlowGraphSchema, i as WorkflowManifestSchema } from "./workflow-manifest-BfL74mjp.mjs";
-import { t as AgentVersionManifestSchema } from "./agent-manifest-sJFbH5H8.mjs";
-import { r as RelativeFilePathSchema } from "./file-metadata-BvGM-B2v.mjs";
-import { c as createArtifactOutputFiles, l as createMetadataOutputFile, o as METADATA_ROOT_DIR_NAME, p as getWorkflowArtifactPaths, t as BUILD_DIR_NAME } from "./layout-CXkZEsXI.mjs";
-import { t as resolveConfiguredBuildOutputDir } from "./utils-C_qCshBA.mjs";
-import { a as readAgentSandboxPackage, r as AGENT_VM_TOOLS_RUNTIME_RELATIVE_PATH } from "./agent-bundle-package-DWV6B_5q-B-qzc3zC.mjs";
-import { a as prewarmFileContentCache, c as typedEntries, i as createFileContentCache, l as require_out, n as computeBuilderFingerprint, o as resetFileContentCache, r as computeWorkflowFingerprint, s as sha256String } from "./metadata-layout-C6ed-9dl-C6Bylr_z.mjs";
-import { a as getAgentArtifactPaths, c as hashWorkflowManifestForDisk, d as resolveOutputDir, i as createAgentOutputFiles, l as removeAgentArtifacts, n as BUILD_CACHE_FILE_NAME, o as hashAgentManifestForDisk, r as allOutputFilesExist, s as hashWorkflowFlowForDisk, t as AGENT_ARTIFACT_DIR_PREFIX, u as removeWorkflowArtifacts } from "./writer-CtvttJdP-DZJ0mZCm.mjs";
-import { a as createDiscoveryFailure, c as createNamespaceStarExportDiscoveryError, d as isWorkflowLoadResult, f as loadWorkflowMetadataBatch, i as createAmbiguousExportDiscoveryError, l as isAgentLoadResult, o as createDuplicateWorkflowIdFailure, t as DuplicateWorkflowIdError, u as isTaskLoadResult } from "./import-module-DDPnzlJ1-BIBSgOhK.mjs";
-import { a as literalString, n as identifierName, o as parseSourceFile, r as isNode } from "./oxc-B3KI3rf_-ghZc3xZ5.mjs";
-import { a as getLocalModuleSpecifier, c as removeAllMetadataArtifacts, d as resolveDefaultExportAssignment, f as resolveLocalModulePath, i as collectWorkflowImportNames, n as DISCOVERY_IGNORE, o as getVariableDeclarators, r as collectLocalWorkflowBindings, s as isExportedVariableStatement, t as DISCOVERY_GLOB, u as removeMetadataArtifacts } from "./source-analysis-DEEChuND-Csu0oOlw.mjs";
-import { n as parseRelativeFilePath } from "./normalize-path-CojS-CgQ-D_WTiHKw.mjs";
+import { t as assertWorkflowProjectRoot } from "./project-config-CJGSh2RQ.mjs";
+import { a as FlowGraphSchema, r as WorkflowBuildManifestSchema } from "./workflow-build-manifest-OPFqFD6f.mjs";
+import { t as AgentVersionManifestSchema } from "./agent-manifest-CZdlCTFs.mjs";
+import { r as RelativeFilePathSchema } from "./file-metadata-Dwy9KKq_.mjs";
+import { c as createArtifactOutputFiles, l as createMetadataOutputFile, o as METADATA_ROOT_DIR_NAME, p as getWorkflowArtifactPaths, t as BUILD_DIR_NAME } from "./layout-DRf9qUf8.mjs";
+import { t as resolveConfiguredBuildOutputDir } from "./utils-DpEtybzI.mjs";
+import { a as readAgentSandboxPackage, r as AGENT_VM_TOOLS_RUNTIME_RELATIVE_PATH } from "./agent-bundle-package-DWV6B_5q-cB76j6UL.mjs";
+import { a as prewarmFileContentCache, c as typedEntries, i as createFileContentCache, l as require_out, n as computeBuilderFingerprint, o as resetFileContentCache, r as computeWorkflowFingerprint, s as sha256String } from "./metadata-layout-C6ed-9dl-EF5pCtIH.mjs";
+import { a as getAgentArtifactPaths, c as hashWorkflowManifestForDisk, d as resolveOutputDir, i as createAgentOutputFiles, l as removeAgentArtifacts, n as BUILD_CACHE_FILE_NAME, o as hashAgentManifestForDisk, r as allOutputFilesExist, s as hashWorkflowFlowForDisk, t as AGENT_ARTIFACT_DIR_PREFIX, u as removeWorkflowArtifacts } from "./writer-CtvttJdP-BfNsrheU.mjs";
+import { a as createDiscoveryFailure, c as createNamespaceStarExportDiscoveryError, d as isWorkflowLoadResult, f as loadWorkflowMetadataBatch, i as createAmbiguousExportDiscoveryError, l as isAgentLoadResult, o as createDuplicateWorkflowIdFailure, t as DuplicateWorkflowIdError, u as isTaskLoadResult } from "./import-module-DEI7R8Yh-Xz-KAPvB.mjs";
+import { a as literalString, n as identifierName, o as parseSourceFile, r as isNode } from "./oxc-B3KI3rf_-CHDUXsus.mjs";
+import { a as getLocalModuleSpecifier, c as removeAllMetadataArtifacts, d as resolveDefaultExportAssignment, f as resolveLocalModulePath, i as collectWorkflowImportNames, n as DISCOVERY_IGNORE, o as getVariableDeclarators, r as collectLocalWorkflowBindings, s as isExportedVariableStatement, t as DISCOVERY_GLOB, u as removeMetadataArtifacts } from "./source-analysis-DTnwNwKq-DoBxUDCg.mjs";
+import { n as parseRelativeFilePath } from "./normalize-path-CojS-CgQ-D5D0AIHR.mjs";
 import * as fs from "node:fs/promises";
 import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
 import * as path$1 from "node:path";
@@ -24,8 +24,7 @@ import { fileURLToPath } from "node:url";
 import { z } from "zod";
 import { createHash } from "node:crypto";
 import { performance } from "node:perf_hooks";
-//#region ../../packages/core/dist/flow-graph-toolkit/index.mjs
-var import_out = /* @__PURE__ */ __toESM(require_out(), 1);
+//#region ../../packages/workflow-builder/dist/pipeline/flow-graph-toolkit.mjs
 function detectAgentInPathCycles(input) {
 	const nodes = /* @__PURE__ */ new Map();
 	const edges = /* @__PURE__ */ new Map();
@@ -71,7 +70,8 @@ function toCycleNode(node) {
 	};
 }
 //#endregion
-//#region ../../packages/workflow-builder/dist/build-CQCgOqoE.mjs
+//#region ../../packages/workflow-builder/dist/build-D3_BXR_1.mjs
+var import_out = /* @__PURE__ */ __toESM(require_out(), 1);
 const DiscoveredWorkflowSchema = z.object({
 	exportFilePath: z.string(),
 	resolvedFilePath: z.string(),
@@ -177,7 +177,7 @@ async function loadCachedArtifact(outputDir, discoveredWorkflow, cachedEntry) {
 		]);
 		if (sha256String(manifestText) !== cachedEntry.manifestHash) return null;
 		if (sha256String(flowText) !== cachedEntry.flowGraphHash) return null;
-		const manifest = WorkflowManifestSchema.parse(JSON.parse(manifestText));
+		const manifest = WorkflowBuildManifestSchema.parse(JSON.parse(manifestText));
 		const flowGraph = FlowGraphSchema.parse(JSON.parse(flowText));
 		if (manifest.id !== cachedEntry.workflowId) return null;
 		if (path.basename(artifactPaths.workflowDir) !== manifest.id) return null;
@@ -909,25 +909,25 @@ function assertUniqueAgentIds(artifacts) {
 	}
 }
 var DuplicateCredentialSetIdError = class extends Error {
-	resolvedCredentialSetId;
+	credentialDefinitionId;
 	files;
 	constructor(options) {
-		super(`Duplicate credential set resolved ID "${options.resolvedCredentialSetId}" found in ${options.files.join(" and ")}`);
+		super(`Duplicate credential definition id "${options.credentialDefinitionId}" found in ${options.files.join(" and ")}`);
 		this.name = "DuplicateCredentialSetIdError";
-		this.resolvedCredentialSetId = options.resolvedCredentialSetId;
+		this.credentialDefinitionId = options.credentialDefinitionId;
 		this.files = [...options.files];
 	}
 };
-function assertUniqueCredentialSetDefinitionResolvedIds(analyzedFiles) {
+function assertUniqueCredentialSetDefinitionIds(analyzedFiles) {
 	const seen = /* @__PURE__ */ new Map();
 	for (const analyzedFile of analyzedFiles) for (const credentialSet of analyzedFile.definitions.credentialSets) {
-		if (!credentialSet.resolvedCredentialSetId) continue;
-		const existing = seen.get(credentialSet.resolvedCredentialSetId);
+		if (!credentialSet.credentialDefinitionId) continue;
+		const existing = seen.get(credentialSet.credentialDefinitionId);
 		if (existing && existing !== analyzedFile.filePath) throw new DuplicateCredentialSetIdError({
-			resolvedCredentialSetId: credentialSet.resolvedCredentialSetId,
+			credentialDefinitionId: credentialSet.credentialDefinitionId,
 			files: [existing, analyzedFile.filePath]
 		});
-		seen.set(credentialSet.resolvedCredentialSetId, analyzedFile.filePath);
+		seen.set(credentialSet.credentialDefinitionId, analyzedFile.filePath);
 	}
 }
 function assertNotReservedWorkflowId(artifact) {
@@ -978,7 +978,7 @@ async function buildDiscoveredWorkflows(options) {
 	const failures = [...buildPlan.failures];
 	const warnings = [];
 	if (buildPlan.workflows.length > 0) {
-		const { buildWorkflowArtifacts } = await import("./build-workflows-3fdvdHHf-BDTy9QgT.mjs");
+		const { buildWorkflowArtifacts } = await import("./build-workflows-Dmzay1vP-DKVuBAjD.mjs");
 		const result = await buildWorkflowArtifacts({
 			entries: buildPlan.workflows,
 			workflowsByKey,
@@ -993,7 +993,7 @@ async function buildDiscoveredWorkflows(options) {
 		warnings.push(...result.warnings);
 	}
 	if (buildPlan.agents.length > 0) {
-		const { buildAgentArtifacts } = await import("./build-agents-DfbiMZ_e-CgnKa9A6.mjs");
+		const { buildAgentArtifacts } = await import("./build-agents-DseUtzd4-DIDGsZWL.mjs");
 		const result = await buildAgentArtifacts({
 			entries: buildPlan.agents,
 			projectRoot: options.projectRoot
@@ -1002,7 +1002,7 @@ async function buildDiscoveredWorkflows(options) {
 		failures.push(...result.failures);
 	}
 	if (buildPlan.tasks.length > 0) {
-		const { buildTaskArtifacts } = await import("./build-tasks-O1jYtlv1-Bkw0w1r3.mjs");
+		const { buildTaskArtifacts } = await import("./build-tasks-GVuMLS0h-DnS9QWzf.mjs");
 		const result = await buildTaskArtifacts({
 			entries: buildPlan.tasks,
 			projectRoot: options.projectRoot,
@@ -1110,7 +1110,7 @@ async function createBuildPlan(options) {
 		const currentWorkflowIndex = workflowProgressIndex;
 		workflowProgressIndex += 1;
 		if (!loadResult?.ok) {
-			const { createWorkflowMetadataFailure } = await import("./build-workflows-3fdvdHHf-BDTy9QgT.mjs");
+			const { createWorkflowMetadataFailure } = await import("./build-workflows-Dmzay1vP-DKVuBAjD.mjs");
 			plan.failures.push(createWorkflowMetadataFailure(discoveredWorkflow, loadResult?.error));
 			continue;
 		}
@@ -1308,7 +1308,7 @@ async function runBuild(config, initialTargetBindingKeys, metadataRebuildDecisio
 			cacheResolvedBindingKeys,
 			releaseBundleMemory: config.releaseBundleMemory
 		};
-		const { writeBuildOutput, writeTargetedBuildOutput } = await import("./writer-CtvttJdP-DZJ0mZCm.mjs").then((n) => n.f).then((n) => n.t);
+		const { writeBuildOutput, writeTargetedBuildOutput } = await import("./writer-CtvttJdP-BfNsrheU.mjs").then((n) => n.f).then((n) => n.t);
 		const writeResult = targetBindingKeys ? await writeTargetedBuildOutput({
 			artifacts: finalizedScopedArtifacts,
 			agentArtifacts,
@@ -1333,7 +1333,7 @@ async function runBuild(config, initialTargetBindingKeys, metadataRebuildDecisio
 			elapsedMs: performance.now() - writeStartedAt,
 			...writeResult.skippedWriteCount !== void 0 && writeResult.skippedWriteCount > 0 ? { skippedWriteCount: writeResult.skippedWriteCount } : {}
 		});
-		const { buildMetadataArtifacts } = await import("./build-metadata-zidV9Cai-Bq37kBOM.mjs");
+		const { buildMetadataArtifacts } = await import("./build-metadata-qebrtraZ-D4SQNsBw.mjs");
 		const metadata = await buildMetadataArtifacts({
 			projectRoot: config.projectRoot,
 			outputDir,
@@ -1362,7 +1362,7 @@ async function runBuild(config, initialTargetBindingKeys, metadataRebuildDecisio
 			errors: conventionErrors
 		});
 		try {
-			assertUniqueCredentialSetDefinitionResolvedIds(metadata.analyzedFacts);
+			assertUniqueCredentialSetDefinitionIds(metadata.analyzedFacts);
 		} catch (error) {
 			if (error instanceof Error) failures.push({
 				kind: "convention",

package/dist/{workflow-manifest-BfL74mjp.mjs → workflow-build-manifest-OPFqFD6f.mjs}

@@ -1,11 +1,10 @@
 #!/usr/bin/env node
 
-import { r as SHA256HashSchema, t as JsonSchemaSchema } from "./common-B3bLe3Mk.mjs";
-import { a as ResolvedCredentialSetSchema, c as TriggerTypeSchema, d as WorkflowStepEntrySchema, i as IntegrationScopeSchema, l as TriggerUploadDataSchema, t as CredentialRequirementsSchema } from "./credential-requirements-BCW8aQWS.mjs";
-import { a as SourceLocationSchema, i as ImportSourceSchema, n as CallsiteFingerprintSchema, t as CallKindSchema } from "./source-analysis-CHkWMC40.mjs";
-import { t as DurationSchema } from "./schedule-BWAI6qLx.mjs";
+import { n as SHA256HashSchema, t as JsonSchemaSchema } from "./common-BaGFkj3n.mjs";
+import { a as SourceLocationSchema, i as ImportSourceSchema, n as CallsiteFingerprintSchema, t as CallKindSchema } from "./source-analysis-CJPymdaA.mjs";
+import { c as TriggerUploadDataSchema, i as ResolvedCredentialSetSchema, r as IntegrationScopeSchema, t as CredentialRequirementsSchema, u as WorkflowStepEntrySchema } from "./credential-requirements-FtBk5JVB.mjs";
 import { z } from "zod";
-//#region ../../packages/core/src/artifacts/flow-graph-schema.ts
+//#region ../../packages/workflow-build-contracts/src/flow-graph-schema.ts
 const DecisionKindSchema = z.enum([
 	"if",
 	"switch",
@@ -171,11 +170,10 @@ const FlowGraphSchema = z.object({
 	diagnostics: z.array(z.string())
 });
 //#endregion
-//#region ../../packages/core/src/artifacts/workflow-manifest.ts
+//#region ../../packages/workflow-build-contracts/src/workflow-build-manifest.ts
 const WORKFLOW_MANIFEST_GENERATOR = "local-build";
 const WORKFLOW_MANIFEST_SCHEMA_VERSION = "1.0.0";
-/** Shared identity fields for a workflow. Single source of truth for name/description/tags validation. */
-const WorkflowIdentitySchema = z.object({
+z.object({
 	name: z.string().trim().min(1).max(255),
 	description: z.string().trim().min(1).optional(),
 	tags: z.array(z.string()).optional()
@@ -202,40 +200,40 @@ const BuildInfoSchema = z.object({
 	sourceChecksum: z.string().length(64),
 	generatedFiles: z.array(z.string().min(1))
 });
-/** Trigger binding data included in workflow manifests. */
+const ManifestDependenciesSchema = z.object({
+	localFiles: z.record(z.string(), z.string()),
+	packages: z.record(z.string(), z.string()),
+	workspacePackages: z.record(z.string(), z.string()),
+	builtins: z.array(z.string())
+});
+const DurationSchema = z.union([z.number().int().positive().finite(), z.string().regex(/^[1-9]\d*[smhdwy]$/)]);
 const WorkflowTriggerBindingSchema = z.object({
 	triggerName: z.string().min(1),
-	triggerType: TriggerTypeSchema,
+	triggerType: z.enum([
+		"webhook",
+		"cron",
+		"polling"
+	]),
 	hasTransform: z.boolean(),
 	hasFilter: z.boolean(),
 	narrowedFrom: z.string().optional(),
 	lineage: z.array(z.string()).optional()
 });
-/** What a Workflow primitive knows about itself at construction time. Every field is real — no placeholders. */
-const WorkflowCoreManifestSchema = WorkflowIdentitySchema.extend({
+const WorkflowCoreManifestSchema = z.object({
 	schemaVersion: z.literal(WORKFLOW_MANIFEST_SCHEMA_VERSION),
 	id: z.string().min(1),
+	name: z.string().trim().min(1).max(255),
+	description: z.string().trim().min(1).optional(),
+	tags: z.array(z.string()).optional(),
 	exportName: z.string().min(1),
 	workflowSchemas: WorkflowIOSchema,
 	workflowGlobals: JsonSchemaSchema.optional(),
 	timeout: DurationSchema.optional(),
-	buildInfo: BuildInfoSchema,
 	triggers: z.array(WorkflowTriggerBindingSchema).optional()
 });
-/** Categorized dependency tracking for workflow manifests */
-const ManifestDependenciesSchema = z.object({
-	/** Local source files: relative path (from project root) -> SHA256 content hash */
-	localFiles: z.record(z.string(), z.string()),
-	/** npm packages: package name -> declared version from package.json */
-	packages: z.record(z.string(), z.string()),
-	/** Workspace packages: @keystroke/* name -> version specifier */
-	workspacePackages: z.record(z.string(), z.string()),
-	/** Node.js built-in module specifiers (e.g., "node:fs") */
-	builtins: z.array(z.string())
-});
-/** Complete build-enriched manifest. Extends core with steps, dependencies, and credentials discovered by the build pipeline. */
-const WorkflowManifestSchema = WorkflowCoreManifestSchema.extend({
+const WorkflowBuildManifestSchema = WorkflowCoreManifestSchema.extend({
 	workflowSource: SourceLocationSchema.optional(),
+	buildInfo: BuildInfoSchema,
 	dependencies: ManifestDependenciesSchema,
 	hasCycles: z.boolean().optional(),
 	credentials: CredentialRequirementsSchema.optional(),
@@ -246,7 +244,7 @@ z.object({
 	organizationId: z.string(),
 	workflowId: z.string(),
 	bundle: z.instanceof(Uint8Array).optional(),
-	manifest: WorkflowManifestSchema,
+	manifest: WorkflowBuildManifestSchema,
 	sourcePath: z.string().optional(),
 	triggers: z.array(TriggerUploadDataSchema).optional(),
 	bundleSize: z.number().optional(),
@@ -258,4 +256,4 @@ z.object({
 	deploymentSnapshotOnly: z.boolean().optional()
 });
 //#endregion
-export { FlowGraphSchema as a, WorkflowManifestSchema as i, WORKFLOW_MANIFEST_SCHEMA_VERSION as n, WorkflowCoreManifestSchema as r, WORKFLOW_MANIFEST_GENERATOR as t };
+export { FlowGraphSchema as a, WorkflowCoreManifestSchema as i, WORKFLOW_MANIFEST_SCHEMA_VERSION as n, WorkflowBuildManifestSchema as r, WORKFLOW_MANIFEST_GENERATOR as t };

package/dist/{workflow-bundler-BzHk73PM-tt09RbIA.mjs → workflow-bundler-BzHk73PM-UJQa7Ubk.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
-import { n as identifierName, o as parseSourceFile, r as isNode } from "./oxc-B3KI3rf_-ghZc3xZ5.mjs";
-import { r as formatEnvAccessError, t as createEnvAccessPlugin } from "./detect-env-access-CwkOYeYM-D4o8gRZs.mjs";
+import { n as identifierName, o as parseSourceFile, r as isNode } from "./oxc-B3KI3rf_-CHDUXsus.mjs";
+import { r as formatEnvAccessError, t as createEnvAccessPlugin } from "./detect-env-access-CwkOYeYM-EmkYvbfJ.mjs";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import * as path$1 from "node:path";
 import { createHash } from "node:crypto";