@keystrokehq/cli 0.0.18 → 0.0.20

package/dist/task-BSCN9cU4.mjs

@@ -0,0 +1,945 @@
+#!/usr/bin/env node
+
+import { n as __exportAll } from "./chunk-DYxdGL9S.mjs";
+import { a as descriptionString, c as optionalDescriptionString, d as trimmedNonEmptyStringUnbounded, i as createStructuralSchema, n as credentialSetProxyConfigSchema, o as idNoSpacesString, s as jsonSchemaObject, t as CredentialSetManifestSchema, u as trimmedNonEmptyString } from "./schemas-U2OzP9gP.mjs";
+import { z } from "zod";
+import "node:crypto";
+const SHA256HashSchema = z.string().length(64, "Must be 64 characters").regex(/^[a-f0-9]{64}$/i, "Must be hexadecimal").transform((value) => value);
+const JsonSchemaSchema = z.record(z.string(), z.unknown());
+z.object({
+	constant: z.object({
+		attempts: z.number().int().min(1).max(10),
+		seconds: z.number().positive()
+	}).optional(),
+	exponential: z.object({
+		attempts: z.number().int().min(1).max(10),
+		base: z.number().min(1).optional(),
+		multiplier: z.number().positive().optional()
+	}).optional()
+}).refine((data) => {
+	return data.constant !== void 0 !== (data.exponential !== void 0);
+}, { error: "Retry config must specify exactly one of constant or exponential strategy" });
+//#endregion
+//#region ../../node_modules/.pnpm/cron-schedule@6.0.0/node_modules/cron-schedule/dist/utils.js
+function extractDateElements(date) {
+	return {
+		second: date.getSeconds(),
+		minute: date.getMinutes(),
+		hour: date.getHours(),
+		day: date.getDate(),
+		month: date.getMonth(),
+		weekday: date.getDay(),
+		year: date.getFullYear()
+	};
+}
+function getDaysInMonth(year, month) {
+	return new Date(year, month + 1, 0).getDate();
+}
+function getDaysBetweenWeekdays(weekday1, weekday2) {
+	if (weekday1 <= weekday2) return weekday2 - weekday1;
+	return 6 - weekday1 + weekday2 + 1;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/cron-schedule@6.0.0/node_modules/cron-schedule/dist/cron.js
+var Cron = class {
+	constructor({ seconds, minutes, hours, days, months, weekdays }) {
+		if (!seconds || seconds.size === 0) throw new Error("There must be at least one allowed second.");
+		if (!minutes || minutes.size === 0) throw new Error("There must be at least one allowed minute.");
+		if (!hours || hours.size === 0) throw new Error("There must be at least one allowed hour.");
+		if (!months || months.size === 0) throw new Error("There must be at least one allowed month.");
+		if ((!weekdays || weekdays.size === 0) && (!days || days.size === 0)) throw new Error("There must be at least one allowed day or weekday.");
+		this.seconds = Array.from(seconds).sort((a, b) => a - b);
+		this.minutes = Array.from(minutes).sort((a, b) => a - b);
+		this.hours = Array.from(hours).sort((a, b) => a - b);
+		this.days = Array.from(days).sort((a, b) => a - b);
+		this.months = Array.from(months).sort((a, b) => a - b);
+		this.weekdays = Array.from(weekdays).sort((a, b) => a - b);
+		const validateData = (name, data, constraint) => {
+			if (data.some((x) => typeof x !== "number" || x % 1 !== 0 || x < constraint.min || x > constraint.max)) throw new Error(`${name} must only consist of integers which are within the range of ${constraint.min} and ${constraint.max}`);
+		};
+		validateData("seconds", this.seconds, {
+			min: 0,
+			max: 59
+		});
+		validateData("minutes", this.minutes, {
+			min: 0,
+			max: 59
+		});
+		validateData("hours", this.hours, {
+			min: 0,
+			max: 23
+		});
+		validateData("days", this.days, {
+			min: 1,
+			max: 31
+		});
+		validateData("months", this.months, {
+			min: 0,
+			max: 11
+		});
+		validateData("weekdays", this.weekdays, {
+			min: 0,
+			max: 6
+		});
+		this.reversed = {
+			seconds: this.seconds.map((x) => x).reverse(),
+			minutes: this.minutes.map((x) => x).reverse(),
+			hours: this.hours.map((x) => x).reverse(),
+			days: this.days.map((x) => x).reverse(),
+			months: this.months.map((x) => x).reverse(),
+			weekdays: this.weekdays.map((x) => x).reverse()
+		};
+	}
+	/**
+	* Find the next or previous hour, starting from the given start hour that matches the hour constraint.
+	* startHour itself might also be allowed.
+	*/
+	findAllowedHour(dir, startHour) {
+		return dir === "next" ? this.hours.find((x) => x >= startHour) : this.reversed.hours.find((x) => x <= startHour);
+	}
+	/**
+	* Find the next or previous minute, starting from the given start minute that matches the minute constraint.
+	* startMinute itself might also be allowed.
+	*/
+	findAllowedMinute(dir, startMinute) {
+		return dir === "next" ? this.minutes.find((x) => x >= startMinute) : this.reversed.minutes.find((x) => x <= startMinute);
+	}
+	/**
+	* Find the next or previous second, starting from the given start second that matches the second constraint.
+	* startSecond itself IS NOT allowed.
+	*/
+	findAllowedSecond(dir, startSecond) {
+		return dir === "next" ? this.seconds.find((x) => x > startSecond) : this.reversed.seconds.find((x) => x < startSecond);
+	}
+	/**
+	* Find the next or previous time, starting from the given start time that matches the hour, minute
+	* and second constraints. startTime itself might also be allowed.
+	*/
+	findAllowedTime(dir, startTime) {
+		let hour = this.findAllowedHour(dir, startTime.hour);
+		if (hour !== void 0) if (hour === startTime.hour) {
+			let minute = this.findAllowedMinute(dir, startTime.minute);
+			if (minute !== void 0) if (minute === startTime.minute) {
+				const second = this.findAllowedSecond(dir, startTime.second);
+				if (second !== void 0) return {
+					hour,
+					minute,
+					second
+				};
+				minute = this.findAllowedMinute(dir, dir === "next" ? startTime.minute + 1 : startTime.minute - 1);
+				if (minute !== void 0) return {
+					hour,
+					minute,
+					second: dir === "next" ? this.seconds[0] : this.reversed.seconds[0]
+				};
+			} else return {
+				hour,
+				minute,
+				second: dir === "next" ? this.seconds[0] : this.reversed.seconds[0]
+			};
+			hour = this.findAllowedHour(dir, dir === "next" ? startTime.hour + 1 : startTime.hour - 1);
+			if (hour !== void 0) return {
+				hour,
+				minute: dir === "next" ? this.minutes[0] : this.reversed.minutes[0],
+				second: dir === "next" ? this.seconds[0] : this.reversed.seconds[0]
+			};
+		} else return {
+			hour,
+			minute: dir === "next" ? this.minutes[0] : this.reversed.minutes[0],
+			second: dir === "next" ? this.seconds[0] : this.reversed.seconds[0]
+		};
+	}
+	/**
+	* Find the next or previous day in the given month, starting from the given startDay
+	* that matches either the day or the weekday constraint. startDay itself might also be allowed.
+	*/
+	findAllowedDayInMonth(dir, year, month, startDay) {
+		var _a, _b;
+		if (startDay < 1) throw new Error("startDay must not be smaller than 1.");
+		const daysInMonth = getDaysInMonth(year, month);
+		const daysRestricted = this.days.length !== 31;
+		const weekdaysRestricted = this.weekdays.length !== 7;
+		if (!daysRestricted && !weekdaysRestricted) {
+			if (startDay > daysInMonth) return dir === "next" ? void 0 : daysInMonth;
+			return startDay;
+		}
+		let allowedDayByDays;
+		if (daysRestricted) {
+			allowedDayByDays = dir === "next" ? this.days.find((x) => x >= startDay) : this.reversed.days.find((x) => x <= startDay);
+			if (allowedDayByDays !== void 0 && allowedDayByDays > daysInMonth) allowedDayByDays = void 0;
+		}
+		let allowedDayByWeekdays;
+		if (weekdaysRestricted) {
+			const startWeekday = new Date(year, month, startDay).getDay();
+			const nearestAllowedWeekday = dir === "next" ? (_a = this.weekdays.find((x) => x >= startWeekday)) !== null && _a !== void 0 ? _a : this.weekdays[0] : (_b = this.reversed.weekdays.find((x) => x <= startWeekday)) !== null && _b !== void 0 ? _b : this.reversed.weekdays[0];
+			if (nearestAllowedWeekday !== void 0) {
+				const daysBetweenWeekdays = dir === "next" ? getDaysBetweenWeekdays(startWeekday, nearestAllowedWeekday) : getDaysBetweenWeekdays(nearestAllowedWeekday, startWeekday);
+				allowedDayByWeekdays = dir === "next" ? startDay + daysBetweenWeekdays : startDay - daysBetweenWeekdays;
+				if (allowedDayByWeekdays > daysInMonth || allowedDayByWeekdays < 1) allowedDayByWeekdays = void 0;
+			}
+		}
+		if (allowedDayByDays !== void 0 && allowedDayByWeekdays !== void 0) return dir === "next" ? Math.min(allowedDayByDays, allowedDayByWeekdays) : Math.max(allowedDayByDays, allowedDayByWeekdays);
+		if (allowedDayByDays !== void 0) return allowedDayByDays;
+		if (allowedDayByWeekdays !== void 0) return allowedDayByWeekdays;
+	}
+	/** Gets the next date starting from the given start date or now. */
+	getNextDate(startDate = /* @__PURE__ */ new Date()) {
+		const startDateElements = extractDateElements(startDate);
+		let minYear = startDateElements.year;
+		let startIndexMonth = this.months.findIndex((x) => x >= startDateElements.month);
+		if (startIndexMonth === -1) {
+			startIndexMonth = 0;
+			minYear++;
+		}
+		const maxIterations = this.months.length * 5;
+		for (let i = 0; i < maxIterations; i++) {
+			const year = minYear + Math.floor((startIndexMonth + i) / this.months.length);
+			const month = this.months[(startIndexMonth + i) % this.months.length];
+			const isStartMonth = year === startDateElements.year && month === startDateElements.month;
+			let day = this.findAllowedDayInMonth("next", year, month, isStartMonth ? startDateElements.day : 1);
+			let isStartDay = isStartMonth && day === startDateElements.day;
+			if (day !== void 0 && isStartDay) {
+				const nextTime = this.findAllowedTime("next", startDateElements);
+				if (nextTime !== void 0) return new Date(year, month, day, nextTime.hour, nextTime.minute, nextTime.second);
+				day = this.findAllowedDayInMonth("next", year, month, day + 1);
+				isStartDay = false;
+			}
+			if (day !== void 0 && !isStartDay) return new Date(year, month, day, this.hours[0], this.minutes[0], this.seconds[0]);
+		}
+		throw new Error("No valid next date was found.");
+	}
+	/** Gets the specified amount of future dates starting from the given start date or now. */
+	getNextDates(amount, startDate) {
+		const dates = [];
+		let nextDate;
+		for (let i = 0; i < amount; i++) {
+			nextDate = this.getNextDate(nextDate !== null && nextDate !== void 0 ? nextDate : startDate);
+			dates.push(nextDate);
+		}
+		return dates;
+	}
+	/**
+	* Get an ES6 compatible iterator which iterates over the next dates starting from startDate or now.
+	* The iterator runs until the optional endDate is reached or forever.
+	*/
+	*getNextDatesIterator(startDate, endDate) {
+		let nextDate;
+		while (true) {
+			nextDate = this.getNextDate(nextDate !== null && nextDate !== void 0 ? nextDate : startDate);
+			if (endDate && endDate.getTime() < nextDate.getTime()) return;
+			yield nextDate;
+		}
+	}
+	/** Gets the previous date starting from the given start date or now. */
+	getPrevDate(startDate = /* @__PURE__ */ new Date()) {
+		const startDateElements = extractDateElements(startDate);
+		let maxYear = startDateElements.year;
+		let startIndexMonth = this.reversed.months.findIndex((x) => x <= startDateElements.month);
+		if (startIndexMonth === -1) {
+			startIndexMonth = 0;
+			maxYear--;
+		}
+		const maxIterations = this.reversed.months.length * 5;
+		for (let i = 0; i < maxIterations; i++) {
+			const year = maxYear - Math.floor((startIndexMonth + i) / this.reversed.months.length);
+			const month = this.reversed.months[(startIndexMonth + i) % this.reversed.months.length];
+			const isStartMonth = year === startDateElements.year && month === startDateElements.month;
+			let day = this.findAllowedDayInMonth("prev", year, month, isStartMonth ? startDateElements.day : getDaysInMonth(year, month));
+			let isStartDay = isStartMonth && day === startDateElements.day;
+			if (day !== void 0 && isStartDay) {
+				const prevTime = this.findAllowedTime("prev", startDateElements);
+				if (prevTime !== void 0) return new Date(year, month, day, prevTime.hour, prevTime.minute, prevTime.second);
+				if (day > 1) {
+					day = this.findAllowedDayInMonth("prev", year, month, day - 1);
+					isStartDay = false;
+				}
+			}
+			if (day !== void 0 && !isStartDay) return new Date(year, month, day, this.reversed.hours[0], this.reversed.minutes[0], this.reversed.seconds[0]);
+		}
+		throw new Error("No valid previous date was found.");
+	}
+	/** Gets the specified amount of previous dates starting from the given start date or now. */
+	getPrevDates(amount, startDate) {
+		const dates = [];
+		let prevDate;
+		for (let i = 0; i < amount; i++) {
+			prevDate = this.getPrevDate(prevDate !== null && prevDate !== void 0 ? prevDate : startDate);
+			dates.push(prevDate);
+		}
+		return dates;
+	}
+	/**
+	* Get an ES6 compatible iterator which iterates over the previous dates starting from startDate or now.
+	* The iterator runs until the optional endDate is reached or forever.
+	*/
+	*getPrevDatesIterator(startDate, endDate) {
+		let prevDate;
+		while (true) {
+			prevDate = this.getPrevDate(prevDate !== null && prevDate !== void 0 ? prevDate : startDate);
+			if (endDate && endDate.getTime() > prevDate.getTime()) return;
+			yield prevDate;
+		}
+	}
+	/** Returns true when there is a cron date at the given date. */
+	matchDate(date) {
+		const { second, minute, hour, day, month, weekday } = extractDateElements(date);
+		if (this.seconds.indexOf(second) === -1 || this.minutes.indexOf(minute) === -1 || this.hours.indexOf(hour) === -1 || this.months.indexOf(month) === -1) return false;
+		if (this.days.length !== 31 && this.weekdays.length !== 7) return this.days.indexOf(day) !== -1 || this.weekdays.indexOf(weekday) !== -1;
+		return this.days.indexOf(day) !== -1 && this.weekdays.indexOf(weekday) !== -1;
+	}
+};
+//#endregion
+//#region ../../node_modules/.pnpm/cron-schedule@6.0.0/node_modules/cron-schedule/dist/cron-parser.js
+const secondConstraint = {
+	min: 0,
+	max: 59
+};
+const minuteConstraint = {
+	min: 0,
+	max: 59
+};
+const hourConstraint = {
+	min: 0,
+	max: 23
+};
+const dayConstraint = {
+	min: 1,
+	max: 31
+};
+const monthConstraint = {
+	min: 1,
+	max: 12,
+	aliases: {
+		jan: "1",
+		feb: "2",
+		mar: "3",
+		apr: "4",
+		may: "5",
+		jun: "6",
+		jul: "7",
+		aug: "8",
+		sep: "9",
+		oct: "10",
+		nov: "11",
+		dec: "12"
+	}
+};
+const weekdayConstraint = {
+	min: 0,
+	max: 7,
+	aliases: {
+		mon: "1",
+		tue: "2",
+		wed: "3",
+		thu: "4",
+		fri: "5",
+		sat: "6",
+		sun: "7"
+	}
+};
+const timeNicknames = {
+	"@yearly": "0 0 1 1 *",
+	"@annually": "0 0 1 1 *",
+	"@monthly": "0 0 1 * *",
+	"@weekly": "0 0 * * 0",
+	"@daily": "0 0 * * *",
+	"@hourly": "0 * * * *",
+	"@minutely": "* * * * *"
+};
+function parseElement(element, constraint) {
+	const result = /* @__PURE__ */ new Set();
+	if (element === "*") {
+		for (let i = constraint.min; i <= constraint.max; i = i + 1) result.add(i);
+		return result;
+	}
+	const listElements = element.split(",");
+	if (listElements.length > 1) {
+		for (const listElement of listElements) {
+			const parsedListElement = parseElement(listElement, constraint);
+			for (const x of parsedListElement) result.add(x);
+		}
+		return result;
+	}
+	const parseSingleElement = (singleElement) => {
+		var _a, _b;
+		singleElement = (_b = (_a = constraint.aliases) === null || _a === void 0 ? void 0 : _a[singleElement.toLowerCase()]) !== null && _b !== void 0 ? _b : singleElement;
+		const parsedElement = Number.parseInt(singleElement, 10);
+		if (Number.isNaN(parsedElement)) throw new Error(`Failed to parse ${element}: ${singleElement} is NaN.`);
+		if (parsedElement < constraint.min || parsedElement > constraint.max) throw new Error(`Failed to parse ${element}: ${singleElement} is outside of constraint range of ${constraint.min} - ${constraint.max}.`);
+		return parsedElement;
+	};
+	const rangeSegments = /^(([0-9a-zA-Z]+)-([0-9a-zA-Z]+)|\*)(\/([0-9]+))?$/.exec(element);
+	if (rangeSegments === null) {
+		result.add(parseSingleElement(element));
+		return result;
+	}
+	let parsedStart = rangeSegments[1] === "*" ? constraint.min : parseSingleElement(rangeSegments[2]);
+	const parsedEnd = rangeSegments[1] === "*" ? constraint.max : parseSingleElement(rangeSegments[3]);
+	if (constraint === weekdayConstraint && parsedStart === 7 && parsedEnd !== 7) parsedStart = 0;
+	if (parsedStart > parsedEnd) throw new Error(`Failed to parse ${element}: Invalid range (start: ${parsedStart}, end: ${parsedEnd}).`);
+	const step = rangeSegments[5];
+	let parsedStep = 1;
+	if (step !== void 0) {
+		parsedStep = Number.parseInt(step, 10);
+		if (Number.isNaN(parsedStep)) throw new Error(`Failed to parse step: ${step} is NaN.`);
+		if (parsedStep < 1) throw new Error(`Failed to parse step: Expected ${step} to be greater than 0.`);
+	}
+	for (let i = parsedStart; i <= parsedEnd; i = i + parsedStep) result.add(i);
+	return result;
+}
+/** Parses a cron expression into a Cron instance. */
+function parseCronExpression(cronExpression) {
+	var _a;
+	if (typeof cronExpression !== "string") throw new TypeError("Invalid cron expression: must be of type string.");
+	cronExpression = (_a = timeNicknames[cronExpression.toLowerCase()]) !== null && _a !== void 0 ? _a : cronExpression;
+	const elements = cronExpression.split(" ").filter((elem) => elem.length > 0);
+	if (elements.length < 5 || elements.length > 6) throw new Error("Invalid cron expression: expected 5 or 6 elements.");
+	const rawSeconds = elements.length === 6 ? elements[0] : "0";
+	const rawMinutes = elements.length === 6 ? elements[1] : elements[0];
+	const rawHours = elements.length === 6 ? elements[2] : elements[1];
+	const rawDays = elements.length === 6 ? elements[3] : elements[2];
+	const rawMonths = elements.length === 6 ? elements[4] : elements[3];
+	const rawWeekdays = elements.length === 6 ? elements[5] : elements[4];
+	return new Cron({
+		seconds: parseElement(rawSeconds, secondConstraint),
+		minutes: parseElement(rawMinutes, minuteConstraint),
+		hours: parseElement(rawHours, hourConstraint),
+		days: parseElement(rawDays, dayConstraint),
+		months: new Set(Array.from(parseElement(rawMonths, monthConstraint)).map((x) => x - 1)),
+		weekdays: new Set(Array.from(parseElement(rawWeekdays, weekdayConstraint)).map((x) => x % 7))
+	});
+}
+//#endregion
+//#region ../../packages/core/src/shared/schedule.ts
+/**
+* shared/schedule.ts
+*
+* Unified schedule type that supports both simple intervals and cron expressions.
+* Can be used in both cron and polling triggers for maximum flexibility.
+*
+* Template literal types provide compile-time type safety.
+* Zod schemas with refinements provide runtime validation.
+*/
+const DurationSchema = z.union([z.number().int().positive().finite(), z.string().regex(/^[1-9]\d*[smhdwy]$/)]);
+const DurationStringSchema = z.string().refine((val) => /^\d+[smhdwy]$/.test(val), { message: "Invalid duration format. Must be a positive integer followed by s, m, h, d, w, or y (e.g., \"5m\", \"1h\")" }).refine((val) => {
+	const match = val.match(/^(\d+)[smhdwy]$/);
+	if (!match?.[1]) return false;
+	const num = Number.parseInt(match[1], 10);
+	return num > 0 && Number.isFinite(num);
+}, { message: "Duration value must be a positive integer greater than 0" });
+const CronExpressionSchema = z.string().superRefine((val, ctx) => {
+	try {
+		parseCronExpression(val);
+	} catch (error) {
+		const errorMessage = error instanceof Error ? error.message : "Invalid cron expression format";
+		ctx.addIssue({
+			code: "custom",
+			message: `Invalid cron expression: ${errorMessage}. Must be a valid 5-field cron: minute hour day month weekday (e.g., "0 9 * * *", "*/15 * * * *")`
+		});
+	}
+});
+z.union([
+	z.number().refine((val) => val > 0, { message: "Duration in milliseconds must be positive" }).refine(Number.isFinite, { message: "Duration in milliseconds must be finite" }).refine(Number.isInteger, { message: "Duration in milliseconds must be an integer" }),
+	DurationStringSchema,
+	CronExpressionSchema
+]);
+z.enum([
+	"UTC",
+	"GMT",
+	"Etc/UTC",
+	"Etc/GMT",
+	"America/New_York",
+	"America/Chicago",
+	"America/Denver",
+	"America/Los_Angeles",
+	"America/Phoenix",
+	"America/Anchorage",
+	"America/Toronto",
+	"America/Vancouver",
+	"America/Mexico_City",
+	"America/Sao_Paulo",
+	"America/Buenos_Aires",
+	"Europe/London",
+	"Europe/Paris",
+	"Europe/Berlin",
+	"Europe/Rome",
+	"Europe/Madrid",
+	"Europe/Amsterdam",
+	"Europe/Stockholm",
+	"Europe/Vienna",
+	"Europe/Zurich",
+	"Europe/Moscow",
+	"Europe/Athens",
+	"Europe/Dublin",
+	"Asia/Tokyo",
+	"Asia/Shanghai",
+	"Asia/Hong_Kong",
+	"Asia/Singapore",
+	"Asia/Seoul",
+	"Asia/Dubai",
+	"Asia/Kolkata",
+	"Asia/Bangkok",
+	"Asia/Jakarta",
+	"Asia/Manila",
+	"Asia/Taipei",
+	"Australia/Sydney",
+	"Australia/Melbourne",
+	"Australia/Brisbane",
+	"Australia/Perth",
+	"Australia/Adelaide",
+	"Pacific/Auckland",
+	"Pacific/Honolulu",
+	"Africa/Cairo",
+	"Africa/Johannesburg",
+	"Africa/Lagos",
+	"Africa/Nairobi",
+	"Asia/Riyadh",
+	"Asia/Tehran",
+	"Asia/Jerusalem",
+	"Asia/Doha"
+]);
+//#endregion
+//#region ../../packages/core/src/artifacts/source-analysis.ts
+const SourceLocationSchema = z.object({
+	filePath: z.string().min(1),
+	absoluteFilePath: z.string().min(1).optional(),
+	line: z.number().int().positive(),
+	column: z.number().int().positive(),
+	position: z.number().int().nonnegative().optional(),
+	endLine: z.number().int().positive(),
+	endColumn: z.number().int().positive(),
+	endPosition: z.number().int().nonnegative().optional(),
+	synthetic: z.boolean().optional()
+});
+z.string().min(1);
+const ImportSourceSchema = z.object({
+	kind: z.enum([
+		"local",
+		"module-import",
+		"namespace-import",
+		"dynamic"
+	]),
+	moduleSpecifier: z.string().min(1).optional(),
+	importName: z.string().min(1).optional(),
+	localName: z.string().min(1).optional(),
+	resolvedPath: z.string().min(1).optional()
+});
+const CallKindSchema = z.enum([
+	"workflow-step",
+	"agent",
+	"tool",
+	"hook",
+	"child-workflow",
+	"function-call",
+	"method-call",
+	"dynamic-call",
+	"parallel-call",
+	"process-exit",
+	"iife",
+	"expression"
+]);
+const CapturedVariableSourceKindSchema = z.enum([
+	"local-const",
+	"relative-import",
+	"package-import"
+]);
+const CapturedVariableValueTypeSchema = z.enum([
+	"string",
+	"number",
+	"boolean",
+	"object",
+	"array",
+	"function",
+	"unknown"
+]);
+z.object({
+	name: z.string().min(1),
+	value: z.union([
+		z.string(),
+		z.number(),
+		z.boolean()
+	]).optional(),
+	sourceText: z.string().optional(),
+	valueType: CapturedVariableValueTypeSchema,
+	resolvable: z.boolean(),
+	source: CapturedVariableSourceKindSchema,
+	importPath: z.string().optional(),
+	declaration: z.object({
+		filePath: z.string().min(1),
+		line: z.number().int().positive()
+	})
+});
+const IntegrationScopeSchema = z.enum([
+	"organization",
+	"project",
+	"user_provided_credential"
+]);
+const IntegrationCredentialRefSchema = z.discriminatedUnion("type", [z.object({
+	type: z.literal("id"),
+	id: z.string().startsWith("cset_")
+}), z.object({
+	type: z.literal("name"),
+	name: z.string().trim().min(1)
+})]);
+function hasProjectOrOrganizationScope(scope) {
+	return scope === "organization" || scope === "project";
+}
+const CredentialRefTokenKeyNameSchema = z.string().regex(/^[A-Za-z0-9_]+$/, "Credential key must contain only letters, digits, and underscores (required for ref-token proxying)");
+/** Shared enum for top-level credential-set `onCredentialRevoked` policy. */
+const OnCredentialRevokedSchema = z.enum(["fail", "retry-once"]);
+/** A credential set after resolution in a built manifest. Contains definition id, scope, alias, and credential keys.*/
+const ResolvedCredentialSetSchema = z.object({
+	resolvedId: z.string(),
+	scope: IntegrationScopeSchema.optional(),
+	alias: z.string().optional(),
+	credentialRef: IntegrationCredentialRefSchema.optional(),
+	/** Auth-shape keys expected post-resolve. */
+	credentialKeys: z.array(CredentialRefTokenKeyNameSchema),
+	/** Subset of `credentialKeys` that are optional in the auth shape. */
+	optionalCredentialKeys: z.array(CredentialRefTokenKeyNameSchema).optional(),
+	/** Auth-shaped vault keys required for vault reads and upload flows. */
+	storedCredentialKeys: z.array(CredentialRefTokenKeyNameSchema).optional(),
+	/** Subset of auth-shaped vault keys that may be absent from the vault without
+	* failing resolution. Derived from the credential set's `auth` schema. */
+	optionalStoredCredentialKeys: z.array(CredentialRefTokenKeyNameSchema).optional(),
+	proxy: credentialSetProxyConfigSchema.optional(),
+	/** When true, resolved values are passed raw (no ref-token proxy) for this set. */
+	needsRawSecret: z.boolean().optional(),
+	/** When true, this requirement uses a registered dynamic resolver phase. */
+	needsDynamicResolution: z.boolean().optional(),
+	/** Cache TTL in milliseconds for registered dynamic resolver output.
+	* `0` or absence means no cache hint. */
+	dynamicResolutionCacheMs: z.number().int().nonnegative().optional(),
+	/** Policy when a step throws `CredentialRevokedError` against this credential set. */
+	onCredentialRevoked: OnCredentialRevokedSchema.optional(),
+	/** Persistence-layer schema fingerprint stamped at build time. The
+	* resolver's phase 2 compares this against the vault row's stored
+	* fingerprint and raises `CredentialSchemaMismatchError` on drift.
+	* Optional here so pre-fingerprint artifacts still parse; the
+	* workflow builder populates it for every authored credential set
+	* that has a resolvable fingerprint. */
+	schemaFingerprint: z.string().optional()
+}).superRefine((value, ctx) => {
+	if (value.credentialRef && !hasProjectOrOrganizationScope(value.scope)) ctx.addIssue({
+		code: z.ZodIssueCode.custom,
+		path: ["credentialRef"],
+		message: "credentialRef requires scope to be \"project\" or \"organization\""
+	});
+});
+z.object({
+	credentialSetId: z.string(),
+	/** Auth-shape keys expected post-resolve. */
+	credentialKeys: z.array(CredentialRefTokenKeyNameSchema),
+	/** Optional subset of the auth-shape keys. */
+	optionalCredentialKeys: z.array(CredentialRefTokenKeyNameSchema).optional(),
+	/** Stored-shape keys required for vault reads. */
+	storedCredentialKeys: z.array(CredentialRefTokenKeyNameSchema).optional(),
+	/** Optional subset of the stored-shape keys. */
+	optionalStoredCredentialKeys: z.array(CredentialRefTokenKeyNameSchema).optional(),
+	schemaFingerprint: z.string().optional(),
+	needsDynamicResolution: z.boolean().optional(),
+	/** Cache TTL in milliseconds for registered dynamic resolver output.
+	*  `0` or absence means no cache hint. */
+	dynamicResolutionCacheMs: z.number().int().nonnegative().optional(),
+	/** Policy when a step throws `CredentialRevokedError` against this credential set. */
+	onCredentialRevoked: OnCredentialRevokedSchema.optional(),
+	proxy: credentialSetProxyConfigSchema.optional(),
+	needsRawSecret: z.boolean().optional(),
+	requiredOAuthScopes: z.array(z.string()).optional()
+});
+const CredentialRequirementEntrySchema = z.object({
+	credentialSetId: z.string(),
+	scope: IntegrationScopeSchema.optional(),
+	alias: z.string().optional(),
+	credentialRef: IntegrationCredentialRefSchema.optional(),
+	/** Auth-shape keys expected post-resolve. */
+	credentialKeys: z.array(CredentialRefTokenKeyNameSchema),
+	/** Optional subset of the auth-shape keys. */
+	optionalCredentialKeys: z.array(CredentialRefTokenKeyNameSchema).optional(),
+	/** Auth-shaped vault keys required for vault reads. */
+	storedCredentialKeys: z.array(CredentialRefTokenKeyNameSchema).optional(),
+	/** Optional subset of the stored-shape keys. */
+	optionalStoredCredentialKeys: z.array(CredentialRefTokenKeyNameSchema).optional(),
+	schemaFingerprint: z.string().optional(),
+	proxy: credentialSetProxyConfigSchema.optional(),
+	needsRawSecret: z.boolean().optional(),
+	/** When true, this requirement uses a registered dynamic resolver phase. */
+	needsDynamicResolution: z.boolean().optional(),
+	/** Cache TTL in milliseconds for registered dynamic resolver output.
+	*  `0` or absence means no cache hint. */
+	dynamicResolutionCacheMs: z.number().int().nonnegative().optional(),
+	/** Policy when a step throws `CredentialRevokedError` against this credential set. */
+	onCredentialRevoked: OnCredentialRevokedSchema.optional(),
+	requiredOAuthScopes: z.array(z.string()).optional()
+}).superRefine((value, ctx) => {
+	if (value.credentialRef && !hasProjectOrOrganizationScope(value.scope)) ctx.addIssue({
+		code: z.ZodIssueCode.custom,
+		path: ["credentialRef"],
+		message: "credentialRef requires scope to be \"project\" or \"organization\""
+	});
+});
+z.object({
+	required: z.array(z.string()),
+	byStep: z.record(z.string(), z.array(CredentialRequirementEntrySchema))
+});
+const TriggerPollExportNameSchema = z.enum(["poll"]);
+const TriggerCredentialRequirementEntrySchema = CredentialRequirementEntrySchema;
+const TriggerCredentialRequirementsSchema = z.object({
+	required: z.array(z.string()),
+	byPollExport: z.partialRecord(TriggerPollExportNameSchema, z.array(TriggerCredentialRequirementEntrySchema))
+});
+const ExecutionIdentityPolicySchema = z.object({ subjectMode: z.enum(["never", "requiredWhenUserProvidedCredential"]) });
+z.object({
+	nodeId: z.string().min(1),
+	stepName: z.string().min(1),
+	label: z.string().min(1),
+	callKind: CallKindSchema,
+	stepId: z.string().min(1).optional(),
+	source: SourceLocationSchema.optional(),
+	astKind: z.string().min(1).optional(),
+	importSource: ImportSourceSchema.optional(),
+	outputBinding: z.string().min(1).optional(),
+	scopeOverride: IntegrationScopeSchema.optional(),
+	description: z.string().optional(),
+	sourceCode: z.string().optional(),
+	exportName: z.string().optional(),
+	inputSchema: JsonSchemaSchema.optional(),
+	outputSchema: JsonSchemaSchema.optional(),
+	credentialSets: z.array(ResolvedCredentialSetSchema).optional()
+});
+const TriggerTypeSchema = z.enum([
+	"webhook",
+	"cron",
+	"polling"
+]);
+/**
+* Persisted on `deployment_triggers.trigger_source`. Mirrors the
+* `webhookTrigger({ source: { type } })` discriminator so the server
+* can index-filter app-source rows during provider-webhook fanout.
+*/
+const TriggerSourceSchema = z.enum(["custom", "app"]);
+z.enum([
+	"GET",
+	"POST",
+	"PUT",
+	"PATCH"
+]);
+const TriggerPollBundleUploadSchema = z.object({
+	code: z.string(),
+	hash: z.string(),
+	size: z.number()
+});
+/** Declarative idempotency-key spec resolved server-side (no VM). */
+const IdempotencyKeyConfigSchema = z.union([
+	z.object({
+		from: z.literal("payload"),
+		strategy: z.literal("hash")
+	}),
+	z.object({
+		from: z.literal("payload"),
+		path: z.string().trim().min(1)
+	}),
+	z.object({
+		from: z.literal("header"),
+		strategy: z.literal("hash")
+	}),
+	z.object({
+		from: z.literal("header"),
+		name: z.string().trim().min(1)
+	})
+]);
+const TriggerPollExportsSchema = z.object({ poll: z.string().min(1).optional() });
+z.object({
+	id: z.string(),
+	/**
+	* Authored trigger name from `xxxTrigger({ name: ... })`. Used by the workflow
+	* VM to look up the bound `transform`. Follows the `authoredWorkflowId` /
+	* `authoredAgentId` naming convention.
+	*/
+	authoredTriggerId: z.string().min(1),
+	type: TriggerTypeSchema,
+	/**
+	* Source-of-truth discriminator for webhook triggers. `'custom'` means
+	* the trigger owns its own HTTP path; `'app'` means it is fanned out by
+	* a Keystroke-managed provider app. Undefined for non-webhook triggers.
+	*/
+	triggerSource: TriggerSourceSchema.optional(),
+	/**
+	* Root-trigger name for `.narrow()` lineage so narrowed custom webhooks share
+	* the same `webhookSecretHash`/`webhookPublicId`. Equals `authoredTriggerId`
+	* for root triggers. Omitted for non-webhook triggers.
+	*/
+	webhookAuthGroupKey: z.string().min(1).optional(),
+	enabled: z.boolean(),
+	schedule: z.string().optional(),
+	timezone: z.string().optional(),
+	config: z.record(z.string(), z.unknown()).optional(),
+	requiredCredentials: TriggerCredentialRequirementsSchema.optional(),
+	/** Hex-encoded sha-256 of the Keystroke-issued webhook secret. */
+	webhookSecretHash: z.string().min(1).optional(),
+	/** Public id surfaced in the webhook URL (header-mode auth). */
+	webhookPublicId: z.string().min(1).optional(),
+	/** JSON Schema applied at the server before any VM hop. Built from a
+	*  pure Zod schema declared on the trigger primitive. */
+	filterSchema: JsonSchemaSchema.optional(),
+	/** Declarative idempotency-key resolver. Webhook-only. */
+	idempotencyConfig: IdempotencyKeyConfigSchema.optional(),
+	pollStoragePath: z.string().min(1).optional(),
+	pollBundle: TriggerPollBundleUploadSchema.optional(),
+	pollExports: TriggerPollExportsSchema.optional()
+});
+//#endregion
+//#region ../../packages/core/src/trigger/shared/idempotency-config.ts
+const trimmedString = z.string().trim().min(1);
+const payloadHashSchema = z.object({
+	from: z.literal("payload"),
+	strategy: z.literal("hash")
+});
+const payloadPathSchema = z.object({
+	from: z.literal("payload"),
+	path: trimmedString
+});
+const headerHashSchema = z.object({
+	from: z.literal("header"),
+	strategy: z.literal("hash")
+});
+const headerNameSchema = z.object({
+	from: z.literal("header"),
+	name: trimmedString
+});
+const idempotencyKeyConfigSchema = z.union([
+	payloadHashSchema,
+	payloadPathSchema,
+	headerHashSchema,
+	headerNameSchema
+]);
+//#endregion
+//#region ../../packages/core/src/trigger/schemas.ts
+const credentialSetInstanceSchema = createStructuralSchema([
+	"id",
+	"auth",
+	"connections"
+], "a CredentialSet instance");
+const TriggerModeDefaultSchema = z.enum(["managed", "subscribable"]);
+const TriggerRuntimeDescriptorSchema = z.object({
+	/**
+	* True when this trigger bundles a `poll` export executed inside a
+	* microsandbox VM at trigger time. Polling-only — webhook/cron always
+	* leave this undefined. Replaces the legacy `callbacks: { poll, ... }`
+	* descriptor (the other callbacks are gone now that filter/idempotency/
+	* verify/transform are declarative or run in the workflow VM).
+	*/
+	poll: z.boolean().optional(),
+	filterSchema: jsonSchemaObject.optional(),
+	/** Webhook-only declarative idempotency-key resolver. */
+	idempotencyConfig: idempotencyKeyConfigSchema.optional()
+});
+const TriggerManifestSchema = z.object({
+	manifestVersion: z.literal(1),
+	type: z.literal("trigger"),
+	triggerType: TriggerTypeSchema,
+	id: trimmedNonEmptyString("Trigger id"),
+	description: descriptionString("Trigger description"),
+	enabled: z.boolean(),
+	modeDefault: TriggerModeDefaultSchema,
+	executionIdentityPolicy: ExecutionIdentityPolicySchema.optional(),
+	credentialSets: z.array(CredentialSetManifestSchema).optional(),
+	runtime: TriggerRuntimeDescriptorSchema
+});
+z.object({
+	credentialSets: z.array(credentialSetInstanceSchema).optional(),
+	description: descriptionString("Trigger description"),
+	enabled: z.boolean().default(true),
+	executionIdentityPolicy: ExecutionIdentityPolicySchema.optional(),
+	modeDefault: TriggerModeDefaultSchema.default("managed"),
+	id: trimmedNonEmptyString("Trigger id")
+});
+//#endregion
+//#region ../../packages/core/src/task/schemas.ts
+const agentInstanceSchema = createStructuralSchema([
+	"id",
+	"name",
+	"systemPrompt",
+	"model",
+	"input",
+	"output",
+	"workflowSafeReference"
+], "an Agent instance");
+const triggerInstanceSchema = createStructuralSchema([
+	"isTrigger",
+	"id",
+	"description",
+	"enabled"
+], "a trigger instance (use cronTrigger(), pollingTrigger(), or webhookTrigger())");
+const taskLifecycleSchema = z.object({
+	maxExecutions: z.number().int().positive().optional(),
+	expiresAt: z.union([z.date(), z.string().datetime()]).optional(),
+	expiresAfter: DurationSchema.optional()
+}).strict();
+z.object({
+	id: idNoSpacesString("Task ID"),
+	name: trimmedNonEmptyString("Task name"),
+	description: optionalDescriptionString("Task description"),
+	agent: agentInstanceSchema,
+	prompt: trimmedNonEmptyStringUnbounded("Task prompt"),
+	triggers: z.array(triggerInstanceSchema).min(1, { message: "At least one trigger is required" }),
+	lifecycle: taskLifecycleSchema.optional(),
+	tags: z.array(z.string()).optional()
+}).strict();
+const WorkflowSafeAgentReferenceSchema = z.object({
+	kind: z.literal("agent"),
+	authoredAgentId: z.string(),
+	displayName: z.string(),
+	runtimeKind: z.enum(["declarative", "runnable"]),
+	inputSchema: jsonSchemaObject.optional(),
+	outputSchema: jsonSchemaObject.optional(),
+	authoredExport: z.object({
+		exportName: z.string().optional(),
+		filePath: z.string().optional()
+	}).optional(),
+	metadata: jsonSchemaObject.optional()
+}).strict();
+const TaskBuildInfoStubSchema = z.object({
+	hash: SHA256HashSchema.optional(),
+	size: z.number().optional(),
+	metadata: jsonSchemaObject.optional()
+}).strict();
+/**
+* Extended trigger manifest schema for tasks.
+* Preserves runtime fields (schedule, timezone, path, method) that the base
+* TriggerManifestSchema strips. Tasks need these for trigger evaluation at runtime.
+*/
+const TaskTriggerManifestSchema = TriggerManifestSchema.extend({
+	runtime: TriggerRuntimeDescriptorSchema.extend({
+		schedule: z.string().optional(),
+		timezone: z.string().optional(),
+		path: z.string().optional(),
+		method: z.string().optional(),
+		input: z.unknown().optional(),
+		payloadMode: z.string().optional()
+	}),
+	/** Static payload for cron triggers */
+	payload: z.unknown().optional()
+});
+const TaskBuildManifestSchema = z.object({
+	manifestVersion: z.literal(1),
+	type: z.literal("task"),
+	id: z.string().min(1),
+	name: z.string().min(1),
+	description: z.string().optional(),
+	agentRef: WorkflowSafeAgentReferenceSchema,
+	prompt: z.string().min(1),
+	triggers: z.array(TaskTriggerManifestSchema),
+	lifecycle: z.object({
+		maxExecutions: z.number().int().positive().optional(),
+		expiresAt: z.string().optional(),
+		expiresAfter: z.string().optional()
+	}).strict().optional(),
+	tags: z.array(z.string()).optional(),
+	buildInfo: TaskBuildInfoStubSchema
+}).strict();
+//#endregion
+//#region ../../packages/core/src/task/index.ts
+var task_exports = /* @__PURE__ */ __exportAll({ TaskBuildManifestSchema: () => TaskBuildManifestSchema });
+//#endregion
+export { TaskBuildManifestSchema as n, task_exports as t };