@keystrokehq/hosting 0.1.7 → 0.1.8

package/dist/index.mjs

@@ -2275,6 +2275,21 @@ function handleReadonlyResult(payload) {
 	payload.value = Object.freeze(payload.value);
 	return payload;
 }
+const $ZodLazy = /* @__PURE__ */ $constructor("$ZodLazy", (inst, def) => {
+	$ZodType.init(inst, def);
+	defineLazy(inst._zod, "innerType", () => {
+		const d = def;
+		if (!d._cachedInner) d._cachedInner = def.getter();
+		return d._cachedInner;
+	});
+	defineLazy(inst._zod, "pattern", () => inst._zod.innerType?._zod?.pattern);
+	defineLazy(inst._zod, "propValues", () => inst._zod.innerType?._zod?.propValues);
+	defineLazy(inst._zod, "optin", () => inst._zod.innerType?._zod?.optin ?? void 0);
+	defineLazy(inst._zod, "optout", () => inst._zod.innerType?._zod?.optout ?? void 0);
+	inst._zod.parse = (payload, ctx) => {
+		return inst._zod.innerType._zod.run(payload, ctx);
+	};
+});
 const $ZodCustom = /* @__PURE__ */ $constructor("$ZodCustom", (inst, def) => {
 	$ZodCheck.init(inst, def);
 	$ZodType.init(inst, def);
@@ -3417,6 +3432,12 @@ const optionalProcessor = (schema, ctx, _json, params) => {
 	const seen = ctx.seen.get(schema);
 	seen.ref = def.innerType;
 };
+const lazyProcessor = (schema, ctx, _json, params) => {
+	const innerType = schema._zod.innerType;
+	process$1(innerType, ctx, params);
+	const seen = ctx.seen.get(schema);
+	seen.ref = innerType;
+};
 //#endregion
 //#region ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/iso.js
 const ZodISODateTime = /* @__PURE__ */ $constructor("ZodISODateTime", (inst, def) => {
@@ -4280,6 +4301,18 @@ function readonly(innerType) {
 		innerType
 	});
 }
+const ZodLazy = /* @__PURE__ */ $constructor("ZodLazy", (inst, def) => {
+	$ZodLazy.init(inst, def);
+	ZodType.init(inst, def);
+	inst._zod.processJSONSchema = (ctx, json, params) => lazyProcessor(inst, ctx, json, params);
+	inst.unwrap = () => inst._zod.def.getter();
+});
+function lazy(getter) {
+	return new ZodLazy({
+		type: "lazy",
+		getter
+	});
+}
 const ZodCustom = /* @__PURE__ */ $constructor("ZodCustom", (inst, def) => {
 	$ZodCustom.init(inst, def);
 	ZodType.init(inst, def);
@@ -4955,10 +4988,244 @@ const AppSlugSchema = ProjectSlugSchema;
 function resolveExplicitPublicPlatformOrigin(env = process.env) {
 	return env.PUBLIC_PLATFORM_URL?.replace(/\/$/, "") || void 0;
 }
+/** How a credential instance is stored (`credential_instances.auth_kind`). */
+const CredentialAuthKindSchema = _enum([
+	"api_key",
+	"oauth_managed",
+	"keystroke"
+]);
+/**
+* Where a credential instance is stored (`credential_instances.scope_type`), and the only thing an
+* action/tool can pin via `.scope(...)`. There is no resolution chain: when no scope is pinned, the
+* resolver tries the project default, then the org default, then throws.
+*/
+const CredentialScopeTypeSchema = _enum([
+	"organization",
+	"project",
+	"user"
+]);
+CredentialAuthKindSchema.options;
+CredentialScopeTypeSchema.options;
+/** Non-empty human-readable label or description (trimmed). */
+const requiredDisplayTextSchema = string().trim().min(1);
+/**
+* Structural workflow-canvas graph contract.
+*
+* This is the deterministic skeleton the deploy-time AST producer emits for a
+* workflow (nodes + edges), plus the manifest-derived trigger-source nodes. It
+* is the single source of truth shared by:
+* - the AST producer (emits it at deploy, stored with the manifest),
+* - the platform route that serves the canvas, and
+* - the SDK / web client that renders it (React Flow).
+*
+* Only the structural skeleton lives here. The LLM enrichment + run-overlay
+* envelope types live in `workflow-canvas-envelope.ts`; the SDK re-exports them.
+* See WORKFLOW.md (§4 grammar, §8 node ids, §9 caching).
+*/
+/**
+* Canvas node taxonomy — the single discriminator for every canvas node. The
+* client derives the React Flow component, icon, and per-node treatment from it
+* (no parallel `type` / `data.kind` fields), and the producer + fixtures emit it
+* directly, so the structural contract can never silently diverge across the
+* deploy → render boundary.
+* - Boundaries: `entry` (Start, owns input) · `exit` (Output, owns output) ·
+*   `error` (a terminal `throw` — an error output that ends the run on a branch)
+* - Callable: `step` (action / agent / llm / hook / child-workflow invocation) —
+*   the invocation flavor lives in {@link WorkflowCanvasCallKind}
+* - Structural control flow: `code-block` · `decision` · `merge` · `loop` ·
+*   `parallel` (group containers) · `loop-start` (the group body's entry marker,
+*   shared by loop + parallel)
+* - Upstream of entry: `trigger-source` (one per manifest trigger attachment)
+*
+* `Promise.all([...])` is modeled as a `parallel` group container: the branches
+* are stacked inside and the container itself is the single prong leaving the
+* wrapper (there is no separate fork/join pair).
+*
+* `exit` and `error` are both terminals: a `return` flows to the shared `exit`
+* (the workflow output), while a `throw` gets its own `error` terminal off the
+* branch so guard clauses (`if (bad) throw …`) read as a visible dead-end.
+*/
+const WorkflowCanvasNodeTypeSchema = _enum([
+	"entry",
+	"exit",
+	"error",
+	"step",
+	"code-block",
+	"decision",
+	"merge",
+	"loop",
+	"parallel",
+	"loop-start",
+	"trigger-source"
+]);
+_enum([
+	"workflow-step",
+	"agent",
+	"llm",
+	"wait",
+	"hook",
+	"tool",
+	"child-workflow"
+]);
+/** A labeled branch output on a decision-style node. */
+const WorkflowCanvasNodeOutputSchema = object({
+	id: string(),
+	label: string()
+});
+/**
+* A step input's configured value at its call site, captured deterministically
+* by the producer from the call's argument object. The platform join turns this
+* into the inspector's {@link WorkflowNodeInputBinding} (filling display labels).
+*/
+const WorkflowCanvasRawBindingSchema = object({
+	tokens: array(discriminatedUnion("kind", [
+		object({
+			kind: literal("text"),
+			text: string()
+		}),
+		object({
+			kind: literal("reference"),
+			/** Upstream node id this value flows from; absent only for unresolved refs. */
+			sourceNodeId: string().optional(),
+			/** Output field of the source (dotted path); omitted = the whole output. */
+			field: string().optional()
+		}),
+		object({
+			kind: literal("variable"),
+			text: string()
+		}),
+		object({
+			kind: literal("call"),
+			name: string()
+		})
+	])),
+	/** Render as a tall multi-line box (object/array/multiline template values). */
+	multiline: boolean().optional()
+});
+/**
+* Statically-captured `promptLlm` options for an `llm` step node. Literal-only:
+* dynamic/expression values (a computed model, a `system` built by a function) are
+* not captured; `system`/`outputSchema` record presence so the inspector can note
+* "a system prompt is configured" / "structured output" without their values.
+*/
+const WorkflowCanvasLlmOptionsSchema = object({
+	model: string().optional(),
+	maxTokens: number$1().optional(),
+	temperature: number$1().optional(),
+	thinkingLevel: string().optional(),
+	hasSystemPrompt: boolean().optional(),
+	hasOutputSchema: boolean().optional()
+});
+const WorkflowCanvasNodeDataSchema = object({
+	label: string(),
+	/** Set on group nodes (loop / parallel section containers). */
+	groupKind: _enum([
+		"loop",
+		"parallel",
+		"conditional"
+	]).optional(),
+	description: string().optional(),
+	/** {@link WorkflowCanvasCallKind} or a looser raw call-site label. */
+	callKind: string().optional(),
+	/**
+	* App/integration slug for a `step` whose action/agent is imported directly
+	* from a `@keystrokehq/<app>` package (e.g. "slack", "apollo"). Lets the client
+	* badge the node with that app's logo; absent for custom (project-local)
+	* actions, which fall back to the call-kind icon.
+	*/
+	appSlug: string().optional(),
+	/** Cron/webhook/poll discriminator on trigger-source nodes. */
+	triggerType: string().optional(),
+	/** Branch outputs (decision nodes). */
+	outputs: array(WorkflowCanvasNodeOutputSchema).optional(),
+	/**
+	* Action/agent/workflow slug resolved at deploy time (via import → definition).
+	* Optional when the deploy build cannot resolve source (dist-only artifacts).
+	*/
+	slug: string().optional(),
+	/**
+	* Durable call-site ids nested inside an off-grammar `code-block` (same-file only).
+	* Used by the run overlay to light the block when any contained step executes.
+	*/
+	containedCallSiteIds: array(string()).optional(),
+	/**
+	* Per-input call-site value bindings for `step` nodes, keyed by input field name.
+	* Deterministically captured from the call's argument object; reference tokens point
+	* at the upstream node that produced the value. The platform join fills display labels.
+	*/
+	inputBindings: record(string(), WorkflowCanvasRawBindingSchema).optional(),
+	/**
+	* Static `promptLlm(prompt, options)` configuration captured at the call site for
+	* `llm` step nodes. Only literal values are captured (model/maxTokens/temperature/
+	* thinkingLevel); `system`/`outputSchema` are usually expressions, so only their
+	* presence is recorded. Absent when no options are statically resolvable.
+	*/
+	llmOptions: WorkflowCanvasLlmOptionsSchema.optional()
+});
+/**
+* A single structural node. This is the deploy artifact's shape: identity
+* (`id`), the canonical discriminator (`nodeType`), display `data`, and group
+* nesting (`parentId`). All layout/rendering — React Flow component key,
+* positions, sizes, `extent`, group box dimensions — is derived entirely
+* client-side from this structure, so it never leaks into the wire contract.
+*/
+const WorkflowCanvasGraphNodeSchema = object({
+	id: string(),
+	nodeType: WorkflowCanvasNodeTypeSchema,
+	data: WorkflowCanvasNodeDataSchema,
+	/** Set on children nested inside a group (loop / parallel) container. */
+	parentId: string().optional()
+});
+const WorkflowCanvasEdgeSchema = object({
+	id: string(),
+	source: string(),
+	target: string(),
+	type: string().optional(),
+	label: string().optional(),
+	sourceHandle: string().optional(),
+	targetHandle: string().optional(),
+	data: object({ branchKind: _enum([
+		"then",
+		"else",
+		"parallel-branch",
+		"error"
+	]).optional() }).optional()
+});
+/** A statically-evaluable top-level `const` value (literal scalars only). */
+const WorkflowCanvasConstantValueSchema = union([
+	string(),
+	number$1(),
+	boolean()
+]);
+/**
+* Top-level `const NAME = <literal>` declarations in the workflow source, captured
+* at deploy. Lets the platform resolve `variable` value tokens (e.g. a `model` set
+* to a named const) to their concrete value for display. Scalars only — computed,
+* function-local, or non-literal consts are intentionally omitted.
+*/
+const WorkflowCanvasConstantsSchema = record(string(), WorkflowCanvasConstantValueSchema);
+const WorkflowCanvasGraphSchema = object({
+	nodes: array(WorkflowCanvasGraphNodeSchema),
+	edges: array(WorkflowCanvasEdgeSchema),
+	/** Top-level literal constants from the workflow source (for value-token resolution). */
+	constants: WorkflowCanvasConstantsSchema.optional()
+});
+/**
+* Deploy-time summary of one credential a step requires, derived from the
+* action/agent-tool definition's `.credentials`. The workflow-canvas credential
+* overlay joins a step node's `slug` to these to resolve the bound instance.
+* `key` doubles as the app slug (matches `credential_instances.app_slug`).
+*/
+const CredentialRequirementSummarySchema = object({
+	key: string(),
+	kind: CredentialAuthKindSchema,
+	/** Scope pinned via `.scope(...)`; absent means project-default → org-default. */
+	scope: CredentialScopeTypeSchema.optional()
+});
 const StoredRouteManifestSkillSchema = object({
 	slug: string(),
-	name: string().optional(),
-	description: string().optional(),
+	name: requiredDisplayTextSchema,
+	description: requiredDisplayTextSchema,
 	moduleFile: string()
 });
 const attachmentSchemasSchema = record(string(), object({
@@ -4966,8 +5233,8 @@ const attachmentSchemasSchema = record(string(), object({
 	filterSchema: record(string(), unknown()).optional()
 }));
 const attachmentMetaSchema = record(string(), object({
-	name: string().optional(),
-	description: string().optional()
+	name: requiredDisplayTextSchema,
+	description: requiredDisplayTextSchema
 }));
 const storedRouteManifestEntryV2Schema = discriminatedUnion("kind", [
 	object({ kind: literal("health") }),
@@ -4975,23 +5242,43 @@ const storedRouteManifestEntryV2Schema = discriminatedUnion("kind", [
 		kind: literal("agent"),
 		slug: string(),
 		moduleFile: string(),
-		name: string().optional(),
-		description: string().optional(),
+		name: requiredDisplayTextSchema,
+		description: requiredDisplayTextSchema,
 		model: string(),
 		systemPrompt: string(),
 		toolCount: number$1().int().nonnegative(),
 		credentialCount: number$1().int().nonnegative(),
 		appSlugs: array(string()).default([]),
-		toolSlugs: array(string()).default([])
+		toolSlugs: array(string()).default([]),
+		/** Credential requirements per tool slug (the agent's credential consumer key). */
+		toolRequirements: record(string(), array(CredentialRequirementSummarySchema)).optional()
+	}),
+	object({
+		kind: literal("action"),
+		slug: string(),
+		name: requiredDisplayTextSchema,
+		description: requiredDisplayTextSchema,
+		moduleFile: string(),
+		/** App slug for actions imported from an integration package (`@keystrokehq/<app>/actions`). */
+		appSlug: string().optional(),
+		inputSchema: record(string(), unknown()),
+		outputSchema: record(string(), unknown()),
+		/** Credentials this action requires (for the canvas credential overlay). */
+		requirements: array(CredentialRequirementSummarySchema).optional()
 	}),
 	object({
 		kind: literal("workflow"),
 		slug: string(),
-		name: string().optional(),
-		description: string().optional(),
+		name: requiredDisplayTextSchema,
+		description: requiredDisplayTextSchema,
 		subscribable: boolean(),
 		moduleFile: string(),
-		requestSchema: record(string(), unknown())
+		requestSchema: record(string(), unknown()),
+		responseSchema: record(string(), unknown()).optional(),
+		/** Deterministic AST control-flow skeleton (deploy-time producer). */
+		flowGraph: WorkflowCanvasGraphSchema.optional(),
+		/** sha256 of the workflow source the `flowGraph` was produced from (staleness). */
+		flowGraphSourceHash: string().optional()
 	}),
 	object({
 		kind: literal("trigger-webhook"),
@@ -5010,8 +5297,8 @@ const storedRouteManifestEntryV2Schema = discriminatedUnion("kind", [
 		moduleFile: string(),
 		sourceHash: string().optional(),
 		schedule: string(),
-		name: string().optional(),
-		description: string().optional()
+		name: requiredDisplayTextSchema,
+		description: requiredDisplayTextSchema
 	}),
 	object({
 		kind: literal("trigger-poll-group"),
@@ -5027,8 +5314,8 @@ const storedRouteManifestEntryV2Schema = discriminatedUnion("kind", [
 		moduleFile: string(),
 		sourceHash: string().optional(),
 		schedule: string(),
-		name: string().optional(),
-		description: string().optional()
+		name: requiredDisplayTextSchema,
+		description: requiredDisplayTextSchema
 	})
 ]);
 object({
@@ -5454,24 +5741,6 @@ object({
 	outputParameters: record(string(), unknown()).optional(),
 	version: string().optional()
 });
-/** How a credential instance is stored (`credential_instances.auth_kind`). */
-const CredentialAuthKindSchema = _enum([
-	"api_key",
-	"oauth_managed",
-	"keystroke"
-]);
-/**
-* Where a credential instance is stored (`credential_instances.scope_type`), and the only thing an
-* action/tool can pin via `.scope(...)`. There is no resolution chain: when no scope is pinned, the
-* resolver tries the project default, then the org default, then throws.
-*/
-const CredentialScopeTypeSchema = _enum([
-	"organization",
-	"project",
-	"user"
-]);
-CredentialAuthKindSchema.options;
-CredentialScopeTypeSchema.options;
 /** Scope of a platform app credential (maps to `credential_instances.scope_type`). */
 const AppCredentialScopeSchema = _enum([
 	"user",
@@ -6467,7 +6736,7 @@ object({
 	id: string(),
 	slug: string(),
 	name: string(),
-	description: string().nullable(),
+	description: string().min(1),
 	type: TriggerTypeSchema,
 	status: TriggerStatusSchema,
 	projectId: string(),
@@ -6763,7 +7032,7 @@ const AgentSummarySchema = object({
 	name: string().min(1),
 	projectId: string().min(1),
 	updatedAt: string().min(1),
-	description: string().optional(),
+	description: string().min(1),
 	sourcePath: string().min(1).optional(),
 	model: string().optional(),
 	capabilities: object({
@@ -6785,7 +7054,7 @@ const WorkflowSummarySchema = object({
 	name: string().min(1),
 	projectId: string().min(1),
 	updatedAt: string().min(1),
-	description: string().optional(),
+	description: string().min(1),
 	sourcePath: string().min(1).optional(),
 	lastRunAt: optionalTimestamp
 });
@@ -6795,7 +7064,7 @@ const SkillSummarySchema = object({
 	name: string().min(1),
 	projectId: string().min(1),
 	updatedAt: string().min(1),
-	description: string().optional(),
+	description: string().min(1),
 	sourcePath: string().min(1).optional()
 });
 AgentSummarySchema.nullable();
@@ -6904,6 +7173,245 @@ object({ files: array(object({
 	id: string(),
 	path: string().min(1)
 })) });
+/** Whether the overview is still being produced or finished. */
+const WorkflowOverviewStatusSchema = _enum(["generating", "ready"]);
+/** One phase of the guided-tour overview. */
+const WorkflowPhaseSchema = object({
+	id: string(),
+	title: string(),
+	copy: string(),
+	nodeIds: array(string())
+});
+object({
+	status: WorkflowOverviewStatusSchema,
+	summary: string(),
+	phases: array(WorkflowPhaseSchema),
+	hash: string(),
+	generatedAt: string().nullable(),
+	model: string()
+});
+/** Subset of JSON-Schema field types the dashboard form renders inline. */
+const WorkflowInputFieldTypeSchema = _enum([
+	"string",
+	"number",
+	"boolean",
+	"enum",
+	"object",
+	"array"
+]);
+const WorkflowInputFieldSchema = lazy(() => object({
+	key: string(),
+	label: string(),
+	type: WorkflowInputFieldTypeSchema,
+	required: boolean(),
+	description: string().optional(),
+	placeholder: string().optional(),
+	options: array(string()).optional(),
+	default: union([
+		string(),
+		number$1(),
+		boolean()
+	]).optional(),
+	children: array(WorkflowInputFieldSchema).optional(),
+	format: string().optional()
+}));
+object({
+	schema: object({ fields: array(WorkflowInputFieldSchema) }),
+	values: record(string(), unknown()).nullable()
+});
+object({ runId: string() });
+/** Annotation lifecycle: "generating" while the LLM pass streams in, then "ready". */
+const WorkflowCanvasStatusSchema = _enum(["generating", "ready"]);
+/** LLM-produced enrichment for a single skeleton node. */
+const WorkflowCanvasAnnotationSchema = object({
+	label: string().optional(),
+	description: string().optional()
+});
+/** The configured value of one input at this call site. */
+const WorkflowNodeInputBindingSchema = object({
+	tokens: array(discriminatedUnion("kind", [
+		object({
+			kind: literal("text"),
+			text: string()
+		}),
+		object({
+			kind: literal("reference"),
+			sourceNodeId: string().optional(),
+			sourceLabel: string(),
+			field: string().optional()
+		}),
+		object({
+			kind: literal("variable"),
+			text: string(),
+			/** Concrete value when `text` resolves to a top-level literal constant. */
+			resolvedValue: string().optional()
+		}),
+		object({
+			kind: literal("call"),
+			name: string()
+		})
+	])),
+	multiline: boolean().optional()
+});
+/** An inspector input with optional call-site binding. */
+const WorkflowCanvasNodeInputSchema = WorkflowInputFieldSchema.and(object({
+	binding: WorkflowNodeInputBindingSchema.optional(),
+	additional: boolean().optional()
+}));
+/** Authored, deterministic metadata for a single node. */
+const WorkflowCanvasNodeMetaSchema = object({
+	kind: _enum([
+		"action",
+		"agent",
+		"workflow",
+		"llm",
+		"trigger",
+		"boundary"
+	]),
+	slug: string(),
+	name: string(),
+	description: string().optional(),
+	appSlug: string().optional(),
+	inputs: array(WorkflowCanvasNodeInputSchema),
+	outputs: array(WorkflowInputFieldSchema),
+	requiredApps: array(string()).optional(),
+	model: string().optional(),
+	toolCount: number$1().int().nonnegative().optional()
+});
+object({
+	graph: WorkflowCanvasGraphSchema,
+	nodeMetadata: record(string(), WorkflowCanvasNodeMetaSchema),
+	annotations: record(string(), WorkflowCanvasAnnotationSchema),
+	status: WorkflowCanvasStatusSchema,
+	hash: string(),
+	generatedAt: string().nullable(),
+	model: string()
+});
+const WorkflowCanvasNodeRunStateSchema = object({
+	status: _enum([
+		"pending",
+		"running",
+		"succeeded",
+		"failed",
+		"skipped"
+	]),
+	iteration: object({
+		index: number$1().int().nonnegative(),
+		total: number$1().int().nonnegative()
+	}).optional()
+});
+/** Overall lifecycle of a run as the canvas animates it. */
+const WorkflowCanvasRunStatusSchema = _enum([
+	"running",
+	"succeeded",
+	"failed",
+	"canceled"
+]);
+object({
+	runId: string(),
+	status: WorkflowCanvasRunStatusSchema,
+	startedAt: string(),
+	finishedAt: string().nullable(),
+	nodeStates: record(string(), WorkflowCanvasNodeRunStateSchema)
+});
+/** Scope a credential instance lives in. */
+const WorkflowCredentialScopeSchema = _enum([
+	"organization",
+	"project",
+	"user"
+]);
+/** The concrete credential instance a binding currently resolves to. */
+const WorkflowResolvedCredentialSchema = object({
+	id: string(),
+	name: string(),
+	scope: WorkflowCredentialScopeSchema,
+	appSlug: string().optional(),
+	isDefault: boolean().optional(),
+	projectId: string().optional(),
+	projectName: string().optional()
+});
+record(string(), WorkflowCanvasAnnotationSchema);
+/** One opaque code-block the annotation pass should label, keyed by its canvas node id. */
+const WorkflowCanvasAnnotationCodeBlockSchema = object({
+	nodeId: string(),
+	/** The raw source snippet (the node's label) the LLM turns into human copy. */
+	source: string()
+});
+/** Inputs the worker feeds the LLM for the gated code-block annotation pass. */
+const WorkflowCanvasAnnotationsInputSchema = object({
+	workflowName: string(),
+	workflowDescription: string().nullable(),
+	codeBlocks: array(WorkflowCanvasAnnotationCodeBlockSchema)
+});
+object({
+	workflowId: string(),
+	projectId: string(),
+	hash: string(),
+	model: string(),
+	input: WorkflowCanvasAnnotationsInputSchema
+});
+/** One node as the overview LLM sees it (derived from the canvas node metadata + graph). */
+const WorkflowOverviewNodeSchema = object({
+	nodeId: string(),
+	label: string(),
+	kind: string(),
+	description: string().optional(),
+	/** App/integration slug for steps imported from a `@keystrokehq/<app>` package. */
+	appSlug: string().optional(),
+	/** Authored input field keys (from the action/agent/workflow definition). */
+	inputs: array(string()).optional(),
+	/** Authored output field keys. */
+	outputs: array(string()).optional(),
+	/** Agent-only: the model the agent runs on. */
+	model: string().optional(),
+	/** Agent-only: number of tools available to the agent. */
+	toolCount: number$1().int().nonnegative().optional()
+});
+/** Inputs the worker feeds the LLM to produce the workflow overview (summary + phases). */
+const WorkflowOverviewInputSchema = object({
+	workflowName: string(),
+	workflowDescription: string().nullable(),
+	/** Display labels of the trigger sources upstream of the workflow (read-only context). */
+	triggers: array(string()),
+	nodes: array(WorkflowOverviewNodeSchema),
+	/** The workflow's TypeScript source (best-effort; null when the deploy has no source snapshot). */
+	source: string().nullable()
+});
+object({
+	workflowId: string(),
+	projectId: string(),
+	hash: string(),
+	model: string(),
+	input: WorkflowOverviewInputSchema
+});
+const WorkflowCanvasCredentialBindingBaseSchema = object({
+	credentialKey: string(),
+	label: string(),
+	appSlug: string().optional()
+});
+/** How one credential requirement on a step currently resolves. */
+const WorkflowCanvasCredentialBindingSchema = union([
+	WorkflowCanvasCredentialBindingBaseSchema.extend({
+		policy: _enum([
+			"project-default",
+			"org-default",
+			"assigned"
+		]),
+		instance: WorkflowResolvedCredentialSchema
+	}),
+	WorkflowCanvasCredentialBindingBaseSchema.extend({
+		policy: literal("scope-pinned"),
+		pinnedScope: WorkflowCredentialScopeSchema,
+		instance: WorkflowResolvedCredentialSchema
+	}),
+	WorkflowCanvasCredentialBindingBaseSchema.extend({
+		policy: literal("unresolved"),
+		reason: _enum(["needs-selection", "missing"]),
+		pinnedScope: WorkflowCredentialScopeSchema.optional()
+	})
+]);
+record(string(), array(WorkflowCanvasCredentialBindingSchema));
+record(string(), unknown());
 //#endregion
 //#region src/runtime.ts
 /** Builds base64 `KEYSTROKE_ORG_ARTIFACTS` payload for org worker containers. */