@keystrokehq/platform 0.1.25 → 0.1.26

package/dist/{dist-BGnpuTuc.cjs → dist-BSIIH4ft.cjs}

@@ -183,7 +183,7 @@ function slugify(input) {
 	return input.toLowerCase().trim().replace(/[^\w\s-]/g, "").replace(/[\s_-]+/g, "-").replace(/^-+|-+$/g, "");
 }
 const captureStackTrace = "captureStackTrace" in Error ? Error.captureStackTrace : (..._args) => {};
-function isObject(data) {
+function isObject$3(data) {
 	return typeof data === "object" && data !== null && !Array.isArray(data);
 }
 const allowsEval = /* @__PURE__ */ cached(() => {
@@ -197,12 +197,12 @@ const allowsEval = /* @__PURE__ */ cached(() => {
 	}
 });
 function isPlainObject$1(o) {
-	if (isObject(o) === false) return false;
+	if (isObject$3(o) === false) return false;
 	const ctor = o.constructor;
 	if (ctor === void 0) return true;
 	if (typeof ctor !== "function") return true;
 	const prot = ctor.prototype;
-	if (isObject(prot) === false) return false;
+	if (isObject$3(prot) === false) return false;
 	if (Object.prototype.hasOwnProperty.call(prot, "isPrototypeOf") === false) return false;
 	return true;
 }
@@ -1590,7 +1590,7 @@ const $ZodObject = /* @__PURE__ */ $constructor("$ZodObject", (inst, def) => {
 		}
 		return propValues;
 	});
-	const isObject$1 = isObject;
+	const isObject$1 = isObject$3;
 	const catchall = def.catchall;
 	let value;
 	inst._zod.parse = (payload, ctx) => {
@@ -1719,7 +1719,7 @@ const $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def)
 		return (payload, ctx) => fn(shape, payload, ctx);
 	};
 	let fastpass;
-	const isObject$2 = isObject;
+	const isObject$2 = isObject$3;
 	const jit = !globalConfig.jitless;
 	const fastEnabled = jit && allowsEval.value;
 	const catchall = def.catchall;
@@ -1831,7 +1831,7 @@ const $ZodDiscriminatedUnion = /* @__PURE__ */ $constructor("$ZodDiscriminatedUn
 	});
 	inst._zod.parse = (payload, ctx) => {
 		const input = payload.value;
-		if (!isObject(input)) {
+		if (!isObject$3(input)) {
 			payload.issues.push({
 				code: "invalid_type",
 				expected: "object",
@@ -2302,6 +2302,21 @@ function handleReadonlyResult(payload) {
 	payload.value = Object.freeze(payload.value);
 	return payload;
 }
+const $ZodLazy = /* @__PURE__ */ $constructor("$ZodLazy", (inst, def) => {
+	$ZodType.init(inst, def);
+	defineLazy(inst._zod, "innerType", () => {
+		const d = def;
+		if (!d._cachedInner) d._cachedInner = def.getter();
+		return d._cachedInner;
+	});
+	defineLazy(inst._zod, "pattern", () => inst._zod.innerType?._zod?.pattern);
+	defineLazy(inst._zod, "propValues", () => inst._zod.innerType?._zod?.propValues);
+	defineLazy(inst._zod, "optin", () => inst._zod.innerType?._zod?.optin ?? void 0);
+	defineLazy(inst._zod, "optout", () => inst._zod.innerType?._zod?.optout ?? void 0);
+	inst._zod.parse = (payload, ctx) => {
+		return inst._zod.innerType._zod.run(payload, ctx);
+	};
+});
 const $ZodCustom = /* @__PURE__ */ $constructor("$ZodCustom", (inst, def) => {
 	$ZodCheck.init(inst, def);
 	$ZodType.init(inst, def);
@@ -3436,6 +3451,12 @@ const optionalProcessor = (schema, ctx, _json, params) => {
 	const seen = ctx.seen.get(schema);
 	seen.ref = def.innerType;
 };
+const lazyProcessor = (schema, ctx, _json, params) => {
+	const innerType = schema._zod.innerType;
+	process$1(innerType, ctx, params);
+	const seen = ctx.seen.get(schema);
+	seen.ref = innerType;
+};
 const ZodISODateTime = /* @__PURE__ */ $constructor("ZodISODateTime", (inst, def) => {
 	$ZodISODateTime.init(inst, def);
 	ZodStringFormat.init(inst, def);
@@ -4291,6 +4312,18 @@ function readonly(innerType) {
 		innerType
 	});
 }
+const ZodLazy = /* @__PURE__ */ $constructor("ZodLazy", (inst, def) => {
+	$ZodLazy.init(inst, def);
+	ZodType.init(inst, def);
+	inst._zod.processJSONSchema = (ctx, json, params) => lazyProcessor(inst, ctx, json, params);
+	inst.unwrap = () => inst._zod.def.getter();
+});
+function lazy(getter) {
+	return new ZodLazy({
+		type: "lazy",
+		getter
+	});
+}
 const ZodCustom = /* @__PURE__ */ $constructor("ZodCustom", (inst, def) => {
 	$ZodCustom.init(inst, def);
 	ZodType.init(inst, def);
@@ -4962,10 +4995,244 @@ const AppSlugSchema$1 = ProjectSlugSchema$1;
 function resolveExplicitPublicPlatformOrigin$1(env = process.env) {
 	return env.PUBLIC_PLATFORM_URL?.replace(/\/$/, "") || void 0;
 }
+/** How a credential instance is stored (`credential_instances.auth_kind`). */
+const CredentialAuthKindSchema$1 = _enum([
+	"api_key",
+	"oauth_managed",
+	"keystroke"
+]);
+/**
+* Where a credential instance is stored (`credential_instances.scope_type`), and the only thing an
+* action/tool can pin via `.scope(...)`. There is no resolution chain: when no scope is pinned, the
+* resolver tries the project default, then the org default, then throws.
+*/
+const CredentialScopeTypeSchema$1 = _enum([
+	"organization",
+	"project",
+	"user"
+]);
+CredentialAuthKindSchema$1.options;
+CredentialScopeTypeSchema$1.options;
+/** Non-empty human-readable label or description (trimmed). */
+const requiredDisplayTextSchema$1 = string().trim().min(1);
+/**
+* Structural workflow-canvas graph contract.
+*
+* This is the deterministic skeleton the deploy-time AST producer emits for a
+* workflow (nodes + edges), plus the manifest-derived trigger-source nodes. It
+* is the single source of truth shared by:
+* - the AST producer (emits it at deploy, stored with the manifest),
+* - the platform route that serves the canvas, and
+* - the SDK / web client that renders it (React Flow).
+*
+* Only the structural skeleton lives here. The LLM enrichment + run-overlay
+* envelope types live in `workflow-canvas-envelope.ts`; the SDK re-exports them.
+* See WORKFLOW.md (§4 grammar, §8 node ids, §9 caching).
+*/
+/**
+* Canvas node taxonomy — the single discriminator for every canvas node. The
+* client derives the React Flow component, icon, and per-node treatment from it
+* (no parallel `type` / `data.kind` fields), and the producer + fixtures emit it
+* directly, so the structural contract can never silently diverge across the
+* deploy → render boundary.
+* - Boundaries: `entry` (Start, owns input) · `exit` (Output, owns output) ·
+*   `error` (a terminal `throw` — an error output that ends the run on a branch)
+* - Callable: `step` (action / agent / llm / hook / child-workflow invocation) —
+*   the invocation flavor lives in {@link WorkflowCanvasCallKind}
+* - Structural control flow: `code-block` · `decision` · `merge` · `loop` ·
+*   `parallel` (group containers) · `loop-start` (the group body's entry marker,
+*   shared by loop + parallel)
+* - Upstream of entry: `trigger-source` (one per manifest trigger attachment)
+*
+* `Promise.all([...])` is modeled as a `parallel` group container: the branches
+* are stacked inside and the container itself is the single prong leaving the
+* wrapper (there is no separate fork/join pair).
+*
+* `exit` and `error` are both terminals: a `return` flows to the shared `exit`
+* (the workflow output), while a `throw` gets its own `error` terminal off the
+* branch so guard clauses (`if (bad) throw …`) read as a visible dead-end.
+*/
+const WorkflowCanvasNodeTypeSchema$1 = _enum([
+	"entry",
+	"exit",
+	"error",
+	"step",
+	"code-block",
+	"decision",
+	"merge",
+	"loop",
+	"parallel",
+	"loop-start",
+	"trigger-source"
+]);
+_enum([
+	"workflow-step",
+	"agent",
+	"llm",
+	"wait",
+	"hook",
+	"tool",
+	"child-workflow"
+]);
+/** A labeled branch output on a decision-style node. */
+const WorkflowCanvasNodeOutputSchema$1 = object({
+	id: string(),
+	label: string()
+});
+/**
+* A step input's configured value at its call site, captured deterministically
+* by the producer from the call's argument object. The platform join turns this
+* into the inspector's {@link WorkflowNodeInputBinding} (filling display labels).
+*/
+const WorkflowCanvasRawBindingSchema$1 = object({
+	tokens: array(discriminatedUnion("kind", [
+		object({
+			kind: literal("text"),
+			text: string()
+		}),
+		object({
+			kind: literal("reference"),
+			/** Upstream node id this value flows from; absent only for unresolved refs. */
+			sourceNodeId: string().optional(),
+			/** Output field of the source (dotted path); omitted = the whole output. */
+			field: string().optional()
+		}),
+		object({
+			kind: literal("variable"),
+			text: string()
+		}),
+		object({
+			kind: literal("call"),
+			name: string()
+		})
+	])),
+	/** Render as a tall multi-line box (object/array/multiline template values). */
+	multiline: boolean().optional()
+});
+/**
+* Statically-captured `promptLlm` options for an `llm` step node. Literal-only:
+* dynamic/expression values (a computed model, a `system` built by a function) are
+* not captured; `system`/`outputSchema` record presence so the inspector can note
+* "a system prompt is configured" / "structured output" without their values.
+*/
+const WorkflowCanvasLlmOptionsSchema$1 = object({
+	model: string().optional(),
+	maxTokens: number$1().optional(),
+	temperature: number$1().optional(),
+	thinkingLevel: string().optional(),
+	hasSystemPrompt: boolean().optional(),
+	hasOutputSchema: boolean().optional()
+});
+const WorkflowCanvasNodeDataSchema$1 = object({
+	label: string(),
+	/** Set on group nodes (loop / parallel section containers). */
+	groupKind: _enum([
+		"loop",
+		"parallel",
+		"conditional"
+	]).optional(),
+	description: string().optional(),
+	/** {@link WorkflowCanvasCallKind} or a looser raw call-site label. */
+	callKind: string().optional(),
+	/**
+	* App/integration slug for a `step` whose action/agent is imported directly
+	* from a `@keystrokehq/<app>` package (e.g. "slack", "apollo"). Lets the client
+	* badge the node with that app's logo; absent for custom (project-local)
+	* actions, which fall back to the call-kind icon.
+	*/
+	appSlug: string().optional(),
+	/** Cron/webhook/poll discriminator on trigger-source nodes. */
+	triggerType: string().optional(),
+	/** Branch outputs (decision nodes). */
+	outputs: array(WorkflowCanvasNodeOutputSchema$1).optional(),
+	/**
+	* Action/agent/workflow slug resolved at deploy time (via import → definition).
+	* Optional when the deploy build cannot resolve source (dist-only artifacts).
+	*/
+	slug: string().optional(),
+	/**
+	* Durable call-site ids nested inside an off-grammar `code-block` (same-file only).
+	* Used by the run overlay to light the block when any contained step executes.
+	*/
+	containedCallSiteIds: array(string()).optional(),
+	/**
+	* Per-input call-site value bindings for `step` nodes, keyed by input field name.
+	* Deterministically captured from the call's argument object; reference tokens point
+	* at the upstream node that produced the value. The platform join fills display labels.
+	*/
+	inputBindings: record(string(), WorkflowCanvasRawBindingSchema$1).optional(),
+	/**
+	* Static `promptLlm(prompt, options)` configuration captured at the call site for
+	* `llm` step nodes. Only literal values are captured (model/maxTokens/temperature/
+	* thinkingLevel); `system`/`outputSchema` are usually expressions, so only their
+	* presence is recorded. Absent when no options are statically resolvable.
+	*/
+	llmOptions: WorkflowCanvasLlmOptionsSchema$1.optional()
+});
+/**
+* A single structural node. This is the deploy artifact's shape: identity
+* (`id`), the canonical discriminator (`nodeType`), display `data`, and group
+* nesting (`parentId`). All layout/rendering — React Flow component key,
+* positions, sizes, `extent`, group box dimensions — is derived entirely
+* client-side from this structure, so it never leaks into the wire contract.
+*/
+const WorkflowCanvasGraphNodeSchema$1 = object({
+	id: string(),
+	nodeType: WorkflowCanvasNodeTypeSchema$1,
+	data: WorkflowCanvasNodeDataSchema$1,
+	/** Set on children nested inside a group (loop / parallel) container. */
+	parentId: string().optional()
+});
+const WorkflowCanvasEdgeSchema$1 = object({
+	id: string(),
+	source: string(),
+	target: string(),
+	type: string().optional(),
+	label: string().optional(),
+	sourceHandle: string().optional(),
+	targetHandle: string().optional(),
+	data: object({ branchKind: _enum([
+		"then",
+		"else",
+		"parallel-branch",
+		"error"
+	]).optional() }).optional()
+});
+/** A statically-evaluable top-level `const` value (literal scalars only). */
+const WorkflowCanvasConstantValueSchema$1 = union([
+	string(),
+	number$1(),
+	boolean()
+]);
+/**
+* Top-level `const NAME = <literal>` declarations in the workflow source, captured
+* at deploy. Lets the platform resolve `variable` value tokens (e.g. a `model` set
+* to a named const) to their concrete value for display. Scalars only — computed,
+* function-local, or non-literal consts are intentionally omitted.
+*/
+const WorkflowCanvasConstantsSchema$1 = record(string(), WorkflowCanvasConstantValueSchema$1);
+const WorkflowCanvasGraphSchema$1 = object({
+	nodes: array(WorkflowCanvasGraphNodeSchema$1),
+	edges: array(WorkflowCanvasEdgeSchema$1),
+	/** Top-level literal constants from the workflow source (for value-token resolution). */
+	constants: WorkflowCanvasConstantsSchema$1.optional()
+});
+/**
+* Deploy-time summary of one credential a step requires, derived from the
+* action/agent-tool definition's `.credentials`. The workflow-canvas credential
+* overlay joins a step node's `slug` to these to resolve the bound instance.
+* `key` doubles as the app slug (matches `credential_instances.app_slug`).
+*/
+const CredentialRequirementSummarySchema$1 = object({
+	key: string(),
+	kind: CredentialAuthKindSchema$1,
+	/** Scope pinned via `.scope(...)`; absent means project-default → org-default. */
+	scope: CredentialScopeTypeSchema$1.optional()
+});
 const StoredRouteManifestSkillSchema$1 = object({
 	slug: string(),
-	name: string().optional(),
-	description: string().optional(),
+	name: requiredDisplayTextSchema$1,
+	description: requiredDisplayTextSchema$1,
 	moduleFile: string()
 });
 const attachmentSchemasSchema$1 = record(string(), object({
@@ -4973,8 +5240,8 @@ const attachmentSchemasSchema$1 = record(string(), object({
 	filterSchema: record(string(), unknown()).optional()
 }));
 const attachmentMetaSchema$1 = record(string(), object({
-	name: string().optional(),
-	description: string().optional()
+	name: requiredDisplayTextSchema$1,
+	description: requiredDisplayTextSchema$1
 }));
 const storedRouteManifestEntryV2Schema$1 = discriminatedUnion("kind", [
 	object({ kind: literal("health") }),
@@ -4982,23 +5249,43 @@ const storedRouteManifestEntryV2Schema$1 = discriminatedUnion("kind", [
 		kind: literal("agent"),
 		slug: string(),
 		moduleFile: string(),
-		name: string().optional(),
-		description: string().optional(),
+		name: requiredDisplayTextSchema$1,
+		description: requiredDisplayTextSchema$1,
 		model: string(),
 		systemPrompt: string(),
 		toolCount: number$1().int().nonnegative(),
 		credentialCount: number$1().int().nonnegative(),
 		appSlugs: array(string()).default([]),
-		toolSlugs: array(string()).default([])
+		toolSlugs: array(string()).default([]),
+		/** Credential requirements per tool slug (the agent's credential consumer key). */
+		toolRequirements: record(string(), array(CredentialRequirementSummarySchema$1)).optional()
+	}),
+	object({
+		kind: literal("action"),
+		slug: string(),
+		name: requiredDisplayTextSchema$1,
+		description: requiredDisplayTextSchema$1,
+		moduleFile: string(),
+		/** App slug for actions imported from an integration package (`@keystrokehq/<app>/actions`). */
+		appSlug: string().optional(),
+		inputSchema: record(string(), unknown()),
+		outputSchema: record(string(), unknown()),
+		/** Credentials this action requires (for the canvas credential overlay). */
+		requirements: array(CredentialRequirementSummarySchema$1).optional()
 	}),
 	object({
 		kind: literal("workflow"),
 		slug: string(),
-		name: string().optional(),
-		description: string().optional(),
+		name: requiredDisplayTextSchema$1,
+		description: requiredDisplayTextSchema$1,
 		subscribable: boolean(),
 		moduleFile: string(),
-		requestSchema: record(string(), unknown())
+		requestSchema: record(string(), unknown()),
+		responseSchema: record(string(), unknown()).optional(),
+		/** Deterministic AST control-flow skeleton (deploy-time producer). */
+		flowGraph: WorkflowCanvasGraphSchema$1.optional(),
+		/** sha256 of the workflow source the `flowGraph` was produced from (staleness). */
+		flowGraphSourceHash: string().optional()
 	}),
 	object({
 		kind: literal("trigger-webhook"),
@@ -5017,8 +5304,8 @@ const storedRouteManifestEntryV2Schema$1 = discriminatedUnion("kind", [
 		moduleFile: string(),
 		sourceHash: string().optional(),
 		schedule: string(),
-		name: string().optional(),
-		description: string().optional()
+		name: requiredDisplayTextSchema$1,
+		description: requiredDisplayTextSchema$1
 	}),
 	object({
 		kind: literal("trigger-poll-group"),
@@ -5034,8 +5321,8 @@ const storedRouteManifestEntryV2Schema$1 = discriminatedUnion("kind", [
 		moduleFile: string(),
 		sourceHash: string().optional(),
 		schedule: string(),
-		name: string().optional(),
-		description: string().optional()
+		name: requiredDisplayTextSchema$1,
+		description: requiredDisplayTextSchema$1
 	})
 ]);
 object({
@@ -5461,24 +5748,6 @@ object({
 	outputParameters: record(string(), unknown()).optional(),
 	version: string().optional()
 });
-/** How a credential instance is stored (`credential_instances.auth_kind`). */
-const CredentialAuthKindSchema$1 = _enum([
-	"api_key",
-	"oauth_managed",
-	"keystroke"
-]);
-/**
-* Where a credential instance is stored (`credential_instances.scope_type`), and the only thing an
-* action/tool can pin via `.scope(...)`. There is no resolution chain: when no scope is pinned, the
-* resolver tries the project default, then the org default, then throws.
-*/
-const CredentialScopeTypeSchema$1 = _enum([
-	"organization",
-	"project",
-	"user"
-]);
-CredentialAuthKindSchema$1.options;
-CredentialScopeTypeSchema$1.options;
 /** Scope of a platform app credential (maps to `credential_instances.scope_type`). */
 const AppCredentialScopeSchema$1 = _enum([
 	"user",
@@ -6474,7 +6743,7 @@ object({
 	id: string(),
 	slug: string(),
 	name: string(),
-	description: string().nullable(),
+	description: string().min(1),
 	type: TriggerTypeSchema$1,
 	status: TriggerStatusSchema$1,
 	projectId: string(),
@@ -6770,7 +7039,7 @@ const AgentSummarySchema$1 = object({
 	name: string().min(1),
 	projectId: string().min(1),
 	updatedAt: string().min(1),
-	description: string().optional(),
+	description: string().min(1),
 	sourcePath: string().min(1).optional(),
 	model: string().optional(),
 	capabilities: object({
@@ -6792,7 +7061,7 @@ const WorkflowSummarySchema$1 = object({
 	name: string().min(1),
 	projectId: string().min(1),
 	updatedAt: string().min(1),
-	description: string().optional(),
+	description: string().min(1),
 	sourcePath: string().min(1).optional(),
 	lastRunAt: optionalTimestamp$2
 });
@@ -6802,7 +7071,7 @@ const SkillSummarySchema$1 = object({
 	name: string().min(1),
 	projectId: string().min(1),
 	updatedAt: string().min(1),
-	description: string().optional(),
+	description: string().min(1),
 	sourcePath: string().min(1).optional()
 });
 AgentSummarySchema$1.nullable();
@@ -6911,6 +7180,245 @@ object({ files: array(object({
 	id: string(),
 	path: string().min(1)
 })) });
+/** Whether the overview is still being produced or finished. */
+const WorkflowOverviewStatusSchema$1 = _enum(["generating", "ready"]);
+/** One phase of the guided-tour overview. */
+const WorkflowPhaseSchema$1 = object({
+	id: string(),
+	title: string(),
+	copy: string(),
+	nodeIds: array(string())
+});
+object({
+	status: WorkflowOverviewStatusSchema$1,
+	summary: string(),
+	phases: array(WorkflowPhaseSchema$1),
+	hash: string(),
+	generatedAt: string().nullable(),
+	model: string()
+});
+/** Subset of JSON-Schema field types the dashboard form renders inline. */
+const WorkflowInputFieldTypeSchema$1 = _enum([
+	"string",
+	"number",
+	"boolean",
+	"enum",
+	"object",
+	"array"
+]);
+const WorkflowInputFieldSchema$1 = lazy(() => object({
+	key: string(),
+	label: string(),
+	type: WorkflowInputFieldTypeSchema$1,
+	required: boolean(),
+	description: string().optional(),
+	placeholder: string().optional(),
+	options: array(string()).optional(),
+	default: union([
+		string(),
+		number$1(),
+		boolean()
+	]).optional(),
+	children: array(WorkflowInputFieldSchema$1).optional(),
+	format: string().optional()
+}));
+object({
+	schema: object({ fields: array(WorkflowInputFieldSchema$1) }),
+	values: record(string(), unknown()).nullable()
+});
+object({ runId: string() });
+/** Annotation lifecycle: "generating" while the LLM pass streams in, then "ready". */
+const WorkflowCanvasStatusSchema$1 = _enum(["generating", "ready"]);
+/** LLM-produced enrichment for a single skeleton node. */
+const WorkflowCanvasAnnotationSchema$1 = object({
+	label: string().optional(),
+	description: string().optional()
+});
+/** The configured value of one input at this call site. */
+const WorkflowNodeInputBindingSchema$1 = object({
+	tokens: array(discriminatedUnion("kind", [
+		object({
+			kind: literal("text"),
+			text: string()
+		}),
+		object({
+			kind: literal("reference"),
+			sourceNodeId: string().optional(),
+			sourceLabel: string(),
+			field: string().optional()
+		}),
+		object({
+			kind: literal("variable"),
+			text: string(),
+			/** Concrete value when `text` resolves to a top-level literal constant. */
+			resolvedValue: string().optional()
+		}),
+		object({
+			kind: literal("call"),
+			name: string()
+		})
+	])),
+	multiline: boolean().optional()
+});
+/** An inspector input with optional call-site binding. */
+const WorkflowCanvasNodeInputSchema$1 = WorkflowInputFieldSchema$1.and(object({
+	binding: WorkflowNodeInputBindingSchema$1.optional(),
+	additional: boolean().optional()
+}));
+/** Authored, deterministic metadata for a single node. */
+const WorkflowCanvasNodeMetaSchema$1 = object({
+	kind: _enum([
+		"action",
+		"agent",
+		"workflow",
+		"llm",
+		"trigger",
+		"boundary"
+	]),
+	slug: string(),
+	name: string(),
+	description: string().optional(),
+	appSlug: string().optional(),
+	inputs: array(WorkflowCanvasNodeInputSchema$1),
+	outputs: array(WorkflowInputFieldSchema$1),
+	requiredApps: array(string()).optional(),
+	model: string().optional(),
+	toolCount: number$1().int().nonnegative().optional()
+});
+object({
+	graph: WorkflowCanvasGraphSchema$1,
+	nodeMetadata: record(string(), WorkflowCanvasNodeMetaSchema$1),
+	annotations: record(string(), WorkflowCanvasAnnotationSchema$1),
+	status: WorkflowCanvasStatusSchema$1,
+	hash: string(),
+	generatedAt: string().nullable(),
+	model: string()
+});
+const WorkflowCanvasNodeRunStateSchema$1 = object({
+	status: _enum([
+		"pending",
+		"running",
+		"succeeded",
+		"failed",
+		"skipped"
+	]),
+	iteration: object({
+		index: number$1().int().nonnegative(),
+		total: number$1().int().nonnegative()
+	}).optional()
+});
+/** Overall lifecycle of a run as the canvas animates it. */
+const WorkflowCanvasRunStatusSchema$1 = _enum([
+	"running",
+	"succeeded",
+	"failed",
+	"canceled"
+]);
+object({
+	runId: string(),
+	status: WorkflowCanvasRunStatusSchema$1,
+	startedAt: string(),
+	finishedAt: string().nullable(),
+	nodeStates: record(string(), WorkflowCanvasNodeRunStateSchema$1)
+});
+/** Scope a credential instance lives in. */
+const WorkflowCredentialScopeSchema$1 = _enum([
+	"organization",
+	"project",
+	"user"
+]);
+/** The concrete credential instance a binding currently resolves to. */
+const WorkflowResolvedCredentialSchema$1 = object({
+	id: string(),
+	name: string(),
+	scope: WorkflowCredentialScopeSchema$1,
+	appSlug: string().optional(),
+	isDefault: boolean().optional(),
+	projectId: string().optional(),
+	projectName: string().optional()
+});
+record(string(), WorkflowCanvasAnnotationSchema$1);
+/** One opaque code-block the annotation pass should label, keyed by its canvas node id. */
+const WorkflowCanvasAnnotationCodeBlockSchema$1 = object({
+	nodeId: string(),
+	/** The raw source snippet (the node's label) the LLM turns into human copy. */
+	source: string()
+});
+/** Inputs the worker feeds the LLM for the gated code-block annotation pass. */
+const WorkflowCanvasAnnotationsInputSchema$1 = object({
+	workflowName: string(),
+	workflowDescription: string().nullable(),
+	codeBlocks: array(WorkflowCanvasAnnotationCodeBlockSchema$1)
+});
+object({
+	workflowId: string(),
+	projectId: string(),
+	hash: string(),
+	model: string(),
+	input: WorkflowCanvasAnnotationsInputSchema$1
+});
+/** One node as the overview LLM sees it (derived from the canvas node metadata + graph). */
+const WorkflowOverviewNodeSchema$1 = object({
+	nodeId: string(),
+	label: string(),
+	kind: string(),
+	description: string().optional(),
+	/** App/integration slug for steps imported from a `@keystrokehq/<app>` package. */
+	appSlug: string().optional(),
+	/** Authored input field keys (from the action/agent/workflow definition). */
+	inputs: array(string()).optional(),
+	/** Authored output field keys. */
+	outputs: array(string()).optional(),
+	/** Agent-only: the model the agent runs on. */
+	model: string().optional(),
+	/** Agent-only: number of tools available to the agent. */
+	toolCount: number$1().int().nonnegative().optional()
+});
+/** Inputs the worker feeds the LLM to produce the workflow overview (summary + phases). */
+const WorkflowOverviewInputSchema$1 = object({
+	workflowName: string(),
+	workflowDescription: string().nullable(),
+	/** Display labels of the trigger sources upstream of the workflow (read-only context). */
+	triggers: array(string()),
+	nodes: array(WorkflowOverviewNodeSchema$1),
+	/** The workflow's TypeScript source (best-effort; null when the deploy has no source snapshot). */
+	source: string().nullable()
+});
+object({
+	workflowId: string(),
+	projectId: string(),
+	hash: string(),
+	model: string(),
+	input: WorkflowOverviewInputSchema$1
+});
+const WorkflowCanvasCredentialBindingBaseSchema$1 = object({
+	credentialKey: string(),
+	label: string(),
+	appSlug: string().optional()
+});
+/** How one credential requirement on a step currently resolves. */
+const WorkflowCanvasCredentialBindingSchema$1 = union([
+	WorkflowCanvasCredentialBindingBaseSchema$1.extend({
+		policy: _enum([
+			"project-default",
+			"org-default",
+			"assigned"
+		]),
+		instance: WorkflowResolvedCredentialSchema$1
+	}),
+	WorkflowCanvasCredentialBindingBaseSchema$1.extend({
+		policy: literal("scope-pinned"),
+		pinnedScope: WorkflowCredentialScopeSchema$1,
+		instance: WorkflowResolvedCredentialSchema$1
+	}),
+	WorkflowCanvasCredentialBindingBaseSchema$1.extend({
+		policy: literal("unresolved"),
+		reason: _enum(["needs-selection", "missing"]),
+		pinnedScope: WorkflowCredentialScopeSchema$1.optional()
+	})
+]);
+record(string(), array(WorkflowCanvasCredentialBindingSchema$1));
+record(string(), unknown());
 /** Builds base64 `KEYSTROKE_ORG_ARTIFACTS` payload for org worker containers. */
 function encodeOrgArtifacts(artifacts) {
 	return Buffer.from(JSON.stringify(artifacts)).toString("base64");
@@ -8303,10 +8811,260 @@ function resolveExternalPlatformOrigin(env = process.env) {
 }
 /** On-disk path under the project root (packed in deploy artifacts when present). */
 const ROUTE_MANIFEST_REL_PATH = "dist/.keystroke/route-manifest.json";
+/** How a credential instance is stored (`credential_instances.auth_kind`). */
+const CredentialAuthKindSchema = zod.z.enum([
+	"api_key",
+	"oauth_managed",
+	"keystroke"
+]);
+/**
+* Where a credential instance is stored (`credential_instances.scope_type`), and the only thing an
+* action/tool can pin via `.scope(...)`. There is no resolution chain: when no scope is pinned, the
+* resolver tries the project default, then the org default, then throws.
+*/
+const CredentialScopeTypeSchema = zod.z.enum([
+	"organization",
+	"project",
+	"user"
+]);
+CredentialAuthKindSchema.options;
+CredentialScopeTypeSchema.options;
+/** Non-empty human-readable label or description (trimmed). */
+const requiredDisplayTextSchema = zod.z.string().trim().min(1);
+/**
+* Structural workflow-canvas graph contract.
+*
+* This is the deterministic skeleton the deploy-time AST producer emits for a
+* workflow (nodes + edges), plus the manifest-derived trigger-source nodes. It
+* is the single source of truth shared by:
+* - the AST producer (emits it at deploy, stored with the manifest),
+* - the platform route that serves the canvas, and
+* - the SDK / web client that renders it (React Flow).
+*
+* Only the structural skeleton lives here. The LLM enrichment + run-overlay
+* envelope types live in `workflow-canvas-envelope.ts`; the SDK re-exports them.
+* See WORKFLOW.md (§4 grammar, §8 node ids, §9 caching).
+*/
+/**
+* Canvas node taxonomy — the single discriminator for every canvas node. The
+* client derives the React Flow component, icon, and per-node treatment from it
+* (no parallel `type` / `data.kind` fields), and the producer + fixtures emit it
+* directly, so the structural contract can never silently diverge across the
+* deploy → render boundary.
+* - Boundaries: `entry` (Start, owns input) · `exit` (Output, owns output) ·
+*   `error` (a terminal `throw` — an error output that ends the run on a branch)
+* - Callable: `step` (action / agent / llm / hook / child-workflow invocation) —
+*   the invocation flavor lives in {@link WorkflowCanvasCallKind}
+* - Structural control flow: `code-block` · `decision` · `merge` · `loop` ·
+*   `parallel` (group containers) · `loop-start` (the group body's entry marker,
+*   shared by loop + parallel)
+* - Upstream of entry: `trigger-source` (one per manifest trigger attachment)
+*
+* `Promise.all([...])` is modeled as a `parallel` group container: the branches
+* are stacked inside and the container itself is the single prong leaving the
+* wrapper (there is no separate fork/join pair).
+*
+* `exit` and `error` are both terminals: a `return` flows to the shared `exit`
+* (the workflow output), while a `throw` gets its own `error` terminal off the
+* branch so guard clauses (`if (bad) throw …`) read as a visible dead-end.
+*/
+const WorkflowCanvasNodeTypeSchema = zod.z.enum([
+	"entry",
+	"exit",
+	"error",
+	"step",
+	"code-block",
+	"decision",
+	"merge",
+	"loop",
+	"parallel",
+	"loop-start",
+	"trigger-source"
+]);
+zod.z.enum([
+	"workflow-step",
+	"agent",
+	"llm",
+	"wait",
+	"hook",
+	"tool",
+	"child-workflow"
+]);
+/** A labeled branch output on a decision-style node. */
+const WorkflowCanvasNodeOutputSchema = zod.z.object({
+	id: zod.z.string(),
+	label: zod.z.string()
+});
+/**
+* One token of a step's call-site argument value as captured by the producer.
+*
+* Raw form, one per source-expression shape so the inspector can render each
+* distinctly instead of dumping raw text:
+* - `text` — a literal value (string/number/boolean) or inert template chunk.
+* - `reference` — an upstream node output; carries only the structural
+*   `sourceNodeId` + `field` (the human `sourceLabel` is filled by the platform
+*   metadata join).
+* - `variable` — a code identifier / property access that isn't an upstream
+*   reference (e.g. a `const`, a loop variable, `job.id`). `text` is the source
+*   name; the platform may attach a `resolvedValue` for known top-level consts.
+* - `call` — a function call; carries only the callee `name` (e.g.
+*   `buildPrompt`), never the full argument list.
+*/
+const WorkflowCanvasRawValueTokenSchema = zod.z.discriminatedUnion("kind", [
+	zod.z.object({
+		kind: zod.z.literal("text"),
+		text: zod.z.string()
+	}),
+	zod.z.object({
+		kind: zod.z.literal("reference"),
+		/** Upstream node id this value flows from; absent only for unresolved refs. */
+		sourceNodeId: zod.z.string().optional(),
+		/** Output field of the source (dotted path); omitted = the whole output. */
+		field: zod.z.string().optional()
+	}),
+	zod.z.object({
+		kind: zod.z.literal("variable"),
+		text: zod.z.string()
+	}),
+	zod.z.object({
+		kind: zod.z.literal("call"),
+		name: zod.z.string()
+	})
+]);
+/**
+* A step input's configured value at its call site, captured deterministically
+* by the producer from the call's argument object. The platform join turns this
+* into the inspector's {@link WorkflowNodeInputBinding} (filling display labels).
+*/
+const WorkflowCanvasRawBindingSchema = zod.z.object({
+	tokens: zod.z.array(WorkflowCanvasRawValueTokenSchema),
+	/** Render as a tall multi-line box (object/array/multiline template values). */
+	multiline: zod.z.boolean().optional()
+});
+/**
+* Statically-captured `promptLlm` options for an `llm` step node. Literal-only:
+* dynamic/expression values (a computed model, a `system` built by a function) are
+* not captured; `system`/`outputSchema` record presence so the inspector can note
+* "a system prompt is configured" / "structured output" without their values.
+*/
+const WorkflowCanvasLlmOptionsSchema = zod.z.object({
+	model: zod.z.string().optional(),
+	maxTokens: zod.z.number().optional(),
+	temperature: zod.z.number().optional(),
+	thinkingLevel: zod.z.string().optional(),
+	hasSystemPrompt: zod.z.boolean().optional(),
+	hasOutputSchema: zod.z.boolean().optional()
+});
+const WorkflowCanvasNodeDataSchema = zod.z.object({
+	label: zod.z.string(),
+	/** Set on group nodes (loop / parallel section containers). */
+	groupKind: zod.z.enum([
+		"loop",
+		"parallel",
+		"conditional"
+	]).optional(),
+	description: zod.z.string().optional(),
+	/** {@link WorkflowCanvasCallKind} or a looser raw call-site label. */
+	callKind: zod.z.string().optional(),
+	/**
+	* App/integration slug for a `step` whose action/agent is imported directly
+	* from a `@keystrokehq/<app>` package (e.g. "slack", "apollo"). Lets the client
+	* badge the node with that app's logo; absent for custom (project-local)
+	* actions, which fall back to the call-kind icon.
+	*/
+	appSlug: zod.z.string().optional(),
+	/** Cron/webhook/poll discriminator on trigger-source nodes. */
+	triggerType: zod.z.string().optional(),
+	/** Branch outputs (decision nodes). */
+	outputs: zod.z.array(WorkflowCanvasNodeOutputSchema).optional(),
+	/**
+	* Action/agent/workflow slug resolved at deploy time (via import → definition).
+	* Optional when the deploy build cannot resolve source (dist-only artifacts).
+	*/
+	slug: zod.z.string().optional(),
+	/**
+	* Durable call-site ids nested inside an off-grammar `code-block` (same-file only).
+	* Used by the run overlay to light the block when any contained step executes.
+	*/
+	containedCallSiteIds: zod.z.array(zod.z.string()).optional(),
+	/**
+	* Per-input call-site value bindings for `step` nodes, keyed by input field name.
+	* Deterministically captured from the call's argument object; reference tokens point
+	* at the upstream node that produced the value. The platform join fills display labels.
+	*/
+	inputBindings: zod.z.record(zod.z.string(), WorkflowCanvasRawBindingSchema).optional(),
+	/**
+	* Static `promptLlm(prompt, options)` configuration captured at the call site for
+	* `llm` step nodes. Only literal values are captured (model/maxTokens/temperature/
+	* thinkingLevel); `system`/`outputSchema` are usually expressions, so only their
+	* presence is recorded. Absent when no options are statically resolvable.
+	*/
+	llmOptions: WorkflowCanvasLlmOptionsSchema.optional()
+});
+/**
+* A single structural node. This is the deploy artifact's shape: identity
+* (`id`), the canonical discriminator (`nodeType`), display `data`, and group
+* nesting (`parentId`). All layout/rendering — React Flow component key,
+* positions, sizes, `extent`, group box dimensions — is derived entirely
+* client-side from this structure, so it never leaks into the wire contract.
+*/
+const WorkflowCanvasGraphNodeSchema = zod.z.object({
+	id: zod.z.string(),
+	nodeType: WorkflowCanvasNodeTypeSchema,
+	data: WorkflowCanvasNodeDataSchema,
+	/** Set on children nested inside a group (loop / parallel) container. */
+	parentId: zod.z.string().optional()
+});
+const WorkflowCanvasEdgeSchema = zod.z.object({
+	id: zod.z.string(),
+	source: zod.z.string(),
+	target: zod.z.string(),
+	type: zod.z.string().optional(),
+	label: zod.z.string().optional(),
+	sourceHandle: zod.z.string().optional(),
+	targetHandle: zod.z.string().optional(),
+	data: zod.z.object({ branchKind: zod.z.enum([
+		"then",
+		"else",
+		"parallel-branch",
+		"error"
+	]).optional() }).optional()
+});
+/** A statically-evaluable top-level `const` value (literal scalars only). */
+const WorkflowCanvasConstantValueSchema = zod.z.union([
+	zod.z.string(),
+	zod.z.number(),
+	zod.z.boolean()
+]);
+/**
+* Top-level `const NAME = <literal>` declarations in the workflow source, captured
+* at deploy. Lets the platform resolve `variable` value tokens (e.g. a `model` set
+* to a named const) to their concrete value for display. Scalars only — computed,
+* function-local, or non-literal consts are intentionally omitted.
+*/
+const WorkflowCanvasConstantsSchema = zod.z.record(zod.z.string(), WorkflowCanvasConstantValueSchema);
+const WorkflowCanvasGraphSchema = zod.z.object({
+	nodes: zod.z.array(WorkflowCanvasGraphNodeSchema),
+	edges: zod.z.array(WorkflowCanvasEdgeSchema),
+	/** Top-level literal constants from the workflow source (for value-token resolution). */
+	constants: WorkflowCanvasConstantsSchema.optional()
+});
+/**
+* Deploy-time summary of one credential a step requires, derived from the
+* action/agent-tool definition's `.credentials`. The workflow-canvas credential
+* overlay joins a step node's `slug` to these to resolve the bound instance.
+* `key` doubles as the app slug (matches `credential_instances.app_slug`).
+*/
+const CredentialRequirementSummarySchema = zod.z.object({
+	key: zod.z.string(),
+	kind: CredentialAuthKindSchema,
+	/** Scope pinned via `.scope(...)`; absent means project-default → org-default. */
+	scope: CredentialScopeTypeSchema.optional()
+});
 const StoredRouteManifestSkillSchema = zod.z.object({
 	slug: zod.z.string(),
-	name: zod.z.string().optional(),
-	description: zod.z.string().optional(),
+	name: requiredDisplayTextSchema,
+	description: requiredDisplayTextSchema,
 	moduleFile: zod.z.string()
 });
 const attachmentSchemasSchema = zod.z.record(zod.z.string(), zod.z.object({
@@ -8314,8 +9072,8 @@ const attachmentSchemasSchema = zod.z.record(zod.z.string(), zod.z.object({
 	filterSchema: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
 }));
 const attachmentMetaSchema = zod.z.record(zod.z.string(), zod.z.object({
-	name: zod.z.string().optional(),
-	description: zod.z.string().optional()
+	name: requiredDisplayTextSchema,
+	description: requiredDisplayTextSchema
 }));
 const storedRouteManifestEntryV2Schema = zod.z.discriminatedUnion("kind", [
 	zod.z.object({ kind: zod.z.literal("health") }),
@@ -8323,23 +9081,43 @@ const storedRouteManifestEntryV2Schema = zod.z.discriminatedUnion("kind", [
 		kind: zod.z.literal("agent"),
 		slug: zod.z.string(),
 		moduleFile: zod.z.string(),
-		name: zod.z.string().optional(),
-		description: zod.z.string().optional(),
+		name: requiredDisplayTextSchema,
+		description: requiredDisplayTextSchema,
 		model: zod.z.string(),
 		systemPrompt: zod.z.string(),
 		toolCount: zod.z.number().int().nonnegative(),
 		credentialCount: zod.z.number().int().nonnegative(),
 		appSlugs: zod.z.array(zod.z.string()).default([]),
-		toolSlugs: zod.z.array(zod.z.string()).default([])
+		toolSlugs: zod.z.array(zod.z.string()).default([]),
+		/** Credential requirements per tool slug (the agent's credential consumer key). */
+		toolRequirements: zod.z.record(zod.z.string(), zod.z.array(CredentialRequirementSummarySchema)).optional()
+	}),
+	zod.z.object({
+		kind: zod.z.literal("action"),
+		slug: zod.z.string(),
+		name: requiredDisplayTextSchema,
+		description: requiredDisplayTextSchema,
+		moduleFile: zod.z.string(),
+		/** App slug for actions imported from an integration package (`@keystrokehq/<app>/actions`). */
+		appSlug: zod.z.string().optional(),
+		inputSchema: zod.z.record(zod.z.string(), zod.z.unknown()),
+		outputSchema: zod.z.record(zod.z.string(), zod.z.unknown()),
+		/** Credentials this action requires (for the canvas credential overlay). */
+		requirements: zod.z.array(CredentialRequirementSummarySchema).optional()
 	}),
 	zod.z.object({
 		kind: zod.z.literal("workflow"),
 		slug: zod.z.string(),
-		name: zod.z.string().optional(),
-		description: zod.z.string().optional(),
+		name: requiredDisplayTextSchema,
+		description: requiredDisplayTextSchema,
 		subscribable: zod.z.boolean(),
 		moduleFile: zod.z.string(),
-		requestSchema: zod.z.record(zod.z.string(), zod.z.unknown())
+		requestSchema: zod.z.record(zod.z.string(), zod.z.unknown()),
+		responseSchema: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
+		/** Deterministic AST control-flow skeleton (deploy-time producer). */
+		flowGraph: WorkflowCanvasGraphSchema.optional(),
+		/** sha256 of the workflow source the `flowGraph` was produced from (staleness). */
+		flowGraphSourceHash: zod.z.string().optional()
 	}),
 	zod.z.object({
 		kind: zod.z.literal("trigger-webhook"),
@@ -8358,8 +9136,8 @@ const storedRouteManifestEntryV2Schema = zod.z.discriminatedUnion("kind", [
 		moduleFile: zod.z.string(),
 		sourceHash: zod.z.string().optional(),
 		schedule: zod.z.string(),
-		name: zod.z.string().optional(),
-		description: zod.z.string().optional()
+		name: requiredDisplayTextSchema,
+		description: requiredDisplayTextSchema
 	}),
 	zod.z.object({
 		kind: zod.z.literal("trigger-poll-group"),
@@ -8375,8 +9153,8 @@ const storedRouteManifestEntryV2Schema = zod.z.discriminatedUnion("kind", [
 		moduleFile: zod.z.string(),
 		sourceHash: zod.z.string().optional(),
 		schedule: zod.z.string(),
-		name: zod.z.string().optional(),
-		description: zod.z.string().optional()
+		name: requiredDisplayTextSchema,
+		description: requiredDisplayTextSchema
 	})
 ]);
 const storedRouteManifestV2Schema = zod.z.object({
@@ -8385,165 +9163,14 @@ const storedRouteManifestV2Schema = zod.z.object({
 	skills: zod.z.array(StoredRouteManifestSkillSchema).default([]),
 	integrations: zod.z.array(zod.z.string()).optional()
 });
-const DERIVED_ENTRY_KINDS = new Set([
-	"agent-sessions-list",
-	"agent-session-detail",
-	"workflow-runs-list",
-	"workflow-run-detail",
-	"trigger-runs-list",
-	"trigger-run-detail"
-]);
-function webhookEndpointFromPath(path) {
-	return path.replace(/^\/triggers\//, "").replace(/^\/+|\/+$/g, "");
-}
-function legacyAgentAppSlugs(entry) {
-	if (Array.isArray(entry.appSlugs)) return entry.appSlugs;
-	if (Array.isArray(entry.credentialSlugs)) return entry.credentialSlugs;
-	if (Array.isArray(entry.credentialKeys)) return entry.credentialKeys;
-	return [];
-}
-/** TODO remove after all artifacts rebuilt — upcasts legacy v1 manifests to v2. */
-function normalizeEntryToV2(entry) {
-	const kind = entry.kind;
-	if (typeof kind !== "string") return null;
-	if (DERIVED_ENTRY_KINDS.has(kind) || kind === "plugin") return null;
-	if (kind === "health") return { kind: "health" };
-	if (kind === "agent") {
-		const slug = typeof entry.slug === "string" ? entry.slug : typeof entry.agentSlug === "string" ? entry.agentSlug : void 0;
-		if (!slug || typeof entry.moduleFile !== "string") return null;
-		return {
-			kind: "agent",
-			slug,
-			moduleFile: entry.moduleFile,
-			...typeof entry.name === "string" ? { name: entry.name } : {},
-			...typeof entry.description === "string" ? { description: entry.description } : {},
-			model: typeof entry.model === "string" ? entry.model : "",
-			systemPrompt: typeof entry.systemPrompt === "string" ? entry.systemPrompt : "",
-			toolCount: typeof entry.toolCount === "number" ? entry.toolCount : 0,
-			credentialCount: typeof entry.credentialCount === "number" ? entry.credentialCount : 0,
-			appSlugs: legacyAgentAppSlugs(entry),
-			toolSlugs: Array.isArray(entry.toolSlugs) ? entry.toolSlugs : []
-		};
-	}
-	if (kind === "workflow") {
-		const slug = typeof entry.slug === "string" ? entry.slug : typeof entry.workflowSlug === "string" ? entry.workflowSlug : void 0;
-		if (!slug || typeof entry.moduleFile !== "string") return null;
-		const name = typeof entry.name === "string" ? entry.name : typeof entry.workflowName === "string" ? entry.workflowName : void 0;
-		return {
-			kind: "workflow",
-			slug,
-			moduleFile: entry.moduleFile,
-			...name ? { name } : {},
-			...typeof entry.description === "string" ? { description: entry.description } : {},
-			subscribable: entry.subscribable === true,
-			requestSchema: entry.requestSchema && typeof entry.requestSchema === "object" ? entry.requestSchema : {}
-		};
-	}
-	if (kind === "trigger-webhook") {
-		if (typeof entry.moduleFile !== "string" || !Array.isArray(entry.attachmentIds)) return null;
-		const endpoint = typeof entry.endpoint === "string" ? entry.endpoint : typeof entry.path === "string" ? webhookEndpointFromPath(entry.path) : void 0;
-		if (!endpoint) return null;
-		return {
-			kind: "trigger-webhook",
-			endpoint,
-			attachmentIds: entry.attachmentIds,
-			moduleFile: entry.moduleFile,
-			...typeof entry.sourceHash === "string" ? { sourceHash: entry.sourceHash } : {},
-			attachmentSchemas: entry.attachmentSchemas && typeof entry.attachmentSchemas === "object" ? entry.attachmentSchemas : {},
-			...entry.attachmentMeta && typeof entry.attachmentMeta === "object" ? { attachmentMeta: entry.attachmentMeta } : {}
-		};
-	}
-	if (kind === "trigger-poll") {
-		if (typeof entry.attachmentId !== "string" || typeof entry.moduleFile !== "string" || typeof entry.schedule !== "string") return null;
-		return {
-			kind: "trigger-poll",
-			attachmentId: entry.attachmentId,
-			attachmentIds: Array.isArray(entry.attachmentIds) ? entry.attachmentIds : [entry.attachmentId],
-			moduleFile: entry.moduleFile,
-			...typeof entry.sourceHash === "string" ? { sourceHash: entry.sourceHash } : {},
-			schedule: entry.schedule,
-			...typeof entry.name === "string" ? { name: entry.name } : {},
-			...typeof entry.description === "string" ? { description: entry.description } : {}
-		};
-	}
-	if (kind === "trigger-poll-group") {
-		if (typeof entry.pollId !== "string" || typeof entry.moduleFile !== "string" || typeof entry.schedule !== "string" || !Array.isArray(entry.attachmentIds)) return null;
-		return {
-			kind: "trigger-poll-group",
-			pollId: entry.pollId,
-			attachmentIds: entry.attachmentIds,
-			moduleFile: entry.moduleFile,
-			schedule: entry.schedule
-		};
-	}
-	if (kind === "cron-schedule") {
-		if (typeof entry.attachmentId !== "string" || typeof entry.moduleFile !== "string" || typeof entry.schedule !== "string") return null;
-		return {
-			kind: "cron-schedule",
-			attachmentId: entry.attachmentId,
-			attachmentIds: Array.isArray(entry.attachmentIds) ? entry.attachmentIds : [entry.attachmentId],
-			moduleFile: entry.moduleFile,
-			...typeof entry.sourceHash === "string" ? { sourceHash: entry.sourceHash } : {},
-			schedule: entry.schedule,
-			...typeof entry.name === "string" ? { name: entry.name } : {},
-			...typeof entry.description === "string" ? { description: entry.description } : {}
-		};
-	}
-	return null;
-}
-/** TODO remove after all artifacts rebuilt — upcasts legacy v1 manifests to v2. */
-function normalizeV2ManifestInput(value) {
-	if (!value || typeof value !== "object") return value;
-	const raw = value;
-	if (raw.version !== 2 || !Array.isArray(raw.entries)) return value;
-	return {
-		...raw,
-		entries: raw.entries.map((entry) => {
-			if (!entry || typeof entry !== "object") return entry;
-			const kind = entry.kind;
-			if (kind === "trigger-poll" || kind === "cron-schedule" || kind === "trigger-webhook" || kind === "trigger-poll-group") {
-				const trigger = entry;
-				if (Array.isArray(trigger.attachmentIds)) return entry;
-				return {
-					...trigger,
-					attachmentIds: typeof trigger.attachmentId === "string" ? [trigger.attachmentId] : []
-				};
-			}
-			if (kind !== "agent") return entry;
-			const agent = entry;
-			if (Array.isArray(agent.appSlugs)) return entry;
-			const appSlugs = legacyAgentAppSlugs(agent);
-			if (appSlugs.length === 0) return entry;
-			const { credentialKeys: _credentialKeys, credentialSlugs: _credentialSlugs, ...rest } = agent;
-			return {
-				...rest,
-				appSlugs,
-				toolSlugs: Array.isArray(agent.toolSlugs) ? agent.toolSlugs : []
-			};
-		})
-	};
-}
-/** TODO remove after all artifacts rebuilt — upcasts legacy v1 manifests to v2. */
-function normalizeStoredRouteManifestToV2(value) {
-	if (!value || typeof value !== "object") throw new Error("Invalid route manifest");
-	const raw = value;
-	if (raw.version === 2) return storedRouteManifestV2Schema.parse(normalizeV2ManifestInput(value));
-	const entriesRaw = Array.isArray(raw.entries) ? raw.entries : [];
-	const entries = [];
-	for (const entry of entriesRaw) {
-		if (!entry || typeof entry !== "object") continue;
-		const normalized = normalizeEntryToV2(entry);
-		if (normalized) entries.push(normalized);
-	}
-	return storedRouteManifestV2Schema.parse({
-		version: 2,
-		entries,
-		skills: raw.skills ?? [],
-		integrations: raw.integrations
-	});
-}
+/**
+* Parse a stored route manifest. Only the strict v2 schema is supported: the
+* builder always emits v2 and every deploy regenerates the manifest, so there is
+* no legacy upcasting. (The pre-v2 `normalizeEntryToV2` path was removed once the
+* data tables were truncated and all artifacts redeployed.)
+*/
 function parseStoredRouteManifest(value) {
-	return normalizeStoredRouteManifestToV2(value);
+	return storedRouteManifestV2Schema.parse(value);
 }
 /** Messaging platforms that support agent gateway bindings. */
 const ChannelPlatformKeySchema = zod.z.enum(["slack"]);
@@ -9302,24 +9929,6 @@ function parseAppSlug(slug) {
 		slug: trimmed
 	};
 }
-/** How a credential instance is stored (`credential_instances.auth_kind`). */
-const CredentialAuthKindSchema = zod.z.enum([
-	"api_key",
-	"oauth_managed",
-	"keystroke"
-]);
-/**
-* Where a credential instance is stored (`credential_instances.scope_type`), and the only thing an
-* action/tool can pin via `.scope(...)`. There is no resolution chain: when no scope is pinned, the
-* resolver tries the project default, then the org default, then throws.
-*/
-const CredentialScopeTypeSchema = zod.z.enum([
-	"organization",
-	"project",
-	"user"
-]);
-CredentialAuthKindSchema.options;
-CredentialScopeTypeSchema.options;
 /** Human-readable app name from a credential slug (e.g. `google-drive` → `Google Drive`). */
 function displayCredentialAppName(appId) {
 	return appId.split(/[-_]+/).filter(Boolean).map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
@@ -10414,7 +11023,7 @@ const WorkspaceTriggerSummarySchema = zod.z.object({
 	id: zod.z.string(),
 	slug: zod.z.string(),
 	name: zod.z.string(),
-	description: zod.z.string().nullable(),
+	description: zod.z.string().min(1),
 	type: TriggerTypeSchema,
 	status: TriggerStatusSchema,
 	projectId: zod.z.string(),
@@ -10840,7 +11449,7 @@ const AgentSummarySchema = zod.z.object({
 	name: zod.z.string().min(1),
 	projectId: zod.z.string().min(1),
 	updatedAt: zod.z.string().min(1),
-	description: zod.z.string().optional(),
+	description: zod.z.string().min(1),
 	sourcePath: zod.z.string().min(1).optional(),
 	model: zod.z.string().optional(),
 	capabilities: zod.z.object({
@@ -10862,7 +11471,7 @@ const WorkflowSummarySchema = zod.z.object({
 	name: zod.z.string().min(1),
 	projectId: zod.z.string().min(1),
 	updatedAt: zod.z.string().min(1),
-	description: zod.z.string().optional(),
+	description: zod.z.string().min(1),
 	sourcePath: zod.z.string().min(1).optional(),
 	lastRunAt: optionalTimestamp
 });
@@ -10872,7 +11481,7 @@ const SkillSummarySchema = zod.z.object({
 	name: zod.z.string().min(1),
 	projectId: zod.z.string().min(1),
 	updatedAt: zod.z.string().min(1),
-	description: zod.z.string().optional(),
+	description: zod.z.string().min(1),
 	sourcePath: zod.z.string().min(1).optional()
 });
 const AgentSummaryListResponseSchema = zod.z.array(AgentSummarySchema);
@@ -11014,6 +11623,366 @@ const ListAgentWorkspaceFilesResponseSchema = zod.z.object({ files: zod.z.array(
 function agentWorkspaceFileId(path) {
 	return projectFileId(path);
 }
+/** Whether the overview is still being produced or finished. */
+const WorkflowOverviewStatusSchema = zod.z.enum(["generating", "ready"]);
+/** One phase of the guided-tour overview. */
+const WorkflowPhaseSchema = zod.z.object({
+	id: zod.z.string(),
+	title: zod.z.string(),
+	copy: zod.z.string(),
+	nodeIds: zod.z.array(zod.z.string())
+});
+/** LLM-generated overview envelope. */
+const WorkspaceWorkflowOverviewSchema = zod.z.object({
+	status: WorkflowOverviewStatusSchema,
+	summary: zod.z.string(),
+	phases: zod.z.array(WorkflowPhaseSchema),
+	hash: zod.z.string(),
+	generatedAt: zod.z.string().nullable(),
+	model: zod.z.string()
+});
+/** Subset of JSON-Schema field types the dashboard form renders inline. */
+const WorkflowInputFieldTypeSchema = zod.z.enum([
+	"string",
+	"number",
+	"boolean",
+	"enum",
+	"object",
+	"array"
+]);
+const WorkflowInputFieldSchema = zod.z.lazy(() => zod.z.object({
+	key: zod.z.string(),
+	label: zod.z.string(),
+	type: WorkflowInputFieldTypeSchema,
+	required: zod.z.boolean(),
+	description: zod.z.string().optional(),
+	placeholder: zod.z.string().optional(),
+	options: zod.z.array(zod.z.string()).optional(),
+	default: zod.z.union([
+		zod.z.string(),
+		zod.z.number(),
+		zod.z.boolean()
+	]).optional(),
+	children: zod.z.array(WorkflowInputFieldSchema).optional(),
+	format: zod.z.string().optional()
+}));
+/** Flat, render-ready view of a workflow's input schema. */
+const WorkflowInputSchemaSchema = zod.z.object({ fields: zod.z.array(WorkflowInputFieldSchema) });
+/** A workflow's run-input contract plus its persisted values. */
+const WorkflowRunInputsSchema = zod.z.object({
+	schema: WorkflowInputSchemaSchema,
+	values: zod.z.record(zod.z.string(), zod.z.unknown()).nullable()
+});
+zod.z.object({ runId: zod.z.string() });
+/** Annotation lifecycle: "generating" while the LLM pass streams in, then "ready". */
+const WorkflowCanvasStatusSchema = zod.z.enum(["generating", "ready"]);
+/** LLM-produced enrichment for a single skeleton node. */
+const WorkflowCanvasAnnotationSchema = zod.z.object({
+	label: zod.z.string().optional(),
+	description: zod.z.string().optional()
+});
+/**
+* One token of a configured input value (inspector form). Mirrors the producer's
+* raw token kinds, with display fields filled by the platform join: `reference`
+* gains a human `sourceLabel`; `variable` may gain a `resolvedValue` when the name
+* matches a known top-level constant.
+*/
+const WorkflowNodeValueTokenSchema = zod.z.discriminatedUnion("kind", [
+	zod.z.object({
+		kind: zod.z.literal("text"),
+		text: zod.z.string()
+	}),
+	zod.z.object({
+		kind: zod.z.literal("reference"),
+		sourceNodeId: zod.z.string().optional(),
+		sourceLabel: zod.z.string(),
+		field: zod.z.string().optional()
+	}),
+	zod.z.object({
+		kind: zod.z.literal("variable"),
+		text: zod.z.string(),
+		/** Concrete value when `text` resolves to a top-level literal constant. */
+		resolvedValue: zod.z.string().optional()
+	}),
+	zod.z.object({
+		kind: zod.z.literal("call"),
+		name: zod.z.string()
+	})
+]);
+/** The configured value of one input at this call site. */
+const WorkflowNodeInputBindingSchema = zod.z.object({
+	tokens: zod.z.array(WorkflowNodeValueTokenSchema),
+	multiline: zod.z.boolean().optional()
+});
+/** An inspector input with optional call-site binding. */
+const WorkflowCanvasNodeInputSchema = WorkflowInputFieldSchema.and(zod.z.object({
+	binding: WorkflowNodeInputBindingSchema.optional(),
+	additional: zod.z.boolean().optional()
+}));
+/** Authored, deterministic metadata for a single node. */
+const WorkflowCanvasNodeMetaSchema = zod.z.object({
+	kind: zod.z.enum([
+		"action",
+		"agent",
+		"workflow",
+		"llm",
+		"trigger",
+		"boundary"
+	]),
+	slug: zod.z.string(),
+	name: zod.z.string(),
+	description: zod.z.string().optional(),
+	appSlug: zod.z.string().optional(),
+	inputs: zod.z.array(WorkflowCanvasNodeInputSchema),
+	outputs: zod.z.array(WorkflowInputFieldSchema),
+	requiredApps: zod.z.array(zod.z.string()).optional(),
+	model: zod.z.string().optional(),
+	toolCount: zod.z.number().int().nonnegative().optional()
+});
+/** The workflow canvas envelope. */
+const WorkflowCanvasSchema = zod.z.object({
+	graph: WorkflowCanvasGraphSchema,
+	nodeMetadata: zod.z.record(zod.z.string(), WorkflowCanvasNodeMetaSchema),
+	annotations: zod.z.record(zod.z.string(), WorkflowCanvasAnnotationSchema),
+	status: WorkflowCanvasStatusSchema,
+	hash: zod.z.string(),
+	generatedAt: zod.z.string().nullable(),
+	model: zod.z.string()
+});
+/** Per-node execution state for a single run. */
+const WorkflowCanvasNodeRunStatusSchema = zod.z.enum([
+	"pending",
+	"running",
+	"succeeded",
+	"failed",
+	"skipped"
+]);
+const WorkflowCanvasNodeRunStateSchema = zod.z.object({
+	status: WorkflowCanvasNodeRunStatusSchema,
+	iteration: zod.z.object({
+		index: zod.z.number().int().nonnegative(),
+		total: zod.z.number().int().nonnegative()
+	}).optional()
+});
+/** Overall lifecycle of a run as the canvas animates it. */
+const WorkflowCanvasRunStatusSchema = zod.z.enum([
+	"running",
+	"succeeded",
+	"failed",
+	"canceled"
+]);
+/** A run projected onto the canvas. */
+const WorkflowCanvasRunSchema = zod.z.object({
+	runId: zod.z.string(),
+	status: WorkflowCanvasRunStatusSchema,
+	startedAt: zod.z.string(),
+	finishedAt: zod.z.string().nullable(),
+	nodeStates: zod.z.record(zod.z.string(), WorkflowCanvasNodeRunStateSchema)
+});
+/** Scope a credential instance lives in. */
+const WorkflowCredentialScopeSchema = zod.z.enum([
+	"organization",
+	"project",
+	"user"
+]);
+/** The concrete credential instance a binding currently resolves to. */
+const WorkflowResolvedCredentialSchema = zod.z.object({
+	id: zod.z.string(),
+	name: zod.z.string(),
+	scope: WorkflowCredentialScopeSchema,
+	appSlug: zod.z.string().optional(),
+	isDefault: zod.z.boolean().optional(),
+	projectId: zod.z.string().optional(),
+	projectName: zod.z.string().optional()
+});
+/** Default model for the gated code-block annotation pass — cheap, same as trigger overviews. */
+const DEFAULT_WORKFLOW_CANVAS_MODEL = "deepseek/deepseek-v4-flash";
+zod.z.record(zod.z.string(), WorkflowCanvasAnnotationSchema);
+/** One opaque code-block the annotation pass should label, keyed by its canvas node id. */
+const WorkflowCanvasAnnotationCodeBlockSchema = zod.z.object({
+	nodeId: zod.z.string(),
+	/** The raw source snippet (the node's label) the LLM turns into human copy. */
+	source: zod.z.string()
+});
+/** Inputs the worker feeds the LLM for the gated code-block annotation pass. */
+const WorkflowCanvasAnnotationsInputSchema = zod.z.object({
+	workflowName: zod.z.string(),
+	workflowDescription: zod.z.string().nullable(),
+	codeBlocks: zod.z.array(WorkflowCanvasAnnotationCodeBlockSchema)
+});
+zod.z.object({
+	workflowId: zod.z.string(),
+	projectId: zod.z.string(),
+	hash: zod.z.string(),
+	model: zod.z.string(),
+	input: WorkflowCanvasAnnotationsInputSchema
+});
+/** Default model for the workflow overview pass — cheap, same as the annotation/trigger passes. */
+const DEFAULT_WORKFLOW_OVERVIEW_MODEL = "deepseek/deepseek-v4-flash";
+/** One node as the overview LLM sees it (derived from the canvas node metadata + graph). */
+const WorkflowOverviewNodeSchema = zod.z.object({
+	nodeId: zod.z.string(),
+	label: zod.z.string(),
+	kind: zod.z.string(),
+	description: zod.z.string().optional(),
+	/** App/integration slug for steps imported from a `@keystrokehq/<app>` package. */
+	appSlug: zod.z.string().optional(),
+	/** Authored input field keys (from the action/agent/workflow definition). */
+	inputs: zod.z.array(zod.z.string()).optional(),
+	/** Authored output field keys. */
+	outputs: zod.z.array(zod.z.string()).optional(),
+	/** Agent-only: the model the agent runs on. */
+	model: zod.z.string().optional(),
+	/** Agent-only: number of tools available to the agent. */
+	toolCount: zod.z.number().int().nonnegative().optional()
+});
+/** Inputs the worker feeds the LLM to produce the workflow overview (summary + phases). */
+const WorkflowOverviewInputSchema = zod.z.object({
+	workflowName: zod.z.string(),
+	workflowDescription: zod.z.string().nullable(),
+	/** Display labels of the trigger sources upstream of the workflow (read-only context). */
+	triggers: zod.z.array(zod.z.string()),
+	nodes: zod.z.array(WorkflowOverviewNodeSchema),
+	/** The workflow's TypeScript source (best-effort; null when the deploy has no source snapshot). */
+	source: zod.z.string().nullable()
+});
+zod.z.object({
+	workflowId: zod.z.string(),
+	projectId: zod.z.string(),
+	hash: zod.z.string(),
+	model: zod.z.string(),
+	input: WorkflowOverviewInputSchema
+});
+const WorkflowCanvasCredentialBindingBaseSchema = zod.z.object({
+	credentialKey: zod.z.string(),
+	label: zod.z.string(),
+	appSlug: zod.z.string().optional()
+});
+/** How one credential requirement on a step currently resolves. */
+const WorkflowCanvasCredentialBindingSchema = zod.z.union([
+	WorkflowCanvasCredentialBindingBaseSchema.extend({
+		policy: zod.z.enum([
+			"project-default",
+			"org-default",
+			"assigned"
+		]),
+		instance: WorkflowResolvedCredentialSchema
+	}),
+	WorkflowCanvasCredentialBindingBaseSchema.extend({
+		policy: zod.z.literal("scope-pinned"),
+		pinnedScope: WorkflowCredentialScopeSchema,
+		instance: WorkflowResolvedCredentialSchema
+	}),
+	WorkflowCanvasCredentialBindingBaseSchema.extend({
+		policy: zod.z.literal("unresolved"),
+		reason: zod.z.enum(["needs-selection", "missing"]),
+		pinnedScope: WorkflowCredentialScopeSchema.optional()
+	})
+]);
+/** Live credential overlay: canvas node id → its step's credential bindings. */
+const WorkflowCanvasCredentialBindingsSchema = zod.z.record(zod.z.string(), zod.z.array(WorkflowCanvasCredentialBindingSchema));
+function isObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function titleCaseKey(key) {
+	return key.replace(/([a-z0-9])([A-Z])/g, "$1 $2").split(/[-_/]+/).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
+}
+function normalizeFieldType(schema) {
+	const rawType = schema.type;
+	if (Array.isArray(rawType)) {
+		const primary = rawType.find((entry) => entry !== "null");
+		if (typeof primary === "string") return normalizeFieldType({
+			...schema,
+			type: primary
+		});
+		return null;
+	}
+	if (typeof rawType !== "string") return null;
+	if (Array.isArray(schema.enum) && schema.enum.every((entry) => typeof entry === "string")) return "enum";
+	switch (rawType) {
+		case "string":
+		case "number":
+		case "integer": return rawType === "integer" ? "number" : rawType;
+		case "boolean": return "boolean";
+		case "object": return "object";
+		case "array": return "array";
+		default: return null;
+	}
+}
+function normalizeField(key, schema, required) {
+	const type = normalizeFieldType(schema);
+	if (!type) return null;
+	const field = {
+		key,
+		label: typeof schema.title === "string" ? schema.title : titleCaseKey(key),
+		type,
+		required,
+		...typeof schema.description === "string" ? { description: schema.description } : {},
+		...typeof schema.format === "string" ? { format: schema.format } : {}
+	};
+	if (type === "enum" && Array.isArray(schema.enum)) field.options = schema.enum.filter((entry) => typeof entry === "string");
+	if (schema.default !== void 0 && (typeof schema.default === "string" || typeof schema.default === "number" || typeof schema.default === "boolean")) field.default = schema.default;
+	if (type === "object" && isObject(schema.properties)) {
+		const childRequired = Array.isArray(schema.required) ? schema.required.filter((entry) => typeof entry === "string") : [];
+		field.children = Object.entries(schema.properties).flatMap(([childKey, childSchema]) => {
+			if (!isObject(childSchema)) return [];
+			const child = normalizeField(childKey, childSchema, childRequired.includes(childKey));
+			return child ? [child] : [];
+		});
+	}
+	if (type === "array" && isObject(schema.items)) {
+		const item = normalizeField("item", schema.items, false);
+		if (item) field.children = [item];
+	}
+	return field;
+}
+/** Normalize a workflow manifest JSON Schema into the dashboard run-input form shape. */
+function jsonSchemaToWorkflowInputSchema(requestSchema) {
+	if (!isObject(requestSchema)) return { fields: [] };
+	const properties = isObject(requestSchema.properties) ? requestSchema.properties : {};
+	const required = Array.isArray(requestSchema.required) ? requestSchema.required.filter((entry) => typeof entry === "string") : [];
+	return { fields: Object.entries(properties).flatMap(([key, propertySchema]) => {
+		if (!isObject(propertySchema)) return [];
+		const field = normalizeField(key, propertySchema, required.includes(key));
+		return field ? [field] : [];
+	}) };
+}
+function isEmpty(value) {
+	return value === void 0 || value === null || value === "";
+}
+function validateFieldValue(field, value) {
+	if (field.required && isEmpty(value)) return "Required";
+	if (isEmpty(value)) return null;
+	switch (field.type) {
+		case "number":
+			if (typeof value !== "number" && Number.isNaN(Number(value))) return "Must be a number";
+			return null;
+		case "boolean":
+			if (typeof value !== "boolean") return "Must be a boolean";
+			return null;
+		case "enum":
+			if (typeof value !== "string" || field.options && !field.options.includes(value)) return "Invalid option";
+			return null;
+		default: return null;
+	}
+}
+/** Validate a run-input payload against the normalized schema (authoritative on save). */
+function validateWorkflowRunInputValues(schema, values) {
+	const allowedKeys = new Set(schema.fields.map((field) => field.key));
+	for (const key of Object.keys(values)) if (!allowedKeys.has(key)) return {
+		ok: false,
+		error: `Unknown field "${key}"`
+	};
+	for (const field of schema.fields) {
+		const message = validateFieldValue(field, values[field.key]);
+		if (message) return {
+			ok: false,
+			error: `${field.key}: ${message}`
+		};
+	}
+	return { ok: true };
+}
+const WorkflowRunInputsPutBodySchema = zod.z.record(zod.z.string(), zod.z.unknown());
 function mapOrganization(row) {
 	return OrganizationSchema.parse({
 		id: row.id,
@@ -11114,8 +12083,8 @@ function mapProjectDeployment(row) {
 const zodSchema$2 = zod.z.custom((v) => v instanceof zod.z.ZodType, "must be a Zod schema");
 zod.z.object({
 	slug: zod.z.string().trim().min(1),
-	name: zod.z.string().optional(),
-	description: zod.z.string().optional(),
+	name: requiredDisplayTextSchema,
+	description: requiredDisplayTextSchema,
 	input: zodSchema$2,
 	output: zodSchema$2,
 	credentials: zod.z.array(credentialInputSchema).optional(),
@@ -11135,6 +12104,26 @@ function registerWorkflowRunGetter(fn) {
 }
 new node_async_hooks.AsyncLocalStorage();
 //#endregion
+//#region ../../packages/credentials/dist/store-4At2Wnk9.mjs
+function normalizeRow(row) {
+	const { projectId: _projectId, ...rest } = row;
+	return rest;
+}
+async function listCredentialAssignmentsByTarget$1(options) {
+	return (await (0, _keystrokehq_database.listCredentialAssignmentsByTarget)(options)).map(normalizeRow);
+}
+function normalizeLocalRow(row) {
+	const { projectId: _projectId, ...rest } = row;
+	return rest;
+}
+async function selectCredentialInstanceById$1$1(id) {
+	const row = await (0, _keystrokehq_database.selectCredentialInstanceById)(id);
+	return row ? normalizeLocalRow(row) : void 0;
+}
+async function selectCredentialInstancesForScope$1$1(appSlug, scopeType, scopeId) {
+	return (await (0, _keystrokehq_database.selectCredentialInstancesForScope)(appSlug, scopeType, scopeId)).map(normalizeLocalRow);
+}
+//#endregion
 //#region ../../packages/secrets/dist/index.mjs
 const ALGORITHM = "aes-256-gcm";
 const IV_LENGTH = 12;
@@ -29536,6 +30525,130 @@ var import_dist$1 = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exp
 	exports.visit = visit.visit;
 	exports.visitAsync = visit.visitAsync;
 })))(), 1);
+const EMPTY_ASSIGNMENT_SET = {
+	byConsumer: {},
+	wildcard: {}
+};
+function selectAssignedInstanceId(assignments, consumerId, credentialSlug) {
+	if (!assignments) return;
+	if (consumerId) {
+		const specific = assignments.byConsumer[consumerId]?.[credentialSlug];
+		if (specific) return specific;
+	}
+	return assignments.wildcard[credentialSlug];
+}
+function buildAssignmentSet(rows) {
+	const byConsumer = {};
+	const wildcard = {};
+	for (const row of rows) {
+		if (row.consumerId === "*") {
+			wildcard[row.credentialSlug] = row.instanceId;
+			continue;
+		}
+		const bucket = byConsumer[row.consumerId] ?? {};
+		bucket[row.credentialSlug] = row.instanceId;
+		byConsumer[row.consumerId] = bucket;
+	}
+	return {
+		byConsumer,
+		wildcard
+	};
+}
+async function loadCredentialAssignments(options) {
+	if (!(0, _keystrokehq_database.isDatabaseInitialized)()) return EMPTY_ASSIGNMENT_SET;
+	return buildAssignmentSet(await listCredentialAssignmentsByTarget$1(options));
+}
+async function withCredentialAssignments(context, options) {
+	const assignments = await loadCredentialAssignments(options);
+	return {
+		...context,
+		assignments
+	};
+}
+function toSummary(row) {
+	return {
+		id: row.id,
+		appSlug: row.appSlug,
+		name: row.name,
+		label: row.label,
+		scopeType: row.scopeType,
+		scopeId: row.scopeId,
+		isDefault: row.isDefault
+	};
+}
+/** Pick the single instance for a scope: the only one, or the unique default; else ambiguous. */
+function pickInstance$1(rows) {
+	if (rows.length === 0) return { kind: "none" };
+	if (rows.length === 1) return {
+		kind: "row",
+		row: rows[0]
+	};
+	const defaults = rows.filter((row) => row.isDefault);
+	if (defaults.length === 1) return {
+		kind: "row",
+		row: defaults[0]
+	};
+	return { kind: "needs-selection" };
+}
+function scopeIdFor(scope, context, orgId) {
+	switch (scope) {
+		case "organization": return orgId;
+		case "project": return context.projectId;
+		case "user": return context.userId;
+	}
+}
+async function describeCredentialBinding(options) {
+	const { key, scope, consumerId, context } = options;
+	const orgId = context.orgId ?? (0, _keystrokehq_database.getServerTenantScopeId)();
+	const assignedId = selectAssignedInstanceId(context.assignments, consumerId, key);
+	if (assignedId) {
+		const row = await selectCredentialInstanceById$1$1(assignedId);
+		if (row && row.appSlug === key) return {
+			policy: "assigned",
+			row: toSummary(row)
+		};
+	}
+	if (scope) {
+		const scopeId = scopeIdFor(scope, context, orgId);
+		const picked = scopeId ? pickInstance$1(await selectCredentialInstancesForScope$1$1(key, scope, scopeId)) : { kind: "none" };
+		if (picked.kind === "row") return {
+			policy: "scope-pinned",
+			pinnedScope: scope,
+			row: toSummary(picked.row)
+		};
+		return {
+			policy: "unresolved",
+			reason: picked.kind === "needs-selection" ? "needs-selection" : "missing",
+			pinnedScope: scope
+		};
+	}
+	if (context.projectId) {
+		const picked = pickInstance$1(await selectCredentialInstancesForScope$1$1(key, "project", context.projectId));
+		if (picked.kind === "row") return {
+			policy: "project-default",
+			row: toSummary(picked.row)
+		};
+		if (picked.kind === "needs-selection") return {
+			policy: "unresolved",
+			reason: "needs-selection"
+		};
+	}
+	if (orgId) {
+		const picked = pickInstance$1(await selectCredentialInstancesForScope$1$1(key, "organization", orgId));
+		if (picked.kind === "row") return {
+			policy: "org-default",
+			row: toSummary(picked.row)
+		};
+		if (picked.kind === "needs-selection") return {
+			policy: "unresolved",
+			reason: "needs-selection"
+		};
+	}
+	return {
+		policy: "unresolved",
+		reason: "missing"
+	};
+}
 function encodeOAuthState(payload) {
 	return (0, _keystrokehq_database.encryptCredentialPayload)(JSON.stringify(payload));
 }
@@ -29808,8 +30921,8 @@ const zodSchema$1 = zod.z.custom((v) => v instanceof zod.z.ZodType, "must be a Z
 /** Runtime validation for an unbranded workflow definition. */
 const workflowCoreSchema = zod.z.object({
 	slug: zod.z.string().trim().min(1),
-	name: zod.z.string().optional(),
-	description: zod.z.string().optional(),
+	name: requiredDisplayTextSchema,
+	description: requiredDisplayTextSchema,
 	subscription: zod.z.object({ mode: zod.z.enum(["system", "subscribable"]).optional() }).optional(),
 	input: zodSchema$1,
 	output: zodSchema$1,
@@ -29825,6 +30938,7 @@ function isWorkflow(value) {
 	if (!(WORKFLOW in value) || value[WORKFLOW] !== true) return false;
 	return workflowCoreSchema.safeParse(value).success;
 }
+new node_async_hooks.AsyncLocalStorage();
 const storage = new node_async_hooks.AsyncLocalStorage();
 registerWorkflowRunGetter(() => {
 	const store = storage.getStore();
@@ -29887,11 +31001,12 @@ function normalizeLegacySlugFields(value) {
 	return next;
 }
 const slugField = zod.z.string().trim().min(1);
-const optionalTextField = zod.z.string().optional();
+const requiredTextField = zod.z.string().trim().min(1);
+const optionalTextField = zod.z.string().trim().min(1).optional();
 const baseSourceShape = {
 	slug: slugField,
-	name: optionalTextField,
-	description: optionalTextField,
+	name: requiredTextField,
+	description: requiredTextField,
 	attach: zod.z.function()
 };
 const webhookSourceSchema = zod.z.object({
@@ -43771,6 +44886,18 @@ Object.defineProperty(exports, "DEFAULT_TRIGGER_OVERVIEW_MODEL", {
 		return DEFAULT_TRIGGER_OVERVIEW_MODEL;
 	}
 });
+Object.defineProperty(exports, "DEFAULT_WORKFLOW_CANVAS_MODEL", {
+	enumerable: true,
+	get: function() {
+		return DEFAULT_WORKFLOW_CANVAS_MODEL;
+	}
+});
+Object.defineProperty(exports, "DEFAULT_WORKFLOW_OVERVIEW_MODEL", {
+	enumerable: true,
+	get: function() {
+		return DEFAULT_WORKFLOW_OVERVIEW_MODEL;
+	}
+});
 Object.defineProperty(exports, "DeclineOrganizationInvitationResponseSchema", {
 	enumerable: true,
 	get: function() {
@@ -44275,6 +45402,36 @@ Object.defineProperty(exports, "UserPreferencesSchema", {
 		return UserPreferencesSchema;
 	}
 });
+Object.defineProperty(exports, "WorkflowCanvasCredentialBindingsSchema", {
+	enumerable: true,
+	get: function() {
+		return WorkflowCanvasCredentialBindingsSchema;
+	}
+});
+Object.defineProperty(exports, "WorkflowCanvasRunSchema", {
+	enumerable: true,
+	get: function() {
+		return WorkflowCanvasRunSchema;
+	}
+});
+Object.defineProperty(exports, "WorkflowCanvasSchema", {
+	enumerable: true,
+	get: function() {
+		return WorkflowCanvasSchema;
+	}
+});
+Object.defineProperty(exports, "WorkflowRunInputsPutBodySchema", {
+	enumerable: true,
+	get: function() {
+		return WorkflowRunInputsPutBodySchema;
+	}
+});
+Object.defineProperty(exports, "WorkflowRunInputsSchema", {
+	enumerable: true,
+	get: function() {
+		return WorkflowRunInputsSchema;
+	}
+});
 Object.defineProperty(exports, "WorkflowSummaryDetailResponseSchema", {
 	enumerable: true,
 	get: function() {
@@ -44323,6 +45480,12 @@ Object.defineProperty(exports, "WorkspaceTriggerRunListResponseSchema", {
 		return WorkspaceTriggerRunListResponseSchema;
 	}
 });
+Object.defineProperty(exports, "WorkspaceWorkflowOverviewSchema", {
+	enumerable: true,
+	get: function() {
+		return WorkspaceWorkflowOverviewSchema;
+	}
+});
 Object.defineProperty(exports, "__commonJSMin", {
 	enumerable: true,
 	get: function() {
@@ -44419,6 +45582,12 @@ Object.defineProperty(exports, "deriveCredentialInstanceSlug", {
 		return deriveCredentialInstanceSlug;
 	}
 });
+Object.defineProperty(exports, "describeCredentialBinding", {
+	enumerable: true,
+	get: function() {
+		return describeCredentialBinding;
+	}
+});
 Object.defineProperty(exports, "discoverGraphqlApp", {
 	enumerable: true,
 	get: function() {
@@ -44503,6 +45672,12 @@ Object.defineProperty(exports, "isUserAvatarStorageKey", {
 		return isUserAvatarStorageKey;
 	}
 });
+Object.defineProperty(exports, "jsonSchemaToWorkflowInputSchema", {
+	enumerable: true,
+	get: function() {
+		return jsonSchemaToWorkflowInputSchema;
+	}
+});
 Object.defineProperty(exports, "keystrokeAssetsAvatarKeyFromPublicUrl", {
 	enumerable: true,
 	get: function() {
@@ -44689,11 +45864,23 @@ Object.defineProperty(exports, "validateCredentialValueAgainstFields", {
 		return validateCredentialValueAgainstFields;
 	}
 });
+Object.defineProperty(exports, "validateWorkflowRunInputValues", {
+	enumerable: true,
+	get: function() {
+		return validateWorkflowRunInputValues;
+	}
+});
 Object.defineProperty(exports, "validationErrorResponse", {
 	enumerable: true,
 	get: function() {
 		return validationErrorResponse;
 	}
 });
+Object.defineProperty(exports, "withCredentialAssignments", {
+	enumerable: true,
+	get: function() {
+		return withCredentialAssignments;
+	}
+});
 
-//# sourceMappingURL=dist-BGnpuTuc.cjs.map
+//# sourceMappingURL=dist-BSIIH4ft.cjs.map