@keystrokehq/cli 0.0.19 → 0.0.20

package/dist/{workflows-K6zetcqI.mjs → workflows-MANdvLft.mjs}

@@ -1,10 +1,8 @@
 #!/usr/bin/env node
 
 import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-BWcVRt-T.mjs";
-import { t as createTypedCommand } from "./commander-C5qcOo8m.mjs";
-import { n as SHA256HashSchema, t as JsonSchemaSchema } from "./common-AK0q0Oz0.mjs";
-import { c as TriggerUploadDataSchema } from "./credential-requirements-Ob-7H-0F.mjs";
-import { a as FlowGraphSchema, r as WorkflowBuildManifestSchema } from "./workflow-build-manifest-BKKW9D05.mjs";
+import { t as createTypedCommand } from "./commander-DQLrBSIW.mjs";
+import { i as WorkflowBuildManifestSchema, l as JsonSchemaSchema, o as FlowGraphSchema, t as src_exports, u as SHA256HashSchema } from "./src-BHTjsZ9V.mjs";
 import { z } from "zod";
 const GitProviderSchema = z.enum(["codestorage", "github"]);
 const GitTreeEntryTypeSchema = z.enum(["file", "directory"]);
@@ -108,8 +106,8 @@ const activationSharedFields = {
 	logicalTriggerKey: z.string(),
 	status: ActivationStatusSchema,
 	/**
-	* Per-callback trigger credential bindings.
-	* Key: "<callbackName>:<credentialDefinitionId>" (e.g. "verify:slack").
+	* Per-poll-export trigger credential bindings.
+	* Key: "poll:<credentialDefinitionId>" (e.g. "poll:slack").
 	* Value: credential set ID or "<scope>.default".
 	*/
 	triggerCredentialBindings: z.record(z.string(), z.string()).optional(),
@@ -320,7 +318,7 @@ function createWorkflowsBuildCommand() {
 		description: "Build workflows locally",
 		schema: WorkflowsBuildOptionsSchema,
 		optionsConfig: BUILD_OPTIONS_CONFIG,
-		loadHandler: async () => (await import("./build.handler-DJrEMCBw.mjs")).handleWorkflowsBuild
+		loadHandler: async () => (await import("./build.handler-CTX80S1K.mjs")).handleWorkflowsBuild
 	});
 }
 //#endregion
@@ -347,7 +345,7 @@ function createWorkflowsDiffCommand() {
 			description: "Authored workflow id (preferred) or workflow name",
 			key: "workflow"
 		},
-		loadHandler: async () => (await import("./diff.handler-DUVFixeG.mjs")).handleWorkflowsDiff
+		loadHandler: async () => (await import("./diff.handler-DO2WzdGB.mjs")).handleWorkflowsDiff
 	});
 }
 //#endregion
@@ -380,7 +378,7 @@ function createWorkflowsEnvCommand() {
 			key: "workflow",
 			required: false
 		},
-		loadHandler: async () => (await import("./env.handler-C8kNFz2U.mjs")).handleWorkflowsEnv
+		loadHandler: async () => (await import("./env.handler-C5GNyiJt.mjs")).handleWorkflowsEnv
 	});
 }
 //#endregion
@@ -412,7 +410,7 @@ function createWorkflowsInspectCommand() {
 			description: "Authored workflow id (preferred) or workflow name",
 			key: "workflow"
 		},
-		loadHandler: async () => (await import("./inspect.handler-QyTo8rWO.mjs")).handleWorkflowsInspect
+		loadHandler: async () => (await import("./inspect.handler-BrYFfN4H.mjs")).handleWorkflowsInspect
 	});
 }
 //#endregion
@@ -508,15 +506,15 @@ function createWorkflowsLogsCommand() {
 			key: "workflow",
 			required: false
 		},
-		loadHandler: async () => (await import("./logs.handler-BIegqc2p.mjs")).handleWorkflowsLogs
+		loadHandler: async () => (await import("./logs.handler-mk1lcZbU.mjs")).handleWorkflowsLogs
 	});
 }
 //#endregion
 //#region ../../packages/shared-types/src/workflows/api/request.ts
 /** Key format: <stepNodeId>:<credentialDefinitionId> (e.g. step_1:slack). */
 const WORKFLOW_CREDENTIAL_BINDING_KEY_REGEX = /^[a-zA-Z0-9_]+:[a-zA-Z0-9.:_-]+$/;
-/** Key format: <callbackName>:<credentialDefinitionId> (e.g. verify:slack) */
-const TRIGGER_CREDENTIAL_BINDING_KEY_REGEX = /^(verify|filter|transform|idempotencyKey|callback):[a-zA-Z0-9.:_-]+$/;
+/** Key format: poll:<credentialDefinitionId> (e.g. poll:slack). */
+const TRIGGER_CREDENTIAL_BINDING_KEY_REGEX = /^poll:[a-zA-Z0-9.:_-]+$/;
 /** Value: credential set ID (cset_ + ULID) or <scope>.default */
 const CREDENTIAL_BINDING_VALUE_CREDSET = /^cset_[A-Za-z0-9]{26}$/;
 const CREDENTIAL_BINDING_VALUE_SCOPE_DEFAULT = /^(organization|user|project)\.default$/;
@@ -533,7 +531,7 @@ const TriggerCredentialBindingsRecordSchema = z.record(z.string(), z.string()).r
 		if (!CREDENTIAL_BINDING_VALUE_CREDSET.test(value) && !CREDENTIAL_BINDING_VALUE_SCOPE_DEFAULT.test(value)) return false;
 	}
 	return true;
-}, { message: "triggerCredentialBindings keys must be \"<callbackName>:<credentialDefinitionId>\"; values must be credential set ID (cset_...) or \"<scope>.default\"" }).optional();
+}, { message: "triggerCredentialBindings keys must be \"poll:<credentialDefinitionId>\"; values must be credential set ID (cset_...) or \"<scope>.default\"" }).optional();
 z.object({
 	workflowName: z.string().min(1),
 	args: z.array(z.unknown()).optional().default([]),
@@ -612,7 +610,7 @@ z.object({
 	exportName: z.string().min(1),
 	manifest: WorkflowBuildManifestSchema,
 	flowJson: FlowGraphSchema.optional(),
-	triggers: z.array(TriggerUploadDataSchema).optional(),
+	triggers: z.array(src_exports.TriggerUploadDataSchema).optional(),
 	bundleHash: SHA256HashSchema,
 	bundleSize: z.number(),
 	args: z.array(z.unknown()).optional().default([]),
@@ -698,7 +696,7 @@ function createWorkflowsPausedCommand() {
 			key: "workflow",
 			required: false
 		},
-		loadHandler: async () => (await import("./paused.handler-DAZ1EaLN.mjs")).handleWorkflowsPaused
+		loadHandler: async () => (await import("./paused.handler-D4j8_Za4.mjs")).handleWorkflowsPaused
 	});
 }
 //#endregion
@@ -792,7 +790,7 @@ function createWorkflowsRunCommand() {
 			key: "payload",
 			required: false
 		}],
-		loadHandler: async () => (await import("./run.handler-BpLmwF_a.mjs")).handleWorkflowsRun
+		loadHandler: async () => (await import("./run.handler-x0B-CjNF.mjs")).handleWorkflowsRun
 	});
 }
 //#endregion
@@ -847,7 +845,7 @@ function createWorkflowsTestCommand() {
 			description: "Authored workflow id (preferred) or workflow name. Multiple workflows with the same name run sequentially.",
 			key: "workflow"
 		},
-		loadHandler: async () => (await import("./test.handler-B7Ahe9ta.mjs")).handleWorkflowsTest
+		loadHandler: async () => (await import("./test.handler-CTd-heRS.mjs")).handleWorkflowsTest
 	});
 }
 //#endregion
@@ -885,7 +883,7 @@ function createWorkflowsValidateCommand() {
 			key: "workflow",
 			required: false
 		},
-		loadHandler: async () => (await import("./validate.handler-Cq2uJjXY.mjs")).handleWorkflowsValidate
+		loadHandler: async () => (await import("./validate.handler-DIJBuX1P.mjs")).handleWorkflowsValidate
 	});
 }
 //#endregion
@@ -904,14 +902,14 @@ function createWorkflowsCommand() {
 		description: "Manage, run, inspect, and debug workflows",
 		schema: WorkflowsOptionsSchema,
 		optionsConfig: WORKFLOWS_OPTIONS_CONFIG,
-		loadHandler: async () => (await import("./list.handler-tnsRn-Rj.mjs")).handleWorkflowsList,
+		loadHandler: async () => (await import("./list2.handler-BdE1k2kl.mjs")).handleWorkflowsList,
 		subcommands: [
 			createTypedCommand({
 				name: "list",
 				description: "List all workflows in the project",
 				schema: WorkflowsOptionsSchema,
 				optionsConfig: WORKFLOWS_OPTIONS_CONFIG,
-				loadHandler: async () => (await import("./list.handler-tnsRn-Rj.mjs")).handleWorkflowsList
+				loadHandler: async () => (await import("./list2.handler-BdE1k2kl.mjs")).handleWorkflowsList
 			}),
 			createWorkflowsBuildCommand(),
 			createWorkflowsTestCommand(),

package/dist/{writer-B-SpZ0G2-CLh7sXRd.mjs → writer-byNNUjRm-w5O7-VT_.mjs}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 
-import { n as __exportAll } from "./chunk-CH6r78ws.mjs";
-import { f as getTriggersDir, n as BUILD_OUTPUT_DIR_NAME, p as getWorkflowArtifactPaths, t as BUILD_DIR_NAME } from "./layout-P1v-Gssz.mjs";
-import { t as TriggerBuildManifestSchema } from "./trigger-manifest-DxdCjGz_.mjs";
-import { t as __exportAll$1 } from "./rolldown-runtime-twds-ZHy-8uqgIurC.mjs";
-import { s as sha256String } from "./metadata-layout-Bv-B0nHj-B1c5giJ7.mjs";
-import { t as runWithConcurrency } from "./concurrency-gXn9Rw8x-BTlfau8D.mjs";
+import { n as __exportAll } from "./chunk-DYxdGL9S.mjs";
+import { f as getTriggersDir, n as BUILD_OUTPUT_DIR_NAME, p as getWorkflowArtifactPaths, t as BUILD_DIR_NAME } from "./layout-DRf9qUf8.mjs";
+import { t as TriggerBuildManifestSchema } from "./trigger-manifest-DTni4NaZ.mjs";
+import { t as __exportAll$1 } from "./rolldown-runtime-twds-ZHy-BoF7MLzP.mjs";
+import { s as sha256String } from "./metadata-layout-Bv-B0nHj-DtMWZ7Cc.mjs";
+import { t as runWithConcurrency } from "./concurrency-gXn9Rw8x-BSBbRfVp.mjs";
 import path from "node:path";
 import { access, mkdir, readdir, rm, stat, writeFile } from "node:fs/promises";
 import { createHash } from "node:crypto";
-//#region ../../packages/workflow-builder/dist/writer-B-SpZ0G2.mjs
-var writer_B_SpZ0G2_exports = /* @__PURE__ */ __exportAll({
+//#region ../../packages/workflow-builder/dist/writer-byNNUjRm.mjs
+var writer_byNNUjRm_exports = /* @__PURE__ */ __exportAll({
 	a: () => getAgentArtifactPaths,
 	d: () => allOutputFilesExist,
 	f: () => hashAgentManifestForDisk,
@@ -34,10 +34,10 @@ function releaseBundleCode(bundle) {
 	if ("sourceMap" in bundle) bundle.sourceMap = null;
 	bundle.released = true;
 }
-function markCallbackBundleDiskBacked(bundle, outputPath) {
+function markPollBundleDiskBacked(bundle, outputPath) {
 	bundle.outputPath = outputPath;
 }
-function releaseCallbackBundleCode(bundle) {
+function releasePollBundleCode(bundle) {
 	bundle.code = "";
 	bundle.released = true;
 }
@@ -352,8 +352,7 @@ function toTriggerWriteArtifact(trigger, triggerDir) {
 		triggerId: trigger.triggerId,
 		triggerDir,
 		manifestPath: path.join(triggerDir, "manifest.json"),
-		...trigger.callbackBundle ? { callbackBundlePath: path.join(triggerDir, "callback-functions.js") } : {},
-		...trigger.transformCallbackBundle ? { transformCallbackBundlePath: path.join(triggerDir, "transform.js") } : {}
+		...trigger.pollBundle ? { pollBundlePath: path.join(triggerDir, "poll-bundle.js") } : {}
 	};
 }
 async function writeTriggerArtifacts(triggers, buildDir, options) {
@@ -370,36 +369,28 @@ async function writeTriggerArtifacts(triggers, buildDir, options) {
 		await mkdir(triggerDir, { recursive: true });
 		const triggerManifest = TriggerBuildManifestSchema.parse({
 			id: trigger.triggerId,
+			authoredTriggerId: trigger.authoredTriggerId,
 			type: trigger.triggerType,
 			...trigger.triggerSource ? { triggerSource: trigger.triggerSource } : {},
+			...trigger.webhookAuthGroupKey ? { webhookAuthGroupKey: trigger.webhookAuthGroupKey } : {},
 			enabled: trigger.enabled,
 			...trigger.schedule ? { schedule: trigger.schedule } : {},
 			...trigger.timezone ? { timezone: trigger.timezone } : {},
-			...trigger.path ? { path: trigger.path } : {},
-			...trigger.method ? { method: trigger.method } : {},
 			config: trigger.config ?? (trigger.staticPayload !== void 0 ? { payload: trigger.staticPayload } : {}),
-			...trigger.requiredCredentials ? { requiredCredentials: trigger.requiredCredentials } : {}
+			...trigger.requiredCredentials ? { requiredCredentials: trigger.requiredCredentials } : {},
+			...trigger.filterSchema ? { filterSchema: trigger.filterSchema } : {},
+			...trigger.idempotencyConfig ? { idempotencyConfig: trigger.idempotencyConfig } : {}
 		});
-		if (trigger.callbackExports && trigger.callbackBundle) triggerManifest.functions = Object.fromEntries(Object.entries(trigger.callbackExports).map(([key, exportName]) => [key, {
-			js: "callback-functions.js",
-			export: exportName
-		}]));
-		if (trigger.transformCallbackExports && trigger.transformCallbackBundle) triggerManifest.attachmentFunctions = Object.fromEntries(Object.entries(trigger.transformCallbackExports).map(([key, exportName]) => [key, {
-			js: "transform.js",
+		if (trigger.pollExports && trigger.pollBundle) triggerManifest.functions = Object.fromEntries(Object.entries(trigger.pollExports).map(([key, exportName]) => [key, {
+			js: "poll-bundle.js",
 			export: exportName
 		}]));
 		await writeFile(path.join(triggerDir, "manifest.json"), `${JSON.stringify(triggerManifest, null, 2)}\n`, "utf-8");
-		if (trigger.callbackBundle) {
-			const callbackBundlePath = path.join(triggerDir, "callback-functions.js");
-			await writeFile(callbackBundlePath, trigger.callbackBundle.code, "utf-8");
-			markCallbackBundleDiskBacked(trigger.callbackBundle, callbackBundlePath);
-			if (options?.releaseBundleMemory) releaseCallbackBundleCode(trigger.callbackBundle);
-		}
-		if (trigger.transformCallbackBundle) {
-			const transformBundlePath = path.join(triggerDir, "transform.js");
-			await writeFile(transformBundlePath, trigger.transformCallbackBundle.code, "utf-8");
-			markCallbackBundleDiskBacked(trigger.transformCallbackBundle, transformBundlePath);
-			if (options?.releaseBundleMemory) releaseCallbackBundleCode(trigger.transformCallbackBundle);
+		if (trigger.pollBundle) {
+			const pollBundlePath = path.join(triggerDir, "poll-bundle.js");
+			await writeFile(pollBundlePath, trigger.pollBundle.code, "utf-8");
+			markPollBundleDiskBacked(trigger.pollBundle, pollBundlePath);
+			if (options?.releaseBundleMemory) releasePollBundleCode(trigger.pollBundle);
 		}
 		results.push(toTriggerWriteArtifact(trigger, triggerDir));
 	}
@@ -423,4 +414,4 @@ var writer_exports = /* @__PURE__ */ __exportAll$1({
 	writeTargetedBuildOutput: () => writeTargetedBuildOutput
 });
 //#endregion
-export { getAgentArtifactPaths as a, hashWorkflowManifestForDisk as c, resolveOutputDir as d, writer_B_SpZ0G2_exports as f, createAgentOutputFiles as i, removeAgentArtifacts as l, BUILD_CACHE_FILE_NAME as n, hashAgentManifestForDisk as o, allOutputFilesExist as r, hashWorkflowFlowForDisk as s, AGENT_ARTIFACT_DIR_PREFIX as t, removeWorkflowArtifacts as u };
+export { getAgentArtifactPaths as a, hashWorkflowManifestForDisk as c, resolveOutputDir as d, writer_byNNUjRm_exports as f, createAgentOutputFiles as i, removeAgentArtifacts as l, BUILD_CACHE_FILE_NAME as n, hashAgentManifestForDisk as o, allOutputFilesExist as r, hashWorkflowFlowForDisk as s, AGENT_ARTIFACT_DIR_PREFIX as t, removeWorkflowArtifacts as u };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@keystrokehq/cli",
-  "version": "0.0.19",
+  "version": "0.0.20",
   "private": false,
   "description": "Command-line interface for creating, managing, and deploying Keystroke automations.",
   "type": "module",
@@ -33,25 +33,25 @@
     "rolldown": "1.0.0",
     "tsx": "^4.21.0",
     "zod": "^4.3.6",
-    "@keystrokehq/skills": "0.0.3"
+    "@keystrokehq/skills": "0.0.4"
   },
   "devDependencies": {
     "tsdown": "0.21.10",
     "typescript": "^5.9.3",
     "vitest": "^4.1.5",
     "@keystroke/env-utils": "0.0.0",
-    "@keystroke/local-memory": "0.0.0",
+    "@keystroke/local-memory": "0.0.1",
     "@keystrokehq/config": "0.0.2",
-    "@keystroke/shared-types": "0.0.3",
-    "@keystroke/test-utils": "0.0.2",
+    "@keystroke/test-utils": "0.0.3",
     "@keystroke/typescript-config": "0.0.0",
     "@keystroke/utils": "0.0.0",
-    "@keystroke/workflow-builder": "0.0.5",
-    "@keystrokehq/core": "0.0.6",
-    "@keystrokehq/testing": "0.2.1",
-    "@keystroke/workflow-sdk": "0.0.2",
-    "@keystroke/workflow-deploy": "0.0.4",
-    "@keystrokehq/workflow-build-contracts": "0.0.2"
+    "@keystroke/workflow-builder": "0.0.6",
+    "@keystrokehq/core": "0.0.7",
+    "@keystrokehq/workflow-build-contracts": "0.0.3",
+    "@keystrokehq/testing": "0.2.2",
+    "@keystroke/shared-types": "0.0.4",
+    "@keystroke/workflow-deploy": "0.0.5",
+    "@keystroke/workflow-sdk": "0.0.3"
   },
   "keywords": [
     "automation",

package/dist/common-AK0q0Oz0.mjs

@@ -1,20 +0,0 @@
-#!/usr/bin/env node
-
-import { z } from "zod";
-const SHA256HashSchema = z.string().length(64, "Must be 64 characters").regex(/^[a-f0-9]{64}$/i, "Must be hexadecimal").transform((value) => value);
-const JsonSchemaSchema = z.record(z.string(), z.unknown());
-z.object({
-	constant: z.object({
-		attempts: z.number().int().min(1).max(10),
-		seconds: z.number().positive()
-	}).optional(),
-	exponential: z.object({
-		attempts: z.number().int().min(1).max(10),
-		base: z.number().min(1).optional(),
-		multiplier: z.number().positive().optional()
-	}).optional()
-}).refine((data) => {
-	return data.constant !== void 0 !== (data.exponential !== void 0);
-}, { error: "Retry config must specify exactly one of constant or exponential strategy" });
-//#endregion
-export { SHA256HashSchema as n, JsonSchemaSchema as t };

package/dist/credential-requirements-Ob-7H-0F.mjs

@@ -1,250 +0,0 @@
-#!/usr/bin/env node
-
-import { t as JsonSchemaSchema } from "./common-AK0q0Oz0.mjs";
-import { n as credentialSetProxyConfigSchema } from "./schemas-BxFPUGWT.mjs";
-import { a as SourceLocationSchema, i as ImportSourceSchema, t as CallKindSchema } from "./source-analysis-Cs0CTBQk.mjs";
-import { z } from "zod";
-const IntegrationScopeSchema = z.enum([
-	"organization",
-	"project",
-	"user_provided_credential"
-]);
-const IntegrationCredentialRefSchema = z.discriminatedUnion("type", [z.object({
-	type: z.literal("id"),
-	id: z.string().startsWith("cset_")
-}), z.object({
-	type: z.literal("name"),
-	name: z.string().trim().min(1)
-})]);
-function hasProjectOrOrganizationScope(scope) {
-	return scope === "organization" || scope === "project";
-}
-const CredentialRefTokenKeyNameSchema = z.string().regex(/^[A-Za-z0-9_]+$/, "Credential key must contain only letters, digits, and underscores (required for ref-token proxying)");
-/** Shared enum for top-level credential-set `onCredentialRevoked` policy. */
-const OnCredentialRevokedSchema = z.enum(["fail", "retry-once"]);
-/** A credential set after resolution in a built manifest. Contains definition id, scope, alias, and credential keys.*/
-const ResolvedCredentialSetSchema = z.object({
-	resolvedId: z.string(),
-	scope: IntegrationScopeSchema.optional(),
-	alias: z.string().optional(),
-	credentialRef: IntegrationCredentialRefSchema.optional(),
-	/** Auth-shape keys expected post-resolve. */
-	credentialKeys: z.array(CredentialRefTokenKeyNameSchema),
-	/** Subset of `credentialKeys` that are optional in the auth shape. */
-	optionalCredentialKeys: z.array(CredentialRefTokenKeyNameSchema).optional(),
-	/** Stored-shape keys required for vault reads and upload flows. */
-	storedCredentialKeys: z.array(CredentialRefTokenKeyNameSchema).optional(),
-	/** Subset of `storedCredentialKeys` that may be absent from the vault without
-	* failing resolution. Derived from the credential set's `stored` schema:
-	* a Zod field wrapped in `.optional()` / `.default()` or a JSON Schema
-	* property not listed in `required` is considered optional. */
-	optionalStoredCredentialKeys: z.array(CredentialRefTokenKeyNameSchema).optional(),
-	proxy: credentialSetProxyConfigSchema.optional(),
-	/** When true, resolved values are passed raw (no ref-token proxy) for this set. */
-	needsRawSecret: z.boolean().optional(),
-	/** When true, this requirement uses a registered dynamic resolver phase. */
-	needsDynamicResolution: z.boolean().optional(),
-	/** Cache TTL in milliseconds for registered dynamic resolver output.
-	* `0` or absence means no cache hint. */
-	dynamicResolutionCacheMs: z.number().int().nonnegative().optional(),
-	/** Policy when a step throws `CredentialRevokedError` against this credential set. */
-	onCredentialRevoked: OnCredentialRevokedSchema.optional(),
-	/** Persistence-layer schema fingerprint stamped at build time. The
-	* resolver's phase 2 compares this against the vault row's stored
-	* fingerprint and raises `CredentialSchemaMismatchError` on drift.
-	* Optional here so pre-fingerprint artifacts still parse; the
-	* workflow builder populates it for every authored credential set
-	* that has a resolvable fingerprint. */
-	schemaFingerprint: z.string().optional()
-}).superRefine((value, ctx) => {
-	if (value.credentialRef && !hasProjectOrOrganizationScope(value.scope)) ctx.addIssue({
-		code: z.ZodIssueCode.custom,
-		path: ["credentialRef"],
-		message: "credentialRef requires scope to be \"project\" or \"organization\""
-	});
-});
-const DeclaredCredentialRequirementSchema = z.object({
-	credentialSetId: z.string(),
-	/** Auth-shape keys expected post-resolve. */
-	credentialKeys: z.array(CredentialRefTokenKeyNameSchema),
-	/** Optional subset of the auth-shape keys. */
-	optionalCredentialKeys: z.array(CredentialRefTokenKeyNameSchema).optional(),
-	/** Stored-shape keys required for vault reads. */
-	storedCredentialKeys: z.array(CredentialRefTokenKeyNameSchema).optional(),
-	/** Optional subset of the stored-shape keys. */
-	optionalStoredCredentialKeys: z.array(CredentialRefTokenKeyNameSchema).optional(),
-	schemaFingerprint: z.string().optional(),
-	needsDynamicResolution: z.boolean().optional(),
-	/** Cache TTL in milliseconds for registered dynamic resolver output.
-	*  `0` or absence means no cache hint. */
-	dynamicResolutionCacheMs: z.number().int().nonnegative().optional(),
-	/** Policy when a step throws `CredentialRevokedError` against this credential set. */
-	onCredentialRevoked: OnCredentialRevokedSchema.optional(),
-	proxy: credentialSetProxyConfigSchema.optional(),
-	needsRawSecret: z.boolean().optional(),
-	requiredOAuthScopes: z.array(z.string()).optional()
-});
-const CredentialRequirementEntrySchema = z.object({
-	credentialSetId: z.string(),
-	scope: IntegrationScopeSchema.optional(),
-	alias: z.string().optional(),
-	credentialRef: IntegrationCredentialRefSchema.optional(),
-	/** Auth-shape keys expected post-resolve. */
-	credentialKeys: z.array(CredentialRefTokenKeyNameSchema),
-	/** Optional subset of the auth-shape keys. */
-	optionalCredentialKeys: z.array(CredentialRefTokenKeyNameSchema).optional(),
-	/** Stored-shape keys required for vault reads. */
-	storedCredentialKeys: z.array(CredentialRefTokenKeyNameSchema).optional(),
-	/** Optional subset of the stored-shape keys. */
-	optionalStoredCredentialKeys: z.array(CredentialRefTokenKeyNameSchema).optional(),
-	schemaFingerprint: z.string().optional(),
-	proxy: credentialSetProxyConfigSchema.optional(),
-	needsRawSecret: z.boolean().optional(),
-	/** When true, this requirement uses a registered dynamic resolver phase. */
-	needsDynamicResolution: z.boolean().optional(),
-	/** Cache TTL in milliseconds for registered dynamic resolver output.
-	*  `0` or absence means no cache hint. */
-	dynamicResolutionCacheMs: z.number().int().nonnegative().optional(),
-	/** Policy when a step throws `CredentialRevokedError` against this credential set. */
-	onCredentialRevoked: OnCredentialRevokedSchema.optional(),
-	requiredOAuthScopes: z.array(z.string()).optional()
-}).superRefine((value, ctx) => {
-	if (value.credentialRef && !hasProjectOrOrganizationScope(value.scope)) ctx.addIssue({
-		code: z.ZodIssueCode.custom,
-		path: ["credentialRef"],
-		message: "credentialRef requires scope to be \"project\" or \"organization\""
-	});
-});
-const CredentialRequirementsSchema = z.object({
-	required: z.array(z.string()),
-	byStep: z.record(z.string(), z.array(CredentialRequirementEntrySchema))
-});
-const TriggerCallbackNameSchema = z.enum([
-	"filter",
-	"idempotencyKey",
-	"verify",
-	"callback"
-]);
-const TriggerCredentialRequirementEntrySchema = CredentialRequirementEntrySchema;
-const TriggerCredentialRequirementsSchema = z.object({
-	required: z.array(z.string()),
-	byCallback: z.partialRecord(TriggerCallbackNameSchema, z.array(TriggerCredentialRequirementEntrySchema))
-});
-function buildCredentialRequirementEntryKey(entry) {
-	const credentialRefKey = entry.credentialRef ? entry.credentialRef.type === "id" ? `id:${entry.credentialRef.id}` : `name:${entry.credentialRef.name}` : "";
-	return [
-		entry.credentialSetId,
-		entry.scope ?? "",
-		entry.alias ?? "",
-		credentialRefKey,
-		entry.schemaFingerprint ?? "",
-		[...entry.credentialKeys].sort().join(","),
-		[...entry.optionalCredentialKeys ?? []].sort().join(","),
-		[...entry.storedCredentialKeys ?? []].sort().join(","),
-		[...entry.optionalStoredCredentialKeys ?? []].sort().join(","),
-		entry.needsRawSecret === true ? "1" : "0",
-		entry.needsDynamicResolution === true ? "1" : "0",
-		typeof entry.dynamicResolutionCacheMs === "number" ? String(entry.dynamicResolutionCacheMs) : "",
-		entry.onCredentialRevoked ?? "",
-		entry.proxy ? JSON.stringify(entry.proxy) : ""
-	].join("|");
-}
-function deduplicateCredentialRequirementEntries(entries) {
-	const deduped = /* @__PURE__ */ new Map();
-	for (const entry of entries) {
-		const key = buildCredentialRequirementEntryKey(entry);
-		const existing = deduped.get(key);
-		if (!existing) deduped.set(key, {
-			...entry,
-			credentialKeys: [...entry.credentialKeys].sort(),
-			...entry.optionalCredentialKeys ? { optionalCredentialKeys: [...entry.optionalCredentialKeys].sort() } : {},
-			...entry.storedCredentialKeys ? { storedCredentialKeys: [...entry.storedCredentialKeys].sort() } : {},
-			...entry.optionalStoredCredentialKeys ? { optionalStoredCredentialKeys: [...entry.optionalStoredCredentialKeys].sort() } : {}
-		});
-		else if (entry.requiredOAuthScopes?.length) {
-			const merged = new Set([...existing.requiredOAuthScopes ?? [], ...entry.requiredOAuthScopes]);
-			deduped.set(key, {
-				...existing,
-				requiredOAuthScopes: [...merged].sort()
-			});
-		}
-	}
-	return [...deduped.values()];
-}
-function collectCredentialRequirementEntries(credentialRequirements) {
-	if (!credentialRequirements) return [];
-	return deduplicateCredentialRequirementEntries(Object.values(credentialRequirements.byStep ?? {}).flat());
-}
-z.object({ subjectMode: z.enum(["never", "requiredWhenUserProvidedCredential"]) });
-/** A step's entry within a WorkflowManifest. Describes how a step is used in a workflow, not what the step itself is. */
-const WorkflowStepEntrySchema = z.object({
-	nodeId: z.string().min(1),
-	stepName: z.string().min(1),
-	label: z.string().min(1),
-	callKind: CallKindSchema,
-	stepId: z.string().min(1).optional(),
-	source: SourceLocationSchema.optional(),
-	astKind: z.string().min(1).optional(),
-	importSource: ImportSourceSchema.optional(),
-	outputBinding: z.string().min(1).optional(),
-	scopeOverride: IntegrationScopeSchema.optional(),
-	description: z.string().optional(),
-	sourceCode: z.string().optional(),
-	exportName: z.string().optional(),
-	inputSchema: JsonSchemaSchema.optional(),
-	outputSchema: JsonSchemaSchema.optional(),
-	credentialSets: z.array(ResolvedCredentialSetSchema).optional()
-});
-const TriggerTypeSchema = z.enum([
-	"webhook",
-	"cron",
-	"polling"
-]);
-/**
-* Persisted on `deployment_triggers.trigger_source`. Mirrors the
-* `webhookTrigger({ source: { type } })` discriminator so the server
-* can index-filter app-source rows during provider-webhook fanout.
-*/
-const TriggerSourceSchema = z.enum(["custom", "app"]);
-const WebhookMethodSchema = z.enum([
-	"GET",
-	"POST",
-	"PUT",
-	"PATCH"
-]);
-const TriggerCallbackBundleUploadSchema = z.object({
-	code: z.string(),
-	hash: z.string(),
-	size: z.number()
-});
-const TriggerCallbackExportsSchema = z.object({
-	verify: z.string().min(1).optional(),
-	filter: z.string().min(1).optional(),
-	idempotencyKey: z.string().min(1).optional(),
-	callback: z.string().min(1).optional()
-});
-const TransformCallbackExportsSchema = z.object({ transform: z.string().min(1).optional() });
-const TriggerUploadDataSchema = z.object({
-	id: z.string(),
-	type: TriggerTypeSchema,
-	/**
-	* Source-of-truth discriminator for webhook triggers. `'custom'` means
-	* the trigger owns its own HTTP path; `'app'` means it is fanned out by
-	* a Keystroke-managed provider app. Undefined for non-webhook triggers.
-	*/
-	triggerSource: TriggerSourceSchema.optional(),
-	enabled: z.boolean(),
-	path: z.string().optional(),
-	method: WebhookMethodSchema.optional(),
-	schedule: z.string().optional(),
-	timezone: z.string().optional(),
-	config: z.record(z.string(), z.unknown()).optional(),
-	requiredCredentials: TriggerCredentialRequirementsSchema.optional(),
-	storagePath: z.string().min(1).optional(),
-	callbackBundle: TriggerCallbackBundleUploadSchema.optional(),
-	callbackExports: TriggerCallbackExportsSchema.optional(),
-	transformCallbackBundle: TriggerCallbackBundleUploadSchema.optional(),
-	transformCallbackExports: TransformCallbackExportsSchema.optional()
-});
-//#endregion
-export { TriggerCredentialRequirementsSchema as a, TriggerUploadDataSchema as c, collectCredentialRequirementEntries as d, deduplicateCredentialRequirementEntries as f, ResolvedCredentialSetSchema as i, WebhookMethodSchema as l, DeclaredCredentialRequirementSchema as n, TriggerSourceSchema as o, IntegrationScopeSchema as r, TriggerTypeSchema as s, CredentialRequirementsSchema as t, WorkflowStepEntrySchema as u };