@keystrokehq/cli 0.0.31 → 0.0.37

package/dist/{workflow-build-Begvjfq8.mjs → workflow-build-Bm8JoVv4.mjs}

@@ -1,28 +1,32 @@
 #!/usr/bin/env node
 
 import { i as __toESM, n as __exportAll } from "./chunk-CH6r78ws.mjs";
-import { F as originalConsole, P as logger, a as ui, n as style, t as ANSI, y as toErrorMessage } from "./keystroke.mjs";
-import { r as getKeystrokeTmpDir } from "./dist-Dw7gCE7y.mjs";
+import { I as logger, L as originalConsole, n as style, p as ui, t as ANSI, x as toErrorMessage } from "./keystroke.mjs";
+import { r as getKeystrokeTmpDir } from "./dist-B5jy238v.mjs";
 import { t as assertWorkflowProjectRoot } from "./project-config-DudGRFPO.mjs";
-import { a as FlowGraphSchema, r as WorkflowBuildManifestSchema } from "./workflow-build-manifest-1sC52TIG.mjs";
-import { t as AgentVersionManifestSchema } from "./agent-manifest-De5TCxZq.mjs";
+import { a as FlowGraphSchema, r as WorkflowBuildManifestSchema } from "./workflow-build-manifest-CV6bBmDO.mjs";
+import { t as AgentVersionManifestSchema } from "./agent-manifest-DfWD5tvv.mjs";
 import { r as RelativeFilePathSchema } from "./file-metadata-DQVDjr7M.mjs";
 import { c as createArtifactOutputFiles, l as createMetadataOutputFile, o as METADATA_ROOT_DIR_NAME, p as getWorkflowArtifactPaths, t as BUILD_DIR_NAME } from "./layout-B95Tku8F.mjs";
 import { t as resolveConfiguredBuildOutputDir } from "./utils-BaxDlCsW.mjs";
 import { a as readAgentSandboxPackage, r as AGENT_VM_TOOLS_RUNTIME_RELATIVE_PATH } from "./agent-bundle-package-DWV6B_5q-B-qzc3zC.mjs";
 import { a as prewarmFileContentCache, c as typedEntries, i as createFileContentCache, l as require_out, n as computeBuilderFingerprint, o as resetFileContentCache, r as computeWorkflowFingerprint, s as sha256String } from "./metadata-layout-Bv-B0nHj-CO8mjjSl.mjs";
-import { a as getAgentArtifactPaths, c as hashWorkflowManifestForDisk, d as resolveOutputDir, i as createAgentOutputFiles, l as removeAgentArtifacts, n as BUILD_CACHE_FILE_NAME, o as hashAgentManifestForDisk, r as allOutputFilesExist, s as hashWorkflowFlowForDisk, t as AGENT_ARTIFACT_DIR_PREFIX, u as removeWorkflowArtifacts } from "./writer-byNNUjRm-B-on1n6c.mjs";
-import { a as createDiscoveryFailure, c as createNamespaceStarExportDiscoveryError, d as isWorkflowLoadResult, f as loadWorkflowMetadataBatch, i as createAmbiguousExportDiscoveryError, l as isAgentLoadResult, o as createDuplicateWorkflowIdFailure, t as DuplicateWorkflowIdError, u as isTaskLoadResult } from "./import-module-y0glInUe-DV_3dsU0.mjs";
+import { a as getAgentArtifactPaths, c as hashWorkflowManifestForDisk, d as resolveOutputDir, i as createAgentOutputFiles, l as removeAgentArtifacts, n as BUILD_CACHE_FILE_NAME, o as hashAgentManifestForDisk, r as allOutputFilesExist, s as hashWorkflowFlowForDisk, t as AGENT_ARTIFACT_DIR_PREFIX, u as removeWorkflowArtifacts } from "./writer-BLg0RuZa-Y6ExdYH9.mjs";
+import { a as createDiscoveryFailure, c as createNamespaceStarExportDiscoveryError, d as isWorkflowLoadResult, f as loadWorkflowMetadataBatch, i as createAmbiguousExportDiscoveryError, l as isAgentLoadResult, o as createDuplicateWorkflowIdFailure, t as DuplicateWorkflowIdError, u as isTaskLoadResult } from "./import-module-y0glInUe-EuAWaw9g.mjs";
 import { a as literalString, n as identifierName, o as parseSourceFile, r as isNode } from "./oxc-B3KI3rf_-B9omBIuN.mjs";
 import { a as getLocalModuleSpecifier, c as removeAllMetadataArtifacts, d as resolveDefaultExportAssignment, f as resolveLocalModulePath, i as collectWorkflowImportNames, n as DISCOVERY_IGNORE, o as getVariableDeclarators, r as collectLocalWorkflowBindings, s as isExportedVariableStatement, t as DISCOVERY_GLOB, u as removeMetadataArtifacts } from "./source-analysis-BBg2E_6G-wPP9mjQx.mjs";
 import { n as parseRelativeFilePath } from "./normalize-path-CojS-CgQ-aOM0agxS.mjs";
+import { createRequire } from "node:module";
 import * as path$1 from "node:path";
 import path from "node:path";
 import * as fs from "node:fs/promises";
-import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
+import { access, mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { existsSync, realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { z } from "zod";
+import { execFile } from "node:child_process";
 import { createHash } from "node:crypto";
+import { promisify } from "node:util";
 import { performance } from "node:perf_hooks";
 //#region ../../packages/workflow-builder/dist/pipeline/flow-graph-toolkit.mjs
 function detectAgentInPathCycles(input) {
@@ -70,7 +74,7 @@ function toCycleNode(node) {
 	};
 }
 //#endregion
-//#region ../../packages/workflow-builder/dist/build-BFmRs6Vo.mjs
+//#region ../../packages/workflow-builder/dist/build-CZTnUnzI.mjs
 var import_out = /* @__PURE__ */ __toESM(require_out(), 1);
 const DiscoveredWorkflowSchema = z.object({
 	exportFilePath: z.string(),
@@ -465,6 +469,25 @@ async function cleanupFailedBuildState(options) {
 		metadata
 	});
 }
+/** Resolves a CLI/build target path to a canonical absolute path for discovery matching. */
+function resolveBuildTargetAbsolutePath(projectRoot, target) {
+	const absolutePath = path.normalize(path.isAbsolute(target) ? target : path.resolve(projectRoot, target));
+	if (!existsSync(absolutePath)) return absolutePath;
+	try {
+		return realpathSync.native(absolutePath);
+	} catch {
+		return absolutePath;
+	}
+}
+/** Canonicalizes a discovered source file path so `/tmp` and `/private/tmp` match on macOS. */
+function resolveDiscoveredAbsolutePath(resolvedFilePath) {
+	const normalized = path.normalize(resolvedFilePath);
+	try {
+		return realpathSync.native(normalized);
+	} catch {
+		return normalized;
+	}
+}
 async function resolveCandidateFiles(projectRoot) {
 	const resolvedProjectRoot = path.resolve(projectRoot);
 	const files = await (0, import_out.default)([...DISCOVERY_GLOB], {
@@ -978,7 +1001,7 @@ async function buildDiscoveredWorkflows(options) {
 	const failures = [...buildPlan.failures];
 	const warnings = [];
 	if (buildPlan.workflows.length > 0) {
-		const { buildWorkflowArtifacts } = await import("./build-workflows-BZ_m97Pr-BiyptCrn.mjs");
+		const { buildWorkflowArtifacts } = await import("./build-workflows-C-gQM3l5-_zcBHE3M.mjs");
 		const result = await buildWorkflowArtifacts({
 			entries: buildPlan.workflows,
 			workflowsByKey,
@@ -993,7 +1016,7 @@ async function buildDiscoveredWorkflows(options) {
 		warnings.push(...result.warnings);
 	}
 	if (buildPlan.agents.length > 0) {
-		const { buildAgentArtifacts } = await import("./build-agents-DseUtzd4-CSGpNXur.mjs");
+		const { buildAgentArtifacts } = await import("./build-agents-CUzBnlAG-3ePFZiJ6.mjs");
 		const result = await buildAgentArtifacts({
 			entries: buildPlan.agents,
 			projectRoot: options.projectRoot
@@ -1002,7 +1025,7 @@ async function buildDiscoveredWorkflows(options) {
 		failures.push(...result.failures);
 	}
 	if (buildPlan.tasks.length > 0) {
-		const { buildTaskArtifacts } = await import("./build-tasks-C09SdfjC-BmAVLTtQ.mjs");
+		const { buildTaskArtifacts } = await import("./build-tasks-5eOvI19S-tbN6CRx9.mjs");
 		const result = await buildTaskArtifacts({
 			entries: buildPlan.tasks,
 			projectRoot: options.projectRoot,
@@ -1110,7 +1133,7 @@ async function createBuildPlan(options) {
 		const currentWorkflowIndex = workflowProgressIndex;
 		workflowProgressIndex += 1;
 		if (!loadResult?.ok) {
-			const { createWorkflowMetadataFailure } = await import("./build-workflows-BZ_m97Pr-BiyptCrn.mjs");
+			const { createWorkflowMetadataFailure } = await import("./build-workflows-C-gQM3l5-_zcBHE3M.mjs");
 			plan.failures.push(createWorkflowMetadataFailure(discoveredWorkflow, loadResult?.error));
 			continue;
 		}
@@ -1308,7 +1331,7 @@ async function runBuild(config, initialTargetBindingKeys, metadataRebuildDecisio
 			cacheResolvedBindingKeys,
 			releaseBundleMemory: config.releaseBundleMemory
 		};
-		const { writeBuildOutput, writeTargetedBuildOutput } = await import("./writer-byNNUjRm-B-on1n6c.mjs").then((n) => n.f).then((n) => n.t);
+		const { writeBuildOutput, writeTargetedBuildOutput } = await import("./writer-BLg0RuZa-Y6ExdYH9.mjs").then((n) => n.f).then((n) => n.t);
 		const writeResult = targetBindingKeys ? await writeTargetedBuildOutput({
 			artifacts: finalizedScopedArtifacts,
 			agentArtifacts,
@@ -1333,7 +1356,7 @@ async function runBuild(config, initialTargetBindingKeys, metadataRebuildDecisio
 			elapsedMs: performance.now() - writeStartedAt,
 			...writeResult.skippedWriteCount !== void 0 && writeResult.skippedWriteCount > 0 ? { skippedWriteCount: writeResult.skippedWriteCount } : {}
 		});
-		const { buildMetadataArtifacts } = await import("./build-metadata-BB_L45ZS-DSJL7dTy.mjs");
+		const { buildMetadataArtifacts } = await import("./build-metadata-BB_L45ZS-DRQsV6JK.mjs");
 		const metadata = await buildMetadataArtifacts({
 			projectRoot: config.projectRoot,
 			outputDir,
@@ -1526,14 +1549,21 @@ function resolveTargetedDiscovery(options) {
 	if (targetFiles.length === 0) return null;
 	const normalizedTargets = /* @__PURE__ */ new Map();
 	for (const target of targetFiles) {
-		const absolutePath = path$1.normalize(path$1.isAbsolute(target) ? target : path$1.resolve(options.projectRoot, target));
+		const absolutePath = resolveBuildTargetAbsolutePath(options.projectRoot, target);
+		if (!existsSync(absolutePath)) return { failure: {
+			kind: "discovery",
+			code: "unknown-discovery-error",
+			filePath: absolutePath,
+			exportNames: [],
+			error: `Target file not found: "${target}"`
+		} };
 		normalizedTargets.set(absolutePath, target);
 	}
 	const matchedBindingKeys = /* @__PURE__ */ new Set();
 	const affectedPaths = /* @__PURE__ */ new Set();
 	const matchedTargets = /* @__PURE__ */ new Set();
 	for (const discoveredWorkflow of options.discovery.workflows) {
-		const resolvedPath = path$1.normalize(discoveredWorkflow.resolvedFilePath);
+		const resolvedPath = resolveDiscoveredAbsolutePath(discoveredWorkflow.resolvedFilePath);
 		if (!normalizedTargets.has(resolvedPath)) continue;
 		matchedBindingKeys.add(discoveredWorkflow.bindingKey);
 		affectedPaths.add(discoveredWorkflow.relativePath);
@@ -1662,6 +1692,172 @@ function formatBuildFailure(failure) {
 	}
 }
 //#endregion
+//#region ../../packages/workflow-builder/dist/index.mjs
+const DIAGNOSTIC_PATTERN = /^(.*)\((\d+),(\d+)\):\s+(error|warning)\s+TS(\d+):\s+(.*)$/;
+function parseDiagnostics(output) {
+	const diagnostics = [];
+	for (const rawLine of output.split(/\r?\n/)) {
+		const line = rawLine.trimEnd();
+		if (line.length === 0) continue;
+		const match = DIAGNOSTIC_PATTERN.exec(line);
+		if (match) {
+			const file = match[1] ?? "";
+			const lineNumber = match[2] ?? "0";
+			const columnNumber = match[3] ?? "0";
+			const severity = match[4] === "warning" ? "warning" : "error";
+			const code = match[5] ?? "0";
+			const message = match[6] ?? "";
+			diagnostics.push({
+				file,
+				line: Number(lineNumber),
+				column: Number(columnNumber),
+				message,
+				severity,
+				code: Number(code)
+			});
+			continue;
+		}
+		const lastDiagnostic = diagnostics.at(-1);
+		if (lastDiagnostic && rawLine.startsWith("  ")) lastDiagnostic.message = `${lastDiagnostic.message}\n${line.trim()}`;
+	}
+	return diagnostics;
+}
+const execFileAsync = promisify(execFile);
+const require = createRequire(import.meta.url);
+function resolveNativeTsgoBin(nativePreviewPackageJson) {
+	const packageName = `@typescript/native-preview-${process.platform}-${process.arch}`;
+	try {
+		const nativePreviewRoot = path$1.dirname(nativePreviewPackageJson);
+		const packageJson = createRequire(path$1.join(nativePreviewRoot, "lib", "getExePath.js")).resolve(`${packageName}/package.json`);
+		const executable = path$1.join(path$1.dirname(packageJson), "lib", process.platform === "win32" ? "tsgo.exe" : "tsgo");
+		return existsSync(executable) ? executable : void 0;
+	} catch {
+		return;
+	}
+}
+function resolveCompilers() {
+	const compilers = [];
+	try {
+		const tsgoPackageJson = require.resolve("@typescript/native-preview/package.json");
+		const nativeTsgoBin = resolveNativeTsgoBin(tsgoPackageJson);
+		if (nativeTsgoBin) {
+			compilers.push({
+				name: "tsgo",
+				binPath: nativeTsgoBin
+			});
+			return compilers;
+		}
+		compilers.push({
+			name: "tsgo",
+			binPath: path$1.join(path$1.dirname(tsgoPackageJson), "bin", "tsgo.js")
+		});
+	} catch {}
+	return compilers;
+}
+const COMPILERS = resolveCompilers();
+const CORE_PRIMITIVE_GLOBAL_TYPES = [
+	"declare const Workflow: typeof import('@keystrokehq/core').Workflow;",
+	"declare const Agent: typeof import('@keystrokehq/core').Agent;",
+	"declare const Operation: typeof import('@keystrokehq/core').Operation;",
+	"declare const Step: typeof import('@keystrokehq/core').Step;",
+	"declare const Tool: typeof import('@keystrokehq/core').Tool;",
+	"declare const Task: typeof import('@keystrokehq/core').Task;",
+	"declare const CredentialSet: typeof import('@keystrokehq/core').CredentialSet;",
+	"declare const Sandbox: typeof import('@keystrokehq/core').Sandbox;",
+	"declare const McpServer: typeof import('@keystrokehq/core').McpServer;",
+	"declare const CronTrigger: typeof import('@keystrokehq/core').CronTrigger;",
+	"declare const WebhookTrigger: typeof import('@keystrokehq/core').WebhookTrigger;",
+	"declare const PollingTrigger: typeof import('@keystrokehq/core').PollingTrigger;",
+	"declare const cronTrigger: typeof import('@keystrokehq/core').cronTrigger;",
+	"declare const webhookTrigger: typeof import('@keystrokehq/core').webhookTrigger;",
+	"declare const pollingTrigger: typeof import('@keystrokehq/core').pollingTrigger;"
+].join("\n");
+async function typecheckWorkflows(options) {
+	const startedAt = performance.now();
+	const tsConfigPath = path$1.join(options.projectRoot, "tsconfig.json");
+	await access(tsConfigPath);
+	const resolvedFiles = [...new Set(options.files)].map((filePath) => path$1.resolve(filePath));
+	if (resolvedFiles.length === 0) return {
+		diagnostics: [],
+		errorCount: 0,
+		warningCount: 0,
+		elapsedMs: 0,
+		compiler: "tsgo",
+		toolFailure: void 0
+	};
+	const tempDir = getKeystrokeTmpDir({ projectRoot: options.projectRoot });
+	await mkdir(tempDir, { recursive: true });
+	const tempConfigPath = path$1.join(tempDir, "typecheck.json");
+	const buildInfoPath = path$1.join(tempDir, "typecheck.tsbuildinfo");
+	const globalsPath = path$1.join(tempDir, "core-globals.d.ts");
+	await writeFile(globalsPath, `${CORE_PRIMITIVE_GLOBAL_TYPES}\n`, "utf-8");
+	await writeFile(tempConfigPath, `${JSON.stringify({
+		extends: tsConfigPath,
+		files: [globalsPath, ...resolvedFiles],
+		include: [path$1.join(options.projectRoot, "**/*.d.ts")],
+		compilerOptions: {
+			noEmit: true,
+			incremental: true,
+			tsBuildInfoFile: buildInfoPath
+		}
+	}, null, 2)}\n`, "utf-8");
+	try {
+		let lastToolFailureResult = null;
+		for (const compiler of COMPILERS) try {
+			const { stdout, stderr } = await execFileAsync(compiler.binPath, [
+				"--noEmit",
+				"--project",
+				tempConfigPath,
+				"--pretty",
+				"false"
+			], { cwd: options.projectRoot });
+			return createTypecheckResult(compiler.name, `${stdout}\n${stderr}`.trim(), startedAt, options.projectRoot);
+		} catch (error) {
+			const failure = error;
+			if (failure.code === "ENOENT") continue;
+			const result = createTypecheckResult(compiler.name, `${failure.stdout ?? ""}\n${failure.stderr ?? ""}`.trim(), startedAt, options.projectRoot, resolveToolFailure(failure));
+			if (result.toolFailure) {
+				lastToolFailureResult = result;
+				continue;
+			}
+			return result;
+		}
+		if (lastToolFailureResult) return lastToolFailureResult;
+	} finally {
+		await rm(tempConfigPath, { force: true });
+	}
+	throw new Error("Unable to run typecheck: no compiler available");
+}
+function createTypecheckResult(compiler, output, startedAt, projectRoot, toolFailure) {
+	const diagnostics = filterProjectDiagnostics(parseDiagnostics(output), projectRoot);
+	const reportedDiagnostics = diagnostics.length > 0 ? diagnostics : [];
+	return {
+		diagnostics: reportedDiagnostics,
+		errorCount: reportedDiagnostics.filter((diagnostic) => diagnostic.severity === "error").length,
+		warningCount: reportedDiagnostics.filter((diagnostic) => diagnostic.severity === "warning").length,
+		elapsedMs: performance.now() - startedAt,
+		compiler,
+		toolFailure
+	};
+}
+function filterProjectDiagnostics(diagnostics, projectRoot) {
+	const root = path$1.resolve(projectRoot);
+	return diagnostics.filter((diagnostic) => {
+		if (!diagnostic.file) return true;
+		const filePath = path$1.resolve(projectRoot, diagnostic.file);
+		return filePath === root || filePath.startsWith(`${root}${path$1.sep}`);
+	});
+}
+function resolveToolFailure(failure) {
+	const combinedOutput = `${failure.stdout ?? ""}\n${failure.stderr ?? ""}`.trim();
+	if (parseDiagnostics(combinedOutput).length > 0) return;
+	return {
+		kind: "process",
+		message: combinedOutput.length > 0 ? combinedOutput : `Typecheck process failed with exit code ${String(failure.code ?? "unknown")}`,
+		exitCode: failure.code
+	};
+}
+//#endregion
 //#region src/lib/workflow-build.ts
 var workflow_build_exports = /* @__PURE__ */ __exportAll({
 	WorkflowBuildExecutionError: () => WorkflowBuildExecutionError,
@@ -1678,13 +1874,13 @@ const workflowBuildDependencies = {
 	build
 };
 var WorkflowNotFoundError = class extends Error {
-	workflowName;
-	availableNames;
-	constructor(workflowName, availableNames) {
-		super(`Workflow "${workflowName}" not found.`);
+	workflowRef;
+	availableIds;
+	constructor(workflowRef, availableIds) {
+		super(`Workflow "${workflowRef}" not found.`);
 		this.name = "WorkflowNotFoundError";
-		this.workflowName = workflowName;
-		this.availableNames = availableNames;
+		this.workflowRef = workflowRef;
+		this.availableIds = availableIds;
 	}
 };
 var WorkflowBuildExecutionError = class extends Error {
@@ -1723,7 +1919,6 @@ async function runWorkflowBuild(options) {
 		throw new WorkflowBuildExecutionError(error);
 	}
 	if (!result.success) throw new WorkflowBuildFailedError(result.failures);
-	if (options.name) assertWorkflowRefExists(result, options.name);
 	if (options.workflowRef) assertWorkflowRefExists(result, options.workflowRef);
 	return {
 		result,
@@ -1732,7 +1927,7 @@ async function runWorkflowBuild(options) {
 }
 function renderBuildHeader(workflowName) {
 	if (workflowName) {
-		ui.header(`Building workflow "${workflowName}"...`);
+		ui.header(`Building project (validating workflow id "${workflowName}")...`);
 		return;
 	}
 	ui.header("Building workflows and agents...");
@@ -1754,12 +1949,21 @@ function renderBuildSummary(result, outDir) {
 	const totalLine = `Total: ${formatTotalTime(result.totalMs)}`;
 	originalConsole.info(`  ${check} ${totalLine}`);
 	logger.info(`  ✓ ${totalLine}`);
+	const workflowIds = collectBuiltWorkflowIds(result);
+	if (workflowIds.length > 0) {
+		const idsLine = `Workflow ids: ${workflowIds.join(", ")}`;
+		originalConsole.info(`  ${check} ${idsLine}`);
+		logger.info(`  ✓ ${idsLine}`);
+	}
 	if (result.warnings.length > 0) {
 		ui.warn(`Build produced ${result.warnings.length} warning(s):`);
 		for (const warning of result.warnings) ui.hint(`- ${warning}`);
 	}
 	ui.hint(`Output: ${outDir}`);
 }
+function collectBuiltWorkflowIds(result) {
+	return result.artifacts.map((artifact) => artifact.manifest.id).filter((id) => typeof id === "string" && id.length > 0).sort((left, right) => left.localeCompare(right));
+}
 function formatTotalTime(ms) {
 	if (ms < 1e3) return `${Math.round(ms)}ms`;
 	const seconds = ms / 1e3;
@@ -1767,12 +1971,12 @@ function formatTotalTime(ms) {
 }
 function renderBuildFailure(error) {
 	if (error instanceof WorkflowNotFoundError) {
-		ui.error(`Workflow "${error.workflowName}" not found.`);
-		if (error.availableNames.length === 0) {
+		ui.error(`Workflow "${error.workflowRef}" not found.`);
+		if (error.availableIds.length === 0) {
 			ui.hint("No workflows were discovered in this project.");
 			return;
 		}
-		ui.hint(`Available workflows: ${error.availableNames.join(", ")}`);
+		ui.hint(`Available workflow ids: ${error.availableIds.join(", ")}`);
 		return;
 	}
 	if (error instanceof WorkflowBuildExecutionError) {
@@ -1787,10 +1991,8 @@ function renderBuildFailure(error) {
 	ui.error(`Build error: ${toErrorMessage(error)}`);
 }
 function assertWorkflowRefExists(result, workflowRef) {
-	if (result.artifacts.find((artifact) => artifact.manifest.id === workflowRef || artifact.manifest.name === workflowRef)) return;
-	const availableNames = result.artifacts.map((artifact) => artifact.manifest.name).sort((left, right) => left.localeCompare(right));
-	const availableIds = result.artifacts.map((artifact) => artifact.manifest.id).sort((left, right) => left.localeCompare(right));
-	throw new WorkflowNotFoundError(workflowRef, availableNames.length > 0 ? availableNames : availableIds);
+	if (result.artifacts.find((artifact) => artifact.manifest.id === workflowRef)) return;
+	throw new WorkflowNotFoundError(workflowRef, result.artifacts.map((artifact) => artifact.manifest.id).filter((id) => typeof id === "string" && id.length > 0).sort((left, right) => left.localeCompare(right)));
 }
 //#endregion
-export { runWorkflowBuild as a, renderBuildSummary as i, renderBuildFailure as n, workflow_build_exports as o, renderBuildHeader as r, build as s, WorkflowNotFoundError as t };
+export { runWorkflowBuild as a, build as c, renderBuildSummary as i, renderBuildFailure as n, workflow_build_exports as o, renderBuildHeader as r, typecheckWorkflows as s, WorkflowNotFoundError as t };

package/dist/{workflow-build-manifest-1sC52TIG.mjs → workflow-build-manifest-CV6bBmDO.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { n as SHA256HashSchema, t as JsonSchemaSchema } from "./common-AK0q0Oz0.mjs";
-import { a as IntegrationScopeSchema, d as WorkflowStepEntrySchema, o as ResolvedCredentialSetSchema, t as CredentialRequirementsSchema, u as TriggerUploadDataSchema } from "./credential-requirements-D0mavK8j-CFMf0Xwu.mjs";
+import { a as IntegrationScopeSchema, d as WorkflowStepEntrySchema, o as ResolvedCredentialSetSchema, t as CredentialRequirementsSchema, u as TriggerUploadDataSchema } from "./credential-requirements-B5Alhu1v-DanlSKnT.mjs";
 import { a as SourceLocationSchema, i as ImportSourceSchema, n as CallsiteFingerprintSchema, t as CallKindSchema } from "./source-analysis-z2RSZw6X.mjs";
 import { z } from "zod";
 //#region ../../packages/workflow-build-contracts/src/flow-graph-schema.ts

package/dist/{workflow-bundler-BzHk73PM-muPv1yGG.mjs → workflow-bundler-Bs3zQNQv-Dy7lXxy3.mjs}

@@ -1,21 +1,32 @@
 #!/usr/bin/env node
 
 import { n as identifierName, o as parseSourceFile, r as isNode } from "./oxc-B3KI3rf_-B9omBIuN.mjs";
-import { r as formatEnvAccessError, t as createEnvAccessPlugin } from "./detect-env-access-CwkOYeYM-COq4U-4Y.mjs";
+import { r as formatEnvAccessError, t as createEnvAccessPlugin } from "./detect-env-access-CwkOYeYM-r4aynBU0.mjs";
 import * as path$1 from "node:path";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { rolldown } from "rolldown";
-//#region ../../packages/workflow-builder/dist/workflow-bundler-BzHk73PM.mjs
+//#region ../../packages/workflow-builder/dist/workflow-bundler-Bs3zQNQv.mjs
 function getDefaultExternal() {
 	return [
 		/^node:/,
 		"@swc/core",
 		/^@swc\/core-/,
 		/^@swc\/wasm/,
-		"playwright-core"
+		"playwright-core",
+		"@keystrokehq/core/flow-graph",
+		"oxc-parser",
+		/^@oxc-parser\//
 	];
 }
+/** Flow-graph AST parsing is build-time only; keep it out of deployed workflow bundles. */
+function isBuildOnlyModule(source) {
+	return source === "@keystrokehq/core/flow-graph" || source === "oxc-parser" || source.startsWith("@oxc-parser/") || source.includes("graph-builder") || source.includes("oxc-parser");
+}
+function isExternalModule(id, patterns) {
+	if (isBuildOnlyModule(id)) return true;
+	return patterns.some((pattern) => typeof pattern === "string" ? pattern === id : pattern.test(id));
+}
 function createVirtualEntry(filePath, localExportName) {
 	return `${localExportName === "default" ? `export { default } from ${JSON.stringify(filePath)};` : `export { ${localExportName} as default } from ${JSON.stringify(filePath)};`}\nexport * from ${JSON.stringify(filePath)};`;
 }
@@ -99,7 +110,7 @@ async function bundleTarget(options) {
 	const bundle = await rolldown({
 		input: entryId,
 		platform: "node",
-		external: options.external ?? getDefaultExternal(),
+		external: (id) => isExternalModule(id, options.external ?? getDefaultExternal()),
 		treeshake: true,
 		plugins: [createEnvAccessPlugin(envViolations, options.projectRoot), {
 			name: "workflow-entry",