@keystrokehq/platform 0.1.25 → 0.1.26

package/dist/{dist-DEUmH1sy.mjs → dist-Dfoa0fsU.mjs}

@@ -1,7 +1,7 @@
 import { createRequire } from "node:module";
 import Docker from "dockerode";
 import { mkdir } from "node:fs/promises";
-import { DEFAULT_DATABASE_URL, claimDueTriggers, claimDueTriggersForOrg, claimNextJob, clearCredentialInstanceDefaults, createPostgresCancelChannel, decryptCredentialPayload, disableAllTriggerSchedules, disableTriggerSchedulesNotInSlugs, encryptCredentialPayload, enqueueJob, ensureOAuthCredentialInstance, failWorkflowRun, getProjectScopeId, inferDialect, listEnabledScheduledTriggers, listExecutableAttachmentsByTriggerIds, markJobComplete, markJobFailed, requeueExpiredLeases, resolvePostgresUrlFromEnv, resolveProjectDatabaseUrlFromEnv, scheduleJobRetry, selectActiveEphemeralScheduledTriggerSlugs, selectCredentialInstancesForScope, selectTriggerBySlug, setTriggerScheduleEnabled, upsertCredentialInstance, upsertTriggerScheduleFields } from "@keystrokehq/database";
+import { DEFAULT_DATABASE_URL, claimDueTriggers, claimDueTriggersForOrg, claimNextJob, clearCredentialInstanceDefaults, createPostgresCancelChannel, decryptCredentialPayload, disableAllTriggerSchedules, disableTriggerSchedulesNotInSlugs, encryptCredentialPayload, enqueueJob, ensureOAuthCredentialInstance, failWorkflowRun, getProjectScopeId, getServerTenantScopeId, inferDialect, isDatabaseInitialized, listCredentialAssignmentsByTarget, listEnabledScheduledTriggers, listExecutableAttachmentsByTriggerIds, markJobComplete, markJobFailed, requeueExpiredLeases, resolvePostgresUrlFromEnv, resolveProjectDatabaseUrlFromEnv, scheduleJobRetry, selectActiveEphemeralScheduledTriggerSlugs, selectCredentialInstanceById, selectCredentialInstancesForScope, selectTriggerBySlug, setTriggerScheduleEnabled, upsertCredentialInstance, upsertTriggerScheduleFields } from "@keystrokehq/database";
 import EventEmitter$1, { EventEmitter } from "node:events";
 import { z } from "zod";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -179,7 +179,7 @@ function slugify(input) {
 	return input.toLowerCase().trim().replace(/[^\w\s-]/g, "").replace(/[\s_-]+/g, "-").replace(/^-+|-+$/g, "");
 }
 const captureStackTrace = "captureStackTrace" in Error ? Error.captureStackTrace : (..._args) => {};
-function isObject(data) {
+function isObject$3(data) {
 	return typeof data === "object" && data !== null && !Array.isArray(data);
 }
 const allowsEval = /* @__PURE__ */ cached(() => {
@@ -193,12 +193,12 @@ const allowsEval = /* @__PURE__ */ cached(() => {
 	}
 });
 function isPlainObject$1(o) {
-	if (isObject(o) === false) return false;
+	if (isObject$3(o) === false) return false;
 	const ctor = o.constructor;
 	if (ctor === void 0) return true;
 	if (typeof ctor !== "function") return true;
 	const prot = ctor.prototype;
-	if (isObject(prot) === false) return false;
+	if (isObject$3(prot) === false) return false;
 	if (Object.prototype.hasOwnProperty.call(prot, "isPrototypeOf") === false) return false;
 	return true;
 }
@@ -1586,7 +1586,7 @@ const $ZodObject = /* @__PURE__ */ $constructor("$ZodObject", (inst, def) => {
 		}
 		return propValues;
 	});
-	const isObject$1 = isObject;
+	const isObject$1 = isObject$3;
 	const catchall = def.catchall;
 	let value;
 	inst._zod.parse = (payload, ctx) => {
@@ -1715,7 +1715,7 @@ const $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def)
 		return (payload, ctx) => fn(shape, payload, ctx);
 	};
 	let fastpass;
-	const isObject$2 = isObject;
+	const isObject$2 = isObject$3;
 	const jit = !globalConfig.jitless;
 	const fastEnabled = jit && allowsEval.value;
 	const catchall = def.catchall;
@@ -1827,7 +1827,7 @@ const $ZodDiscriminatedUnion = /* @__PURE__ */ $constructor("$ZodDiscriminatedUn
 	});
 	inst._zod.parse = (payload, ctx) => {
 		const input = payload.value;
-		if (!isObject(input)) {
+		if (!isObject$3(input)) {
 			payload.issues.push({
 				code: "invalid_type",
 				expected: "object",
@@ -2298,6 +2298,21 @@ function handleReadonlyResult(payload) {
 	payload.value = Object.freeze(payload.value);
 	return payload;
 }
+const $ZodLazy = /* @__PURE__ */ $constructor("$ZodLazy", (inst, def) => {
+	$ZodType.init(inst, def);
+	defineLazy(inst._zod, "innerType", () => {
+		const d = def;
+		if (!d._cachedInner) d._cachedInner = def.getter();
+		return d._cachedInner;
+	});
+	defineLazy(inst._zod, "pattern", () => inst._zod.innerType?._zod?.pattern);
+	defineLazy(inst._zod, "propValues", () => inst._zod.innerType?._zod?.propValues);
+	defineLazy(inst._zod, "optin", () => inst._zod.innerType?._zod?.optin ?? void 0);
+	defineLazy(inst._zod, "optout", () => inst._zod.innerType?._zod?.optout ?? void 0);
+	inst._zod.parse = (payload, ctx) => {
+		return inst._zod.innerType._zod.run(payload, ctx);
+	};
+});
 const $ZodCustom = /* @__PURE__ */ $constructor("$ZodCustom", (inst, def) => {
 	$ZodCheck.init(inst, def);
 	$ZodType.init(inst, def);
@@ -3432,6 +3447,12 @@ const optionalProcessor = (schema, ctx, _json, params) => {
 	const seen = ctx.seen.get(schema);
 	seen.ref = def.innerType;
 };
+const lazyProcessor = (schema, ctx, _json, params) => {
+	const innerType = schema._zod.innerType;
+	process$1(innerType, ctx, params);
+	const seen = ctx.seen.get(schema);
+	seen.ref = innerType;
+};
 const ZodISODateTime = /* @__PURE__ */ $constructor("ZodISODateTime", (inst, def) => {
 	$ZodISODateTime.init(inst, def);
 	ZodStringFormat.init(inst, def);
@@ -4287,6 +4308,18 @@ function readonly(innerType) {
 		innerType
 	});
 }
+const ZodLazy = /* @__PURE__ */ $constructor("ZodLazy", (inst, def) => {
+	$ZodLazy.init(inst, def);
+	ZodType.init(inst, def);
+	inst._zod.processJSONSchema = (ctx, json, params) => lazyProcessor(inst, ctx, json, params);
+	inst.unwrap = () => inst._zod.def.getter();
+});
+function lazy(getter) {
+	return new ZodLazy({
+		type: "lazy",
+		getter
+	});
+}
 const ZodCustom = /* @__PURE__ */ $constructor("ZodCustom", (inst, def) => {
 	$ZodCustom.init(inst, def);
 	ZodType.init(inst, def);
@@ -4958,10 +4991,244 @@ const AppSlugSchema$1 = ProjectSlugSchema$1;
 function resolveExplicitPublicPlatformOrigin$1(env = process.env) {
 	return env.PUBLIC_PLATFORM_URL?.replace(/\/$/, "") || void 0;
 }
+/** How a credential instance is stored (`credential_instances.auth_kind`). */
+const CredentialAuthKindSchema$1 = _enum([
+	"api_key",
+	"oauth_managed",
+	"keystroke"
+]);
+/**
+* Where a credential instance is stored (`credential_instances.scope_type`), and the only thing an
+* action/tool can pin via `.scope(...)`. There is no resolution chain: when no scope is pinned, the
+* resolver tries the project default, then the org default, then throws.
+*/
+const CredentialScopeTypeSchema$1 = _enum([
+	"organization",
+	"project",
+	"user"
+]);
+CredentialAuthKindSchema$1.options;
+CredentialScopeTypeSchema$1.options;
+/** Non-empty human-readable label or description (trimmed). */
+const requiredDisplayTextSchema$1 = string().trim().min(1);
+/**
+* Structural workflow-canvas graph contract.
+*
+* This is the deterministic skeleton the deploy-time AST producer emits for a
+* workflow (nodes + edges), plus the manifest-derived trigger-source nodes. It
+* is the single source of truth shared by:
+* - the AST producer (emits it at deploy, stored with the manifest),
+* - the platform route that serves the canvas, and
+* - the SDK / web client that renders it (React Flow).
+*
+* Only the structural skeleton lives here. The LLM enrichment + run-overlay
+* envelope types live in `workflow-canvas-envelope.ts`; the SDK re-exports them.
+* See WORKFLOW.md (§4 grammar, §8 node ids, §9 caching).
+*/
+/**
+* Canvas node taxonomy — the single discriminator for every canvas node. The
+* client derives the React Flow component, icon, and per-node treatment from it
+* (no parallel `type` / `data.kind` fields), and the producer + fixtures emit it
+* directly, so the structural contract can never silently diverge across the
+* deploy → render boundary.
+* - Boundaries: `entry` (Start, owns input) · `exit` (Output, owns output) ·
+*   `error` (a terminal `throw` — an error output that ends the run on a branch)
+* - Callable: `step` (action / agent / llm / hook / child-workflow invocation) —
+*   the invocation flavor lives in {@link WorkflowCanvasCallKind}
+* - Structural control flow: `code-block` · `decision` · `merge` · `loop` ·
+*   `parallel` (group containers) · `loop-start` (the group body's entry marker,
+*   shared by loop + parallel)
+* - Upstream of entry: `trigger-source` (one per manifest trigger attachment)
+*
+* `Promise.all([...])` is modeled as a `parallel` group container: the branches
+* are stacked inside and the container itself is the single prong leaving the
+* wrapper (there is no separate fork/join pair).
+*
+* `exit` and `error` are both terminals: a `return` flows to the shared `exit`
+* (the workflow output), while a `throw` gets its own `error` terminal off the
+* branch so guard clauses (`if (bad) throw …`) read as a visible dead-end.
+*/
+const WorkflowCanvasNodeTypeSchema$1 = _enum([
+	"entry",
+	"exit",
+	"error",
+	"step",
+	"code-block",
+	"decision",
+	"merge",
+	"loop",
+	"parallel",
+	"loop-start",
+	"trigger-source"
+]);
+_enum([
+	"workflow-step",
+	"agent",
+	"llm",
+	"wait",
+	"hook",
+	"tool",
+	"child-workflow"
+]);
+/** A labeled branch output on a decision-style node. */
+const WorkflowCanvasNodeOutputSchema$1 = object({
+	id: string(),
+	label: string()
+});
+/**
+* A step input's configured value at its call site, captured deterministically
+* by the producer from the call's argument object. The platform join turns this
+* into the inspector's {@link WorkflowNodeInputBinding} (filling display labels).
+*/
+const WorkflowCanvasRawBindingSchema$1 = object({
+	tokens: array(discriminatedUnion("kind", [
+		object({
+			kind: literal("text"),
+			text: string()
+		}),
+		object({
+			kind: literal("reference"),
+			/** Upstream node id this value flows from; absent only for unresolved refs. */
+			sourceNodeId: string().optional(),
+			/** Output field of the source (dotted path); omitted = the whole output. */
+			field: string().optional()
+		}),
+		object({
+			kind: literal("variable"),
+			text: string()
+		}),
+		object({
+			kind: literal("call"),
+			name: string()
+		})
+	])),
+	/** Render as a tall multi-line box (object/array/multiline template values). */
+	multiline: boolean().optional()
+});
+/**
+* Statically-captured `promptLlm` options for an `llm` step node. Literal-only:
+* dynamic/expression values (a computed model, a `system` built by a function) are
+* not captured; `system`/`outputSchema` record presence so the inspector can note
+* "a system prompt is configured" / "structured output" without their values.
+*/
+const WorkflowCanvasLlmOptionsSchema$1 = object({
+	model: string().optional(),
+	maxTokens: number$1().optional(),
+	temperature: number$1().optional(),
+	thinkingLevel: string().optional(),
+	hasSystemPrompt: boolean().optional(),
+	hasOutputSchema: boolean().optional()
+});
+const WorkflowCanvasNodeDataSchema$1 = object({
+	label: string(),
+	/** Set on group nodes (loop / parallel section containers). */
+	groupKind: _enum([
+		"loop",
+		"parallel",
+		"conditional"
+	]).optional(),
+	description: string().optional(),
+	/** {@link WorkflowCanvasCallKind} or a looser raw call-site label. */
+	callKind: string().optional(),
+	/**
+	* App/integration slug for a `step` whose action/agent is imported directly
+	* from a `@keystrokehq/<app>` package (e.g. "slack", "apollo"). Lets the client
+	* badge the node with that app's logo; absent for custom (project-local)
+	* actions, which fall back to the call-kind icon.
+	*/
+	appSlug: string().optional(),
+	/** Cron/webhook/poll discriminator on trigger-source nodes. */
+	triggerType: string().optional(),
+	/** Branch outputs (decision nodes). */
+	outputs: array(WorkflowCanvasNodeOutputSchema$1).optional(),
+	/**
+	* Action/agent/workflow slug resolved at deploy time (via import → definition).
+	* Optional when the deploy build cannot resolve source (dist-only artifacts).
+	*/
+	slug: string().optional(),
+	/**
+	* Durable call-site ids nested inside an off-grammar `code-block` (same-file only).
+	* Used by the run overlay to light the block when any contained step executes.
+	*/
+	containedCallSiteIds: array(string()).optional(),
+	/**
+	* Per-input call-site value bindings for `step` nodes, keyed by input field name.
+	* Deterministically captured from the call's argument object; reference tokens point
+	* at the upstream node that produced the value. The platform join fills display labels.
+	*/
+	inputBindings: record(string(), WorkflowCanvasRawBindingSchema$1).optional(),
+	/**
+	* Static `promptLlm(prompt, options)` configuration captured at the call site for
+	* `llm` step nodes. Only literal values are captured (model/maxTokens/temperature/
+	* thinkingLevel); `system`/`outputSchema` are usually expressions, so only their
+	* presence is recorded. Absent when no options are statically resolvable.
+	*/
+	llmOptions: WorkflowCanvasLlmOptionsSchema$1.optional()
+});
+/**
+* A single structural node. This is the deploy artifact's shape: identity
+* (`id`), the canonical discriminator (`nodeType`), display `data`, and group
+* nesting (`parentId`). All layout/rendering — React Flow component key,
+* positions, sizes, `extent`, group box dimensions — is derived entirely
+* client-side from this structure, so it never leaks into the wire contract.
+*/
+const WorkflowCanvasGraphNodeSchema$1 = object({
+	id: string(),
+	nodeType: WorkflowCanvasNodeTypeSchema$1,
+	data: WorkflowCanvasNodeDataSchema$1,
+	/** Set on children nested inside a group (loop / parallel) container. */
+	parentId: string().optional()
+});
+const WorkflowCanvasEdgeSchema$1 = object({
+	id: string(),
+	source: string(),
+	target: string(),
+	type: string().optional(),
+	label: string().optional(),
+	sourceHandle: string().optional(),
+	targetHandle: string().optional(),
+	data: object({ branchKind: _enum([
+		"then",
+		"else",
+		"parallel-branch",
+		"error"
+	]).optional() }).optional()
+});
+/** A statically-evaluable top-level `const` value (literal scalars only). */
+const WorkflowCanvasConstantValueSchema$1 = union([
+	string(),
+	number$1(),
+	boolean()
+]);
+/**
+* Top-level `const NAME = <literal>` declarations in the workflow source, captured
+* at deploy. Lets the platform resolve `variable` value tokens (e.g. a `model` set
+* to a named const) to their concrete value for display. Scalars only — computed,
+* function-local, or non-literal consts are intentionally omitted.
+*/
+const WorkflowCanvasConstantsSchema$1 = record(string(), WorkflowCanvasConstantValueSchema$1);
+const WorkflowCanvasGraphSchema$1 = object({
+	nodes: array(WorkflowCanvasGraphNodeSchema$1),
+	edges: array(WorkflowCanvasEdgeSchema$1),
+	/** Top-level literal constants from the workflow source (for value-token resolution). */
+	constants: WorkflowCanvasConstantsSchema$1.optional()
+});
+/**
+* Deploy-time summary of one credential a step requires, derived from the
+* action/agent-tool definition's `.credentials`. The workflow-canvas credential
+* overlay joins a step node's `slug` to these to resolve the bound instance.
+* `key` doubles as the app slug (matches `credential_instances.app_slug`).
+*/
+const CredentialRequirementSummarySchema$1 = object({
+	key: string(),
+	kind: CredentialAuthKindSchema$1,
+	/** Scope pinned via `.scope(...)`; absent means project-default → org-default. */
+	scope: CredentialScopeTypeSchema$1.optional()
+});
 const StoredRouteManifestSkillSchema$1 = object({
 	slug: string(),
-	name: string().optional(),
-	description: string().optional(),
+	name: requiredDisplayTextSchema$1,
+	description: requiredDisplayTextSchema$1,
 	moduleFile: string()
 });
 const attachmentSchemasSchema$1 = record(string(), object({
@@ -4969,8 +5236,8 @@ const attachmentSchemasSchema$1 = record(string(), object({
 	filterSchema: record(string(), unknown()).optional()
 }));
 const attachmentMetaSchema$1 = record(string(), object({
-	name: string().optional(),
-	description: string().optional()
+	name: requiredDisplayTextSchema$1,
+	description: requiredDisplayTextSchema$1
 }));
 const storedRouteManifestEntryV2Schema$1 = discriminatedUnion("kind", [
 	object({ kind: literal("health") }),
@@ -4978,23 +5245,43 @@ const storedRouteManifestEntryV2Schema$1 = discriminatedUnion("kind", [
 		kind: literal("agent"),
 		slug: string(),
 		moduleFile: string(),
-		name: string().optional(),
-		description: string().optional(),
+		name: requiredDisplayTextSchema$1,
+		description: requiredDisplayTextSchema$1,
 		model: string(),
 		systemPrompt: string(),
 		toolCount: number$1().int().nonnegative(),
 		credentialCount: number$1().int().nonnegative(),
 		appSlugs: array(string()).default([]),
-		toolSlugs: array(string()).default([])
+		toolSlugs: array(string()).default([]),
+		/** Credential requirements per tool slug (the agent's credential consumer key). */
+		toolRequirements: record(string(), array(CredentialRequirementSummarySchema$1)).optional()
+	}),
+	object({
+		kind: literal("action"),
+		slug: string(),
+		name: requiredDisplayTextSchema$1,
+		description: requiredDisplayTextSchema$1,
+		moduleFile: string(),
+		/** App slug for actions imported from an integration package (`@keystrokehq/<app>/actions`). */
+		appSlug: string().optional(),
+		inputSchema: record(string(), unknown()),
+		outputSchema: record(string(), unknown()),
+		/** Credentials this action requires (for the canvas credential overlay). */
+		requirements: array(CredentialRequirementSummarySchema$1).optional()
 	}),
 	object({
 		kind: literal("workflow"),
 		slug: string(),
-		name: string().optional(),
-		description: string().optional(),
+		name: requiredDisplayTextSchema$1,
+		description: requiredDisplayTextSchema$1,
 		subscribable: boolean(),
 		moduleFile: string(),
-		requestSchema: record(string(), unknown())
+		requestSchema: record(string(), unknown()),
+		responseSchema: record(string(), unknown()).optional(),
+		/** Deterministic AST control-flow skeleton (deploy-time producer). */
+		flowGraph: WorkflowCanvasGraphSchema$1.optional(),
+		/** sha256 of the workflow source the `flowGraph` was produced from (staleness). */
+		flowGraphSourceHash: string().optional()
 	}),
 	object({
 		kind: literal("trigger-webhook"),
@@ -5013,8 +5300,8 @@ const storedRouteManifestEntryV2Schema$1 = discriminatedUnion("kind", [
 		moduleFile: string(),
 		sourceHash: string().optional(),
 		schedule: string(),
-		name: string().optional(),
-		description: string().optional()
+		name: requiredDisplayTextSchema$1,
+		description: requiredDisplayTextSchema$1
 	}),
 	object({
 		kind: literal("trigger-poll-group"),
@@ -5030,8 +5317,8 @@ const storedRouteManifestEntryV2Schema$1 = discriminatedUnion("kind", [
 		moduleFile: string(),
 		sourceHash: string().optional(),
 		schedule: string(),
-		name: string().optional(),
-		description: string().optional()
+		name: requiredDisplayTextSchema$1,
+		description: requiredDisplayTextSchema$1
 	})
 ]);
 object({
@@ -5457,24 +5744,6 @@ object({
 	outputParameters: record(string(), unknown()).optional(),
 	version: string().optional()
 });
-/** How a credential instance is stored (`credential_instances.auth_kind`). */
-const CredentialAuthKindSchema$1 = _enum([
-	"api_key",
-	"oauth_managed",
-	"keystroke"
-]);
-/**
-* Where a credential instance is stored (`credential_instances.scope_type`), and the only thing an
-* action/tool can pin via `.scope(...)`. There is no resolution chain: when no scope is pinned, the
-* resolver tries the project default, then the org default, then throws.
-*/
-const CredentialScopeTypeSchema$1 = _enum([
-	"organization",
-	"project",
-	"user"
-]);
-CredentialAuthKindSchema$1.options;
-CredentialScopeTypeSchema$1.options;
 /** Scope of a platform app credential (maps to `credential_instances.scope_type`). */
 const AppCredentialScopeSchema$1 = _enum([
 	"user",
@@ -6470,7 +6739,7 @@ object({
 	id: string(),
 	slug: string(),
 	name: string(),
-	description: string().nullable(),
+	description: string().min(1),
 	type: TriggerTypeSchema$1,
 	status: TriggerStatusSchema$1,
 	projectId: string(),
@@ -6766,7 +7035,7 @@ const AgentSummarySchema$1 = object({
 	name: string().min(1),
 	projectId: string().min(1),
 	updatedAt: string().min(1),
-	description: string().optional(),
+	description: string().min(1),
 	sourcePath: string().min(1).optional(),
 	model: string().optional(),
 	capabilities: object({
@@ -6788,7 +7057,7 @@ const WorkflowSummarySchema$1 = object({
 	name: string().min(1),
 	projectId: string().min(1),
 	updatedAt: string().min(1),
-	description: string().optional(),
+	description: string().min(1),
 	sourcePath: string().min(1).optional(),
 	lastRunAt: optionalTimestamp$2
 });
@@ -6798,7 +7067,7 @@ const SkillSummarySchema$1 = object({
 	name: string().min(1),
 	projectId: string().min(1),
 	updatedAt: string().min(1),
-	description: string().optional(),
+	description: string().min(1),
 	sourcePath: string().min(1).optional()
 });
 AgentSummarySchema$1.nullable();
@@ -6907,6 +7176,245 @@ object({ files: array(object({
 	id: string(),
 	path: string().min(1)
 })) });
+/** Whether the overview is still being produced or finished. */
+const WorkflowOverviewStatusSchema$1 = _enum(["generating", "ready"]);
+/** One phase of the guided-tour overview. */
+const WorkflowPhaseSchema$1 = object({
+	id: string(),
+	title: string(),
+	copy: string(),
+	nodeIds: array(string())
+});
+object({
+	status: WorkflowOverviewStatusSchema$1,
+	summary: string(),
+	phases: array(WorkflowPhaseSchema$1),
+	hash: string(),
+	generatedAt: string().nullable(),
+	model: string()
+});
+/** Subset of JSON-Schema field types the dashboard form renders inline. */
+const WorkflowInputFieldTypeSchema$1 = _enum([
+	"string",
+	"number",
+	"boolean",
+	"enum",
+	"object",
+	"array"
+]);
+const WorkflowInputFieldSchema$1 = lazy(() => object({
+	key: string(),
+	label: string(),
+	type: WorkflowInputFieldTypeSchema$1,
+	required: boolean(),
+	description: string().optional(),
+	placeholder: string().optional(),
+	options: array(string()).optional(),
+	default: union([
+		string(),
+		number$1(),
+		boolean()
+	]).optional(),
+	children: array(WorkflowInputFieldSchema$1).optional(),
+	format: string().optional()
+}));
+object({
+	schema: object({ fields: array(WorkflowInputFieldSchema$1) }),
+	values: record(string(), unknown()).nullable()
+});
+object({ runId: string() });
+/** Annotation lifecycle: "generating" while the LLM pass streams in, then "ready". */
+const WorkflowCanvasStatusSchema$1 = _enum(["generating", "ready"]);
+/** LLM-produced enrichment for a single skeleton node. */
+const WorkflowCanvasAnnotationSchema$1 = object({
+	label: string().optional(),
+	description: string().optional()
+});
+/** The configured value of one input at this call site. */
+const WorkflowNodeInputBindingSchema$1 = object({
+	tokens: array(discriminatedUnion("kind", [
+		object({
+			kind: literal("text"),
+			text: string()
+		}),
+		object({
+			kind: literal("reference"),
+			sourceNodeId: string().optional(),
+			sourceLabel: string(),
+			field: string().optional()
+		}),
+		object({
+			kind: literal("variable"),
+			text: string(),
+			/** Concrete value when `text` resolves to a top-level literal constant. */
+			resolvedValue: string().optional()
+		}),
+		object({
+			kind: literal("call"),
+			name: string()
+		})
+	])),
+	multiline: boolean().optional()
+});
+/** An inspector input with optional call-site binding. */
+const WorkflowCanvasNodeInputSchema$1 = WorkflowInputFieldSchema$1.and(object({
+	binding: WorkflowNodeInputBindingSchema$1.optional(),
+	additional: boolean().optional()
+}));
+/** Authored, deterministic metadata for a single node. */
+const WorkflowCanvasNodeMetaSchema$1 = object({
+	kind: _enum([
+		"action",
+		"agent",
+		"workflow",
+		"llm",
+		"trigger",
+		"boundary"
+	]),
+	slug: string(),
+	name: string(),
+	description: string().optional(),
+	appSlug: string().optional(),
+	inputs: array(WorkflowCanvasNodeInputSchema$1),
+	outputs: array(WorkflowInputFieldSchema$1),
+	requiredApps: array(string()).optional(),
+	model: string().optional(),
+	toolCount: number$1().int().nonnegative().optional()
+});
+object({
+	graph: WorkflowCanvasGraphSchema$1,
+	nodeMetadata: record(string(), WorkflowCanvasNodeMetaSchema$1),
+	annotations: record(string(), WorkflowCanvasAnnotationSchema$1),
+	status: WorkflowCanvasStatusSchema$1,
+	hash: string(),
+	generatedAt: string().nullable(),
+	model: string()
+});
+const WorkflowCanvasNodeRunStateSchema$1 = object({
+	status: _enum([
+		"pending",
+		"running",
+		"succeeded",
+		"failed",
+		"skipped"
+	]),
+	iteration: object({
+		index: number$1().int().nonnegative(),
+		total: number$1().int().nonnegative()
+	}).optional()
+});
+/** Overall lifecycle of a run as the canvas animates it. */
+const WorkflowCanvasRunStatusSchema$1 = _enum([
+	"running",
+	"succeeded",
+	"failed",
+	"canceled"
+]);
+object({
+	runId: string(),
+	status: WorkflowCanvasRunStatusSchema$1,
+	startedAt: string(),
+	finishedAt: string().nullable(),
+	nodeStates: record(string(), WorkflowCanvasNodeRunStateSchema$1)
+});
+/** Scope a credential instance lives in. */
+const WorkflowCredentialScopeSchema$1 = _enum([
+	"organization",
+	"project",
+	"user"
+]);
+/** The concrete credential instance a binding currently resolves to. */
+const WorkflowResolvedCredentialSchema$1 = object({
+	id: string(),
+	name: string(),
+	scope: WorkflowCredentialScopeSchema$1,
+	appSlug: string().optional(),
+	isDefault: boolean().optional(),
+	projectId: string().optional(),
+	projectName: string().optional()
+});
+record(string(), WorkflowCanvasAnnotationSchema$1);
+/** One opaque code-block the annotation pass should label, keyed by its canvas node id. */
+const WorkflowCanvasAnnotationCodeBlockSchema$1 = object({
+	nodeId: string(),
+	/** The raw source snippet (the node's label) the LLM turns into human copy. */
+	source: string()
+});
+/** Inputs the worker feeds the LLM for the gated code-block annotation pass. */
+const WorkflowCanvasAnnotationsInputSchema$1 = object({
+	workflowName: string(),
+	workflowDescription: string().nullable(),
+	codeBlocks: array(WorkflowCanvasAnnotationCodeBlockSchema$1)
+});
+object({
+	workflowId: string(),
+	projectId: string(),
+	hash: string(),
+	model: string(),
+	input: WorkflowCanvasAnnotationsInputSchema$1
+});
+/** One node as the overview LLM sees it (derived from the canvas node metadata + graph). */
+const WorkflowOverviewNodeSchema$1 = object({
+	nodeId: string(),
+	label: string(),
+	kind: string(),
+	description: string().optional(),
+	/** App/integration slug for steps imported from a `@keystrokehq/<app>` package. */
+	appSlug: string().optional(),
+	/** Authored input field keys (from the action/agent/workflow definition). */
+	inputs: array(string()).optional(),
+	/** Authored output field keys. */
+	outputs: array(string()).optional(),
+	/** Agent-only: the model the agent runs on. */
+	model: string().optional(),
+	/** Agent-only: number of tools available to the agent. */
+	toolCount: number$1().int().nonnegative().optional()
+});
+/** Inputs the worker feeds the LLM to produce the workflow overview (summary + phases). */
+const WorkflowOverviewInputSchema$1 = object({
+	workflowName: string(),
+	workflowDescription: string().nullable(),
+	/** Display labels of the trigger sources upstream of the workflow (read-only context). */
+	triggers: array(string()),
+	nodes: array(WorkflowOverviewNodeSchema$1),
+	/** The workflow's TypeScript source (best-effort; null when the deploy has no source snapshot). */
+	source: string().nullable()
+});
+object({
+	workflowId: string(),
+	projectId: string(),
+	hash: string(),
+	model: string(),
+	input: WorkflowOverviewInputSchema$1
+});
+const WorkflowCanvasCredentialBindingBaseSchema$1 = object({
+	credentialKey: string(),
+	label: string(),
+	appSlug: string().optional()
+});
+/** How one credential requirement on a step currently resolves. */
+const WorkflowCanvasCredentialBindingSchema$1 = union([
+	WorkflowCanvasCredentialBindingBaseSchema$1.extend({
+		policy: _enum([
+			"project-default",
+			"org-default",
+			"assigned"
+		]),
+		instance: WorkflowResolvedCredentialSchema$1
+	}),
+	WorkflowCanvasCredentialBindingBaseSchema$1.extend({
+		policy: literal("scope-pinned"),
+		pinnedScope: WorkflowCredentialScopeSchema$1,
+		instance: WorkflowResolvedCredentialSchema$1
+	}),
+	WorkflowCanvasCredentialBindingBaseSchema$1.extend({
+		policy: literal("unresolved"),
+		reason: _enum(["needs-selection", "missing"]),
+		pinnedScope: WorkflowCredentialScopeSchema$1.optional()
+	})
+]);
+record(string(), array(WorkflowCanvasCredentialBindingSchema$1));
+record(string(), unknown());
 /** Builds base64 `KEYSTROKE_ORG_ARTIFACTS` payload for org worker containers. */
 function encodeOrgArtifacts(artifacts) {
 	return Buffer.from(JSON.stringify(artifacts)).toString("base64");
@@ -8299,10 +8807,260 @@ function resolveExternalPlatformOrigin(env = process.env) {
 }
 /** On-disk path under the project root (packed in deploy artifacts when present). */
 const ROUTE_MANIFEST_REL_PATH = "dist/.keystroke/route-manifest.json";
+/** How a credential instance is stored (`credential_instances.auth_kind`). */
+const CredentialAuthKindSchema = z.enum([
+	"api_key",
+	"oauth_managed",
+	"keystroke"
+]);
+/**
+* Where a credential instance is stored (`credential_instances.scope_type`), and the only thing an
+* action/tool can pin via `.scope(...)`. There is no resolution chain: when no scope is pinned, the
+* resolver tries the project default, then the org default, then throws.
+*/
+const CredentialScopeTypeSchema = z.enum([
+	"organization",
+	"project",
+	"user"
+]);
+CredentialAuthKindSchema.options;
+CredentialScopeTypeSchema.options;
+/** Non-empty human-readable label or description (trimmed). */
+const requiredDisplayTextSchema = z.string().trim().min(1);
+/**
+* Structural workflow-canvas graph contract.
+*
+* This is the deterministic skeleton the deploy-time AST producer emits for a
+* workflow (nodes + edges), plus the manifest-derived trigger-source nodes. It
+* is the single source of truth shared by:
+* - the AST producer (emits it at deploy, stored with the manifest),
+* - the platform route that serves the canvas, and
+* - the SDK / web client that renders it (React Flow).
+*
+* Only the structural skeleton lives here. The LLM enrichment + run-overlay
+* envelope types live in `workflow-canvas-envelope.ts`; the SDK re-exports them.
+* See WORKFLOW.md (§4 grammar, §8 node ids, §9 caching).
+*/
+/**
+* Canvas node taxonomy — the single discriminator for every canvas node. The
+* client derives the React Flow component, icon, and per-node treatment from it
+* (no parallel `type` / `data.kind` fields), and the producer + fixtures emit it
+* directly, so the structural contract can never silently diverge across the
+* deploy → render boundary.
+* - Boundaries: `entry` (Start, owns input) · `exit` (Output, owns output) ·
+*   `error` (a terminal `throw` — an error output that ends the run on a branch)
+* - Callable: `step` (action / agent / llm / hook / child-workflow invocation) —
+*   the invocation flavor lives in {@link WorkflowCanvasCallKind}
+* - Structural control flow: `code-block` · `decision` · `merge` · `loop` ·
+*   `parallel` (group containers) · `loop-start` (the group body's entry marker,
+*   shared by loop + parallel)
+* - Upstream of entry: `trigger-source` (one per manifest trigger attachment)
+*
+* `Promise.all([...])` is modeled as a `parallel` group container: the branches
+* are stacked inside and the container itself is the single prong leaving the
+* wrapper (there is no separate fork/join pair).
+*
+* `exit` and `error` are both terminals: a `return` flows to the shared `exit`
+* (the workflow output), while a `throw` gets its own `error` terminal off the
+* branch so guard clauses (`if (bad) throw …`) read as a visible dead-end.
+*/
+const WorkflowCanvasNodeTypeSchema = z.enum([
+	"entry",
+	"exit",
+	"error",
+	"step",
+	"code-block",
+	"decision",
+	"merge",
+	"loop",
+	"parallel",
+	"loop-start",
+	"trigger-source"
+]);
+z.enum([
+	"workflow-step",
+	"agent",
+	"llm",
+	"wait",
+	"hook",
+	"tool",
+	"child-workflow"
+]);
+/** A labeled branch output on a decision-style node. */
+const WorkflowCanvasNodeOutputSchema = z.object({
+	id: z.string(),
+	label: z.string()
+});
+/**
+* One token of a step's call-site argument value as captured by the producer.
+*
+* Raw form, one per source-expression shape so the inspector can render each
+* distinctly instead of dumping raw text:
+* - `text` — a literal value (string/number/boolean) or inert template chunk.
+* - `reference` — an upstream node output; carries only the structural
+*   `sourceNodeId` + `field` (the human `sourceLabel` is filled by the platform
+*   metadata join).
+* - `variable` — a code identifier / property access that isn't an upstream
+*   reference (e.g. a `const`, a loop variable, `job.id`). `text` is the source
+*   name; the platform may attach a `resolvedValue` for known top-level consts.
+* - `call` — a function call; carries only the callee `name` (e.g.
+*   `buildPrompt`), never the full argument list.
+*/
+const WorkflowCanvasRawValueTokenSchema = z.discriminatedUnion("kind", [
+	z.object({
+		kind: z.literal("text"),
+		text: z.string()
+	}),
+	z.object({
+		kind: z.literal("reference"),
+		/** Upstream node id this value flows from; absent only for unresolved refs. */
+		sourceNodeId: z.string().optional(),
+		/** Output field of the source (dotted path); omitted = the whole output. */
+		field: z.string().optional()
+	}),
+	z.object({
+		kind: z.literal("variable"),
+		text: z.string()
+	}),
+	z.object({
+		kind: z.literal("call"),
+		name: z.string()
+	})
+]);
+/**
+* A step input's configured value at its call site, captured deterministically
+* by the producer from the call's argument object. The platform join turns this
+* into the inspector's {@link WorkflowNodeInputBinding} (filling display labels).
+*/
+const WorkflowCanvasRawBindingSchema = z.object({
+	tokens: z.array(WorkflowCanvasRawValueTokenSchema),
+	/** Render as a tall multi-line box (object/array/multiline template values). */
+	multiline: z.boolean().optional()
+});
+/**
+* Statically-captured `promptLlm` options for an `llm` step node. Literal-only:
+* dynamic/expression values (a computed model, a `system` built by a function) are
+* not captured; `system`/`outputSchema` record presence so the inspector can note
+* "a system prompt is configured" / "structured output" without their values.
+*/
+const WorkflowCanvasLlmOptionsSchema = z.object({
+	model: z.string().optional(),
+	maxTokens: z.number().optional(),
+	temperature: z.number().optional(),
+	thinkingLevel: z.string().optional(),
+	hasSystemPrompt: z.boolean().optional(),
+	hasOutputSchema: z.boolean().optional()
+});
+const WorkflowCanvasNodeDataSchema = z.object({
+	label: z.string(),
+	/** Set on group nodes (loop / parallel section containers). */
+	groupKind: z.enum([
+		"loop",
+		"parallel",
+		"conditional"
+	]).optional(),
+	description: z.string().optional(),
+	/** {@link WorkflowCanvasCallKind} or a looser raw call-site label. */
+	callKind: z.string().optional(),
+	/**
+	* App/integration slug for a `step` whose action/agent is imported directly
+	* from a `@keystrokehq/<app>` package (e.g. "slack", "apollo"). Lets the client
+	* badge the node with that app's logo; absent for custom (project-local)
+	* actions, which fall back to the call-kind icon.
+	*/
+	appSlug: z.string().optional(),
+	/** Cron/webhook/poll discriminator on trigger-source nodes. */
+	triggerType: z.string().optional(),
+	/** Branch outputs (decision nodes). */
+	outputs: z.array(WorkflowCanvasNodeOutputSchema).optional(),
+	/**
+	* Action/agent/workflow slug resolved at deploy time (via import → definition).
+	* Optional when the deploy build cannot resolve source (dist-only artifacts).
+	*/
+	slug: z.string().optional(),
+	/**
+	* Durable call-site ids nested inside an off-grammar `code-block` (same-file only).
+	* Used by the run overlay to light the block when any contained step executes.
+	*/
+	containedCallSiteIds: z.array(z.string()).optional(),
+	/**
+	* Per-input call-site value bindings for `step` nodes, keyed by input field name.
+	* Deterministically captured from the call's argument object; reference tokens point
+	* at the upstream node that produced the value. The platform join fills display labels.
+	*/
+	inputBindings: z.record(z.string(), WorkflowCanvasRawBindingSchema).optional(),
+	/**
+	* Static `promptLlm(prompt, options)` configuration captured at the call site for
+	* `llm` step nodes. Only literal values are captured (model/maxTokens/temperature/
+	* thinkingLevel); `system`/`outputSchema` are usually expressions, so only their
+	* presence is recorded. Absent when no options are statically resolvable.
+	*/
+	llmOptions: WorkflowCanvasLlmOptionsSchema.optional()
+});
+/**
+* A single structural node. This is the deploy artifact's shape: identity
+* (`id`), the canonical discriminator (`nodeType`), display `data`, and group
+* nesting (`parentId`). All layout/rendering — React Flow component key,
+* positions, sizes, `extent`, group box dimensions — is derived entirely
+* client-side from this structure, so it never leaks into the wire contract.
+*/
+const WorkflowCanvasGraphNodeSchema = z.object({
+	id: z.string(),
+	nodeType: WorkflowCanvasNodeTypeSchema,
+	data: WorkflowCanvasNodeDataSchema,
+	/** Set on children nested inside a group (loop / parallel) container. */
+	parentId: z.string().optional()
+});
+const WorkflowCanvasEdgeSchema = z.object({
+	id: z.string(),
+	source: z.string(),
+	target: z.string(),
+	type: z.string().optional(),
+	label: z.string().optional(),
+	sourceHandle: z.string().optional(),
+	targetHandle: z.string().optional(),
+	data: z.object({ branchKind: z.enum([
+		"then",
+		"else",
+		"parallel-branch",
+		"error"
+	]).optional() }).optional()
+});
+/** A statically-evaluable top-level `const` value (literal scalars only). */
+const WorkflowCanvasConstantValueSchema = z.union([
+	z.string(),
+	z.number(),
+	z.boolean()
+]);
+/**
+* Top-level `const NAME = <literal>` declarations in the workflow source, captured
+* at deploy. Lets the platform resolve `variable` value tokens (e.g. a `model` set
+* to a named const) to their concrete value for display. Scalars only — computed,
+* function-local, or non-literal consts are intentionally omitted.
+*/
+const WorkflowCanvasConstantsSchema = z.record(z.string(), WorkflowCanvasConstantValueSchema);
+const WorkflowCanvasGraphSchema = z.object({
+	nodes: z.array(WorkflowCanvasGraphNodeSchema),
+	edges: z.array(WorkflowCanvasEdgeSchema),
+	/** Top-level literal constants from the workflow source (for value-token resolution). */
+	constants: WorkflowCanvasConstantsSchema.optional()
+});
+/**
+* Deploy-time summary of one credential a step requires, derived from the
+* action/agent-tool definition's `.credentials`. The workflow-canvas credential
+* overlay joins a step node's `slug` to these to resolve the bound instance.
+* `key` doubles as the app slug (matches `credential_instances.app_slug`).
+*/
+const CredentialRequirementSummarySchema = z.object({
+	key: z.string(),
+	kind: CredentialAuthKindSchema,
+	/** Scope pinned via `.scope(...)`; absent means project-default → org-default. */
+	scope: CredentialScopeTypeSchema.optional()
+});
 const StoredRouteManifestSkillSchema = z.object({
 	slug: z.string(),
-	name: z.string().optional(),
-	description: z.string().optional(),
+	name: requiredDisplayTextSchema,
+	description: requiredDisplayTextSchema,
 	moduleFile: z.string()
 });
 const attachmentSchemasSchema = z.record(z.string(), z.object({
@@ -8310,8 +9068,8 @@ const attachmentSchemasSchema = z.record(z.string(), z.object({
 	filterSchema: z.record(z.string(), z.unknown()).optional()
 }));
 const attachmentMetaSchema = z.record(z.string(), z.object({
-	name: z.string().optional(),
-	description: z.string().optional()
+	name: requiredDisplayTextSchema,
+	description: requiredDisplayTextSchema
 }));
 const storedRouteManifestEntryV2Schema = z.discriminatedUnion("kind", [
 	z.object({ kind: z.literal("health") }),
@@ -8319,23 +9077,43 @@ const storedRouteManifestEntryV2Schema = z.discriminatedUnion("kind", [
 		kind: z.literal("agent"),
 		slug: z.string(),
 		moduleFile: z.string(),
-		name: z.string().optional(),
-		description: z.string().optional(),
+		name: requiredDisplayTextSchema,
+		description: requiredDisplayTextSchema,
 		model: z.string(),
 		systemPrompt: z.string(),
 		toolCount: z.number().int().nonnegative(),
 		credentialCount: z.number().int().nonnegative(),
 		appSlugs: z.array(z.string()).default([]),
-		toolSlugs: z.array(z.string()).default([])
+		toolSlugs: z.array(z.string()).default([]),
+		/** Credential requirements per tool slug (the agent's credential consumer key). */
+		toolRequirements: z.record(z.string(), z.array(CredentialRequirementSummarySchema)).optional()
+	}),
+	z.object({
+		kind: z.literal("action"),
+		slug: z.string(),
+		name: requiredDisplayTextSchema,
+		description: requiredDisplayTextSchema,
+		moduleFile: z.string(),
+		/** App slug for actions imported from an integration package (`@keystrokehq/<app>/actions`). */
+		appSlug: z.string().optional(),
+		inputSchema: z.record(z.string(), z.unknown()),
+		outputSchema: z.record(z.string(), z.unknown()),
+		/** Credentials this action requires (for the canvas credential overlay). */
+		requirements: z.array(CredentialRequirementSummarySchema).optional()
 	}),
 	z.object({
 		kind: z.literal("workflow"),
 		slug: z.string(),
-		name: z.string().optional(),
-		description: z.string().optional(),
+		name: requiredDisplayTextSchema,
+		description: requiredDisplayTextSchema,
 		subscribable: z.boolean(),
 		moduleFile: z.string(),
-		requestSchema: z.record(z.string(), z.unknown())
+		requestSchema: z.record(z.string(), z.unknown()),
+		responseSchema: z.record(z.string(), z.unknown()).optional(),
+		/** Deterministic AST control-flow skeleton (deploy-time producer). */
+		flowGraph: WorkflowCanvasGraphSchema.optional(),
+		/** sha256 of the workflow source the `flowGraph` was produced from (staleness). */
+		flowGraphSourceHash: z.string().optional()
 	}),
 	z.object({
 		kind: z.literal("trigger-webhook"),
@@ -8354,8 +9132,8 @@ const storedRouteManifestEntryV2Schema = z.discriminatedUnion("kind", [
 		moduleFile: z.string(),
 		sourceHash: z.string().optional(),
 		schedule: z.string(),
-		name: z.string().optional(),
-		description: z.string().optional()
+		name: requiredDisplayTextSchema,
+		description: requiredDisplayTextSchema
 	}),
 	z.object({
 		kind: z.literal("trigger-poll-group"),
@@ -8371,8 +9149,8 @@ const storedRouteManifestEntryV2Schema = z.discriminatedUnion("kind", [
 		moduleFile: z.string(),
 		sourceHash: z.string().optional(),
 		schedule: z.string(),
-		name: z.string().optional(),
-		description: z.string().optional()
+		name: requiredDisplayTextSchema,
+		description: requiredDisplayTextSchema
 	})
 ]);
 const storedRouteManifestV2Schema = z.object({
@@ -8381,165 +9159,14 @@ const storedRouteManifestV2Schema = z.object({
 	skills: z.array(StoredRouteManifestSkillSchema).default([]),
 	integrations: z.array(z.string()).optional()
 });
-const DERIVED_ENTRY_KINDS = new Set([
-	"agent-sessions-list",
-	"agent-session-detail",
-	"workflow-runs-list",
-	"workflow-run-detail",
-	"trigger-runs-list",
-	"trigger-run-detail"
-]);
-function webhookEndpointFromPath(path) {
-	return path.replace(/^\/triggers\//, "").replace(/^\/+|\/+$/g, "");
-}
-function legacyAgentAppSlugs(entry) {
-	if (Array.isArray(entry.appSlugs)) return entry.appSlugs;
-	if (Array.isArray(entry.credentialSlugs)) return entry.credentialSlugs;
-	if (Array.isArray(entry.credentialKeys)) return entry.credentialKeys;
-	return [];
-}
-/** TODO remove after all artifacts rebuilt — upcasts legacy v1 manifests to v2. */
-function normalizeEntryToV2(entry) {
-	const kind = entry.kind;
-	if (typeof kind !== "string") return null;
-	if (DERIVED_ENTRY_KINDS.has(kind) || kind === "plugin") return null;
-	if (kind === "health") return { kind: "health" };
-	if (kind === "agent") {
-		const slug = typeof entry.slug === "string" ? entry.slug : typeof entry.agentSlug === "string" ? entry.agentSlug : void 0;
-		if (!slug || typeof entry.moduleFile !== "string") return null;
-		return {
-			kind: "agent",
-			slug,
-			moduleFile: entry.moduleFile,
-			...typeof entry.name === "string" ? { name: entry.name } : {},
-			...typeof entry.description === "string" ? { description: entry.description } : {},
-			model: typeof entry.model === "string" ? entry.model : "",
-			systemPrompt: typeof entry.systemPrompt === "string" ? entry.systemPrompt : "",
-			toolCount: typeof entry.toolCount === "number" ? entry.toolCount : 0,
-			credentialCount: typeof entry.credentialCount === "number" ? entry.credentialCount : 0,
-			appSlugs: legacyAgentAppSlugs(entry),
-			toolSlugs: Array.isArray(entry.toolSlugs) ? entry.toolSlugs : []
-		};
-	}
-	if (kind === "workflow") {
-		const slug = typeof entry.slug === "string" ? entry.slug : typeof entry.workflowSlug === "string" ? entry.workflowSlug : void 0;
-		if (!slug || typeof entry.moduleFile !== "string") return null;
-		const name = typeof entry.name === "string" ? entry.name : typeof entry.workflowName === "string" ? entry.workflowName : void 0;
-		return {
-			kind: "workflow",
-			slug,
-			moduleFile: entry.moduleFile,
-			...name ? { name } : {},
-			...typeof entry.description === "string" ? { description: entry.description } : {},
-			subscribable: entry.subscribable === true,
-			requestSchema: entry.requestSchema && typeof entry.requestSchema === "object" ? entry.requestSchema : {}
-		};
-	}
-	if (kind === "trigger-webhook") {
-		if (typeof entry.moduleFile !== "string" || !Array.isArray(entry.attachmentIds)) return null;
-		const endpoint = typeof entry.endpoint === "string" ? entry.endpoint : typeof entry.path === "string" ? webhookEndpointFromPath(entry.path) : void 0;
-		if (!endpoint) return null;
-		return {
-			kind: "trigger-webhook",
-			endpoint,
-			attachmentIds: entry.attachmentIds,
-			moduleFile: entry.moduleFile,
-			...typeof entry.sourceHash === "string" ? { sourceHash: entry.sourceHash } : {},
-			attachmentSchemas: entry.attachmentSchemas && typeof entry.attachmentSchemas === "object" ? entry.attachmentSchemas : {},
-			...entry.attachmentMeta && typeof entry.attachmentMeta === "object" ? { attachmentMeta: entry.attachmentMeta } : {}
-		};
-	}
-	if (kind === "trigger-poll") {
-		if (typeof entry.attachmentId !== "string" || typeof entry.moduleFile !== "string" || typeof entry.schedule !== "string") return null;
-		return {
-			kind: "trigger-poll",
-			attachmentId: entry.attachmentId,
-			attachmentIds: Array.isArray(entry.attachmentIds) ? entry.attachmentIds : [entry.attachmentId],
-			moduleFile: entry.moduleFile,
-			...typeof entry.sourceHash === "string" ? { sourceHash: entry.sourceHash } : {},
-			schedule: entry.schedule,
-			...typeof entry.name === "string" ? { name: entry.name } : {},
-			...typeof entry.description === "string" ? { description: entry.description } : {}
-		};
-	}
-	if (kind === "trigger-poll-group") {
-		if (typeof entry.pollId !== "string" || typeof entry.moduleFile !== "string" || typeof entry.schedule !== "string" || !Array.isArray(entry.attachmentIds)) return null;
-		return {
-			kind: "trigger-poll-group",
-			pollId: entry.pollId,
-			attachmentIds: entry.attachmentIds,
-			moduleFile: entry.moduleFile,
-			schedule: entry.schedule
-		};
-	}
-	if (kind === "cron-schedule") {
-		if (typeof entry.attachmentId !== "string" || typeof entry.moduleFile !== "string" || typeof entry.schedule !== "string") return null;
-		return {
-			kind: "cron-schedule",
-			attachmentId: entry.attachmentId,
-			attachmentIds: Array.isArray(entry.attachmentIds) ? entry.attachmentIds : [entry.attachmentId],
-			moduleFile: entry.moduleFile,
-			...typeof entry.sourceHash === "string" ? { sourceHash: entry.sourceHash } : {},
-			schedule: entry.schedule,
-			...typeof entry.name === "string" ? { name: entry.name } : {},
-			...typeof entry.description === "string" ? { description: entry.description } : {}
-		};
-	}
-	return null;
-}
-/** TODO remove after all artifacts rebuilt — upcasts legacy v1 manifests to v2. */
-function normalizeV2ManifestInput(value) {
-	if (!value || typeof value !== "object") return value;
-	const raw = value;
-	if (raw.version !== 2 || !Array.isArray(raw.entries)) return value;
-	return {
-		...raw,
-		entries: raw.entries.map((entry) => {
-			if (!entry || typeof entry !== "object") return entry;
-			const kind = entry.kind;
-			if (kind === "trigger-poll" || kind === "cron-schedule" || kind === "trigger-webhook" || kind === "trigger-poll-group") {
-				const trigger = entry;
-				if (Array.isArray(trigger.attachmentIds)) return entry;
-				return {
-					...trigger,
-					attachmentIds: typeof trigger.attachmentId === "string" ? [trigger.attachmentId] : []
-				};
-			}
-			if (kind !== "agent") return entry;
-			const agent = entry;
-			if (Array.isArray(agent.appSlugs)) return entry;
-			const appSlugs = legacyAgentAppSlugs(agent);
-			if (appSlugs.length === 0) return entry;
-			const { credentialKeys: _credentialKeys, credentialSlugs: _credentialSlugs, ...rest } = agent;
-			return {
-				...rest,
-				appSlugs,
-				toolSlugs: Array.isArray(agent.toolSlugs) ? agent.toolSlugs : []
-			};
-		})
-	};
-}
-/** TODO remove after all artifacts rebuilt — upcasts legacy v1 manifests to v2. */
-function normalizeStoredRouteManifestToV2(value) {
-	if (!value || typeof value !== "object") throw new Error("Invalid route manifest");
-	const raw = value;
-	if (raw.version === 2) return storedRouteManifestV2Schema.parse(normalizeV2ManifestInput(value));
-	const entriesRaw = Array.isArray(raw.entries) ? raw.entries : [];
-	const entries = [];
-	for (const entry of entriesRaw) {
-		if (!entry || typeof entry !== "object") continue;
-		const normalized = normalizeEntryToV2(entry);
-		if (normalized) entries.push(normalized);
-	}
-	return storedRouteManifestV2Schema.parse({
-		version: 2,
-		entries,
-		skills: raw.skills ?? [],
-		integrations: raw.integrations
-	});
-}
+/**
+* Parse a stored route manifest. Only the strict v2 schema is supported: the
+* builder always emits v2 and every deploy regenerates the manifest, so there is
+* no legacy upcasting. (The pre-v2 `normalizeEntryToV2` path was removed once the
+* data tables were truncated and all artifacts redeployed.)
+*/
 function parseStoredRouteManifest(value) {
-	return normalizeStoredRouteManifestToV2(value);
+	return storedRouteManifestV2Schema.parse(value);
 }
 /** Messaging platforms that support agent gateway bindings. */
 const ChannelPlatformKeySchema = z.enum(["slack"]);
@@ -9298,24 +9925,6 @@ function parseAppSlug(slug) {
 		slug: trimmed
 	};
 }
-/** How a credential instance is stored (`credential_instances.auth_kind`). */
-const CredentialAuthKindSchema = z.enum([
-	"api_key",
-	"oauth_managed",
-	"keystroke"
-]);
-/**
-* Where a credential instance is stored (`credential_instances.scope_type`), and the only thing an
-* action/tool can pin via `.scope(...)`. There is no resolution chain: when no scope is pinned, the
-* resolver tries the project default, then the org default, then throws.
-*/
-const CredentialScopeTypeSchema = z.enum([
-	"organization",
-	"project",
-	"user"
-]);
-CredentialAuthKindSchema.options;
-CredentialScopeTypeSchema.options;
 /** Human-readable app name from a credential slug (e.g. `google-drive` → `Google Drive`). */
 function displayCredentialAppName(appId) {
 	return appId.split(/[-_]+/).filter(Boolean).map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
@@ -10410,7 +11019,7 @@ const WorkspaceTriggerSummarySchema = z.object({
 	id: z.string(),
 	slug: z.string(),
 	name: z.string(),
-	description: z.string().nullable(),
+	description: z.string().min(1),
 	type: TriggerTypeSchema,
 	status: TriggerStatusSchema,
 	projectId: z.string(),
@@ -10836,7 +11445,7 @@ const AgentSummarySchema = z.object({
 	name: z.string().min(1),
 	projectId: z.string().min(1),
 	updatedAt: z.string().min(1),
-	description: z.string().optional(),
+	description: z.string().min(1),
 	sourcePath: z.string().min(1).optional(),
 	model: z.string().optional(),
 	capabilities: z.object({
@@ -10858,7 +11467,7 @@ const WorkflowSummarySchema = z.object({
 	name: z.string().min(1),
 	projectId: z.string().min(1),
 	updatedAt: z.string().min(1),
-	description: z.string().optional(),
+	description: z.string().min(1),
 	sourcePath: z.string().min(1).optional(),
 	lastRunAt: optionalTimestamp
 });
@@ -10868,7 +11477,7 @@ const SkillSummarySchema = z.object({
 	name: z.string().min(1),
 	projectId: z.string().min(1),
 	updatedAt: z.string().min(1),
-	description: z.string().optional(),
+	description: z.string().min(1),
 	sourcePath: z.string().min(1).optional()
 });
 const AgentSummaryListResponseSchema = z.array(AgentSummarySchema);
@@ -11010,6 +11619,366 @@ const ListAgentWorkspaceFilesResponseSchema = z.object({ files: z.array(AgentWor
 function agentWorkspaceFileId(path) {
 	return projectFileId(path);
 }
+/** Whether the overview is still being produced or finished. */
+const WorkflowOverviewStatusSchema = z.enum(["generating", "ready"]);
+/** One phase of the guided-tour overview. */
+const WorkflowPhaseSchema = z.object({
+	id: z.string(),
+	title: z.string(),
+	copy: z.string(),
+	nodeIds: z.array(z.string())
+});
+/** LLM-generated overview envelope. */
+const WorkspaceWorkflowOverviewSchema = z.object({
+	status: WorkflowOverviewStatusSchema,
+	summary: z.string(),
+	phases: z.array(WorkflowPhaseSchema),
+	hash: z.string(),
+	generatedAt: z.string().nullable(),
+	model: z.string()
+});
+/** Subset of JSON-Schema field types the dashboard form renders inline. */
+const WorkflowInputFieldTypeSchema = z.enum([
+	"string",
+	"number",
+	"boolean",
+	"enum",
+	"object",
+	"array"
+]);
+const WorkflowInputFieldSchema = z.lazy(() => z.object({
+	key: z.string(),
+	label: z.string(),
+	type: WorkflowInputFieldTypeSchema,
+	required: z.boolean(),
+	description: z.string().optional(),
+	placeholder: z.string().optional(),
+	options: z.array(z.string()).optional(),
+	default: z.union([
+		z.string(),
+		z.number(),
+		z.boolean()
+	]).optional(),
+	children: z.array(WorkflowInputFieldSchema).optional(),
+	format: z.string().optional()
+}));
+/** Flat, render-ready view of a workflow's input schema. */
+const WorkflowInputSchemaSchema = z.object({ fields: z.array(WorkflowInputFieldSchema) });
+/** A workflow's run-input contract plus its persisted values. */
+const WorkflowRunInputsSchema = z.object({
+	schema: WorkflowInputSchemaSchema,
+	values: z.record(z.string(), z.unknown()).nullable()
+});
+z.object({ runId: z.string() });
+/** Annotation lifecycle: "generating" while the LLM pass streams in, then "ready". */
+const WorkflowCanvasStatusSchema = z.enum(["generating", "ready"]);
+/** LLM-produced enrichment for a single skeleton node. */
+const WorkflowCanvasAnnotationSchema = z.object({
+	label: z.string().optional(),
+	description: z.string().optional()
+});
+/**
+* One token of a configured input value (inspector form). Mirrors the producer's
+* raw token kinds, with display fields filled by the platform join: `reference`
+* gains a human `sourceLabel`; `variable` may gain a `resolvedValue` when the name
+* matches a known top-level constant.
+*/
+const WorkflowNodeValueTokenSchema = z.discriminatedUnion("kind", [
+	z.object({
+		kind: z.literal("text"),
+		text: z.string()
+	}),
+	z.object({
+		kind: z.literal("reference"),
+		sourceNodeId: z.string().optional(),
+		sourceLabel: z.string(),
+		field: z.string().optional()
+	}),
+	z.object({
+		kind: z.literal("variable"),
+		text: z.string(),
+		/** Concrete value when `text` resolves to a top-level literal constant. */
+		resolvedValue: z.string().optional()
+	}),
+	z.object({
+		kind: z.literal("call"),
+		name: z.string()
+	})
+]);
+/** The configured value of one input at this call site. */
+const WorkflowNodeInputBindingSchema = z.object({
+	tokens: z.array(WorkflowNodeValueTokenSchema),
+	multiline: z.boolean().optional()
+});
+/** An inspector input with optional call-site binding. */
+const WorkflowCanvasNodeInputSchema = WorkflowInputFieldSchema.and(z.object({
+	binding: WorkflowNodeInputBindingSchema.optional(),
+	additional: z.boolean().optional()
+}));
+/** Authored, deterministic metadata for a single node. */
+const WorkflowCanvasNodeMetaSchema = z.object({
+	kind: z.enum([
+		"action",
+		"agent",
+		"workflow",
+		"llm",
+		"trigger",
+		"boundary"
+	]),
+	slug: z.string(),
+	name: z.string(),
+	description: z.string().optional(),
+	appSlug: z.string().optional(),
+	inputs: z.array(WorkflowCanvasNodeInputSchema),
+	outputs: z.array(WorkflowInputFieldSchema),
+	requiredApps: z.array(z.string()).optional(),
+	model: z.string().optional(),
+	toolCount: z.number().int().nonnegative().optional()
+});
+/** The workflow canvas envelope. */
+const WorkflowCanvasSchema = z.object({
+	graph: WorkflowCanvasGraphSchema,
+	nodeMetadata: z.record(z.string(), WorkflowCanvasNodeMetaSchema),
+	annotations: z.record(z.string(), WorkflowCanvasAnnotationSchema),
+	status: WorkflowCanvasStatusSchema,
+	hash: z.string(),
+	generatedAt: z.string().nullable(),
+	model: z.string()
+});
+/** Per-node execution state for a single run. */
+const WorkflowCanvasNodeRunStatusSchema = z.enum([
+	"pending",
+	"running",
+	"succeeded",
+	"failed",
+	"skipped"
+]);
+const WorkflowCanvasNodeRunStateSchema = z.object({
+	status: WorkflowCanvasNodeRunStatusSchema,
+	iteration: z.object({
+		index: z.number().int().nonnegative(),
+		total: z.number().int().nonnegative()
+	}).optional()
+});
+/** Overall lifecycle of a run as the canvas animates it. */
+const WorkflowCanvasRunStatusSchema = z.enum([
+	"running",
+	"succeeded",
+	"failed",
+	"canceled"
+]);
+/** A run projected onto the canvas. */
+const WorkflowCanvasRunSchema = z.object({
+	runId: z.string(),
+	status: WorkflowCanvasRunStatusSchema,
+	startedAt: z.string(),
+	finishedAt: z.string().nullable(),
+	nodeStates: z.record(z.string(), WorkflowCanvasNodeRunStateSchema)
+});
+/** Scope a credential instance lives in. */
+const WorkflowCredentialScopeSchema = z.enum([
+	"organization",
+	"project",
+	"user"
+]);
+/** The concrete credential instance a binding currently resolves to. */
+const WorkflowResolvedCredentialSchema = z.object({
+	id: z.string(),
+	name: z.string(),
+	scope: WorkflowCredentialScopeSchema,
+	appSlug: z.string().optional(),
+	isDefault: z.boolean().optional(),
+	projectId: z.string().optional(),
+	projectName: z.string().optional()
+});
+/** Default model for the gated code-block annotation pass — cheap, same as trigger overviews. */
+const DEFAULT_WORKFLOW_CANVAS_MODEL = "deepseek/deepseek-v4-flash";
+z.record(z.string(), WorkflowCanvasAnnotationSchema);
+/** One opaque code-block the annotation pass should label, keyed by its canvas node id. */
+const WorkflowCanvasAnnotationCodeBlockSchema = z.object({
+	nodeId: z.string(),
+	/** The raw source snippet (the node's label) the LLM turns into human copy. */
+	source: z.string()
+});
+/** Inputs the worker feeds the LLM for the gated code-block annotation pass. */
+const WorkflowCanvasAnnotationsInputSchema = z.object({
+	workflowName: z.string(),
+	workflowDescription: z.string().nullable(),
+	codeBlocks: z.array(WorkflowCanvasAnnotationCodeBlockSchema)
+});
+z.object({
+	workflowId: z.string(),
+	projectId: z.string(),
+	hash: z.string(),
+	model: z.string(),
+	input: WorkflowCanvasAnnotationsInputSchema
+});
+/** Default model for the workflow overview pass — cheap, same as the annotation/trigger passes. */
+const DEFAULT_WORKFLOW_OVERVIEW_MODEL = "deepseek/deepseek-v4-flash";
+/** One node as the overview LLM sees it (derived from the canvas node metadata + graph). */
+const WorkflowOverviewNodeSchema = z.object({
+	nodeId: z.string(),
+	label: z.string(),
+	kind: z.string(),
+	description: z.string().optional(),
+	/** App/integration slug for steps imported from a `@keystrokehq/<app>` package. */
+	appSlug: z.string().optional(),
+	/** Authored input field keys (from the action/agent/workflow definition). */
+	inputs: z.array(z.string()).optional(),
+	/** Authored output field keys. */
+	outputs: z.array(z.string()).optional(),
+	/** Agent-only: the model the agent runs on. */
+	model: z.string().optional(),
+	/** Agent-only: number of tools available to the agent. */
+	toolCount: z.number().int().nonnegative().optional()
+});
+/** Inputs the worker feeds the LLM to produce the workflow overview (summary + phases). */
+const WorkflowOverviewInputSchema = z.object({
+	workflowName: z.string(),
+	workflowDescription: z.string().nullable(),
+	/** Display labels of the trigger sources upstream of the workflow (read-only context). */
+	triggers: z.array(z.string()),
+	nodes: z.array(WorkflowOverviewNodeSchema),
+	/** The workflow's TypeScript source (best-effort; null when the deploy has no source snapshot). */
+	source: z.string().nullable()
+});
+z.object({
+	workflowId: z.string(),
+	projectId: z.string(),
+	hash: z.string(),
+	model: z.string(),
+	input: WorkflowOverviewInputSchema
+});
+const WorkflowCanvasCredentialBindingBaseSchema = z.object({
+	credentialKey: z.string(),
+	label: z.string(),
+	appSlug: z.string().optional()
+});
+/** How one credential requirement on a step currently resolves. */
+const WorkflowCanvasCredentialBindingSchema = z.union([
+	WorkflowCanvasCredentialBindingBaseSchema.extend({
+		policy: z.enum([
+			"project-default",
+			"org-default",
+			"assigned"
+		]),
+		instance: WorkflowResolvedCredentialSchema
+	}),
+	WorkflowCanvasCredentialBindingBaseSchema.extend({
+		policy: z.literal("scope-pinned"),
+		pinnedScope: WorkflowCredentialScopeSchema,
+		instance: WorkflowResolvedCredentialSchema
+	}),
+	WorkflowCanvasCredentialBindingBaseSchema.extend({
+		policy: z.literal("unresolved"),
+		reason: z.enum(["needs-selection", "missing"]),
+		pinnedScope: WorkflowCredentialScopeSchema.optional()
+	})
+]);
+/** Live credential overlay: canvas node id → its step's credential bindings. */
+const WorkflowCanvasCredentialBindingsSchema = z.record(z.string(), z.array(WorkflowCanvasCredentialBindingSchema));
+function isObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function titleCaseKey(key) {
+	return key.replace(/([a-z0-9])([A-Z])/g, "$1 $2").split(/[-_/]+/).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
+}
+function normalizeFieldType(schema) {
+	const rawType = schema.type;
+	if (Array.isArray(rawType)) {
+		const primary = rawType.find((entry) => entry !== "null");
+		if (typeof primary === "string") return normalizeFieldType({
+			...schema,
+			type: primary
+		});
+		return null;
+	}
+	if (typeof rawType !== "string") return null;
+	if (Array.isArray(schema.enum) && schema.enum.every((entry) => typeof entry === "string")) return "enum";
+	switch (rawType) {
+		case "string":
+		case "number":
+		case "integer": return rawType === "integer" ? "number" : rawType;
+		case "boolean": return "boolean";
+		case "object": return "object";
+		case "array": return "array";
+		default: return null;
+	}
+}
+function normalizeField(key, schema, required) {
+	const type = normalizeFieldType(schema);
+	if (!type) return null;
+	const field = {
+		key,
+		label: typeof schema.title === "string" ? schema.title : titleCaseKey(key),
+		type,
+		required,
+		...typeof schema.description === "string" ? { description: schema.description } : {},
+		...typeof schema.format === "string" ? { format: schema.format } : {}
+	};
+	if (type === "enum" && Array.isArray(schema.enum)) field.options = schema.enum.filter((entry) => typeof entry === "string");
+	if (schema.default !== void 0 && (typeof schema.default === "string" || typeof schema.default === "number" || typeof schema.default === "boolean")) field.default = schema.default;
+	if (type === "object" && isObject(schema.properties)) {
+		const childRequired = Array.isArray(schema.required) ? schema.required.filter((entry) => typeof entry === "string") : [];
+		field.children = Object.entries(schema.properties).flatMap(([childKey, childSchema]) => {
+			if (!isObject(childSchema)) return [];
+			const child = normalizeField(childKey, childSchema, childRequired.includes(childKey));
+			return child ? [child] : [];
+		});
+	}
+	if (type === "array" && isObject(schema.items)) {
+		const item = normalizeField("item", schema.items, false);
+		if (item) field.children = [item];
+	}
+	return field;
+}
+/** Normalize a workflow manifest JSON Schema into the dashboard run-input form shape. */
+function jsonSchemaToWorkflowInputSchema(requestSchema) {
+	if (!isObject(requestSchema)) return { fields: [] };
+	const properties = isObject(requestSchema.properties) ? requestSchema.properties : {};
+	const required = Array.isArray(requestSchema.required) ? requestSchema.required.filter((entry) => typeof entry === "string") : [];
+	return { fields: Object.entries(properties).flatMap(([key, propertySchema]) => {
+		if (!isObject(propertySchema)) return [];
+		const field = normalizeField(key, propertySchema, required.includes(key));
+		return field ? [field] : [];
+	}) };
+}
+function isEmpty(value) {
+	return value === void 0 || value === null || value === "";
+}
+function validateFieldValue(field, value) {
+	if (field.required && isEmpty(value)) return "Required";
+	if (isEmpty(value)) return null;
+	switch (field.type) {
+		case "number":
+			if (typeof value !== "number" && Number.isNaN(Number(value))) return "Must be a number";
+			return null;
+		case "boolean":
+			if (typeof value !== "boolean") return "Must be a boolean";
+			return null;
+		case "enum":
+			if (typeof value !== "string" || field.options && !field.options.includes(value)) return "Invalid option";
+			return null;
+		default: return null;
+	}
+}
+/** Validate a run-input payload against the normalized schema (authoritative on save). */
+function validateWorkflowRunInputValues(schema, values) {
+	const allowedKeys = new Set(schema.fields.map((field) => field.key));
+	for (const key of Object.keys(values)) if (!allowedKeys.has(key)) return {
+		ok: false,
+		error: `Unknown field "${key}"`
+	};
+	for (const field of schema.fields) {
+		const message = validateFieldValue(field, values[field.key]);
+		if (message) return {
+			ok: false,
+			error: `${field.key}: ${message}`
+		};
+	}
+	return { ok: true };
+}
+const WorkflowRunInputsPutBodySchema = z.record(z.string(), z.unknown());
 function mapOrganization(row) {
 	return OrganizationSchema.parse({
 		id: row.id,
@@ -11110,8 +12079,8 @@ function mapProjectDeployment(row) {
 const zodSchema$2 = z.custom((v) => v instanceof z.ZodType, "must be a Zod schema");
 z.object({
 	slug: z.string().trim().min(1),
-	name: z.string().optional(),
-	description: z.string().optional(),
+	name: requiredDisplayTextSchema,
+	description: requiredDisplayTextSchema,
 	input: zodSchema$2,
 	output: zodSchema$2,
 	credentials: z.array(credentialInputSchema).optional(),
@@ -11131,6 +12100,26 @@ function registerWorkflowRunGetter(fn) {
 }
 new AsyncLocalStorage();
 //#endregion
+//#region ../../packages/credentials/dist/store-4At2Wnk9.mjs
+function normalizeRow(row) {
+	const { projectId: _projectId, ...rest } = row;
+	return rest;
+}
+async function listCredentialAssignmentsByTarget$1(options) {
+	return (await listCredentialAssignmentsByTarget(options)).map(normalizeRow);
+}
+function normalizeLocalRow(row) {
+	const { projectId: _projectId, ...rest } = row;
+	return rest;
+}
+async function selectCredentialInstanceById$1(id) {
+	const row = await selectCredentialInstanceById(id);
+	return row ? normalizeLocalRow(row) : void 0;
+}
+async function selectCredentialInstancesForScope$1(appSlug, scopeType, scopeId) {
+	return (await selectCredentialInstancesForScope(appSlug, scopeType, scopeId)).map(normalizeLocalRow);
+}
+//#endregion
 //#region ../../packages/secrets/dist/index.mjs
 const ALGORITHM = "aes-256-gcm";
 const IV_LENGTH = 12;
@@ -29532,6 +30521,130 @@ var import_dist$1 = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exp
 	exports.visit = visit.visit;
 	exports.visitAsync = visit.visitAsync;
 })))(), 1);
+const EMPTY_ASSIGNMENT_SET = {
+	byConsumer: {},
+	wildcard: {}
+};
+function selectAssignedInstanceId(assignments, consumerId, credentialSlug) {
+	if (!assignments) return;
+	if (consumerId) {
+		const specific = assignments.byConsumer[consumerId]?.[credentialSlug];
+		if (specific) return specific;
+	}
+	return assignments.wildcard[credentialSlug];
+}
+function buildAssignmentSet(rows) {
+	const byConsumer = {};
+	const wildcard = {};
+	for (const row of rows) {
+		if (row.consumerId === "*") {
+			wildcard[row.credentialSlug] = row.instanceId;
+			continue;
+		}
+		const bucket = byConsumer[row.consumerId] ?? {};
+		bucket[row.credentialSlug] = row.instanceId;
+		byConsumer[row.consumerId] = bucket;
+	}
+	return {
+		byConsumer,
+		wildcard
+	};
+}
+async function loadCredentialAssignments(options) {
+	if (!isDatabaseInitialized()) return EMPTY_ASSIGNMENT_SET;
+	return buildAssignmentSet(await listCredentialAssignmentsByTarget$1(options));
+}
+async function withCredentialAssignments(context, options) {
+	const assignments = await loadCredentialAssignments(options);
+	return {
+		...context,
+		assignments
+	};
+}
+function toSummary(row) {
+	return {
+		id: row.id,
+		appSlug: row.appSlug,
+		name: row.name,
+		label: row.label,
+		scopeType: row.scopeType,
+		scopeId: row.scopeId,
+		isDefault: row.isDefault
+	};
+}
+/** Pick the single instance for a scope: the only one, or the unique default; else ambiguous. */
+function pickInstance$1(rows) {
+	if (rows.length === 0) return { kind: "none" };
+	if (rows.length === 1) return {
+		kind: "row",
+		row: rows[0]
+	};
+	const defaults = rows.filter((row) => row.isDefault);
+	if (defaults.length === 1) return {
+		kind: "row",
+		row: defaults[0]
+	};
+	return { kind: "needs-selection" };
+}
+function scopeIdFor(scope, context, orgId) {
+	switch (scope) {
+		case "organization": return orgId;
+		case "project": return context.projectId;
+		case "user": return context.userId;
+	}
+}
+async function describeCredentialBinding(options) {
+	const { key, scope, consumerId, context } = options;
+	const orgId = context.orgId ?? getServerTenantScopeId();
+	const assignedId = selectAssignedInstanceId(context.assignments, consumerId, key);
+	if (assignedId) {
+		const row = await selectCredentialInstanceById$1(assignedId);
+		if (row && row.appSlug === key) return {
+			policy: "assigned",
+			row: toSummary(row)
+		};
+	}
+	if (scope) {
+		const scopeId = scopeIdFor(scope, context, orgId);
+		const picked = scopeId ? pickInstance$1(await selectCredentialInstancesForScope$1(key, scope, scopeId)) : { kind: "none" };
+		if (picked.kind === "row") return {
+			policy: "scope-pinned",
+			pinnedScope: scope,
+			row: toSummary(picked.row)
+		};
+		return {
+			policy: "unresolved",
+			reason: picked.kind === "needs-selection" ? "needs-selection" : "missing",
+			pinnedScope: scope
+		};
+	}
+	if (context.projectId) {
+		const picked = pickInstance$1(await selectCredentialInstancesForScope$1(key, "project", context.projectId));
+		if (picked.kind === "row") return {
+			policy: "project-default",
+			row: toSummary(picked.row)
+		};
+		if (picked.kind === "needs-selection") return {
+			policy: "unresolved",
+			reason: "needs-selection"
+		};
+	}
+	if (orgId) {
+		const picked = pickInstance$1(await selectCredentialInstancesForScope$1(key, "organization", orgId));
+		if (picked.kind === "row") return {
+			policy: "org-default",
+			row: toSummary(picked.row)
+		};
+		if (picked.kind === "needs-selection") return {
+			policy: "unresolved",
+			reason: "needs-selection"
+		};
+	}
+	return {
+		policy: "unresolved",
+		reason: "missing"
+	};
+}
 function encodeOAuthState(payload) {
 	return encryptCredentialPayload(JSON.stringify(payload));
 }
@@ -29804,8 +30917,8 @@ const zodSchema$1 = z.custom((v) => v instanceof z.ZodType, "must be a Zod schem
 /** Runtime validation for an unbranded workflow definition. */
 const workflowCoreSchema = z.object({
 	slug: z.string().trim().min(1),
-	name: z.string().optional(),
-	description: z.string().optional(),
+	name: requiredDisplayTextSchema,
+	description: requiredDisplayTextSchema,
 	subscription: z.object({ mode: z.enum(["system", "subscribable"]).optional() }).optional(),
 	input: zodSchema$1,
 	output: zodSchema$1,
@@ -29821,6 +30934,7 @@ function isWorkflow(value) {
 	if (!(WORKFLOW in value) || value[WORKFLOW] !== true) return false;
 	return workflowCoreSchema.safeParse(value).success;
 }
+new AsyncLocalStorage();
 const storage = new AsyncLocalStorage();
 registerWorkflowRunGetter(() => {
 	const store = storage.getStore();
@@ -29883,11 +30997,12 @@ function normalizeLegacySlugFields(value) {
 	return next;
 }
 const slugField = z.string().trim().min(1);
-const optionalTextField = z.string().optional();
+const requiredTextField = z.string().trim().min(1);
+const optionalTextField = z.string().trim().min(1).optional();
 const baseSourceShape = {
 	slug: slugField,
-	name: optionalTextField,
-	description: optionalTextField,
+	name: requiredTextField,
+	description: requiredTextField,
 	attach: z.function()
 };
 const webhookSourceSchema = z.object({
@@ -43623,6 +44738,6 @@ function minioStoragePlugin(options = {}) {
 	};
 }
 //#endregion
-export { CreateProjectArtifactResponseSchema as $, mapProjectMember as $n, ProjectSlugAvailabilityResponseSchema as $t, PublicHttpUrlError as A, UserPreferencesPatchSchema as An, ListProjectMembersResponseSchema as At, AgentSummarySchema as B, agentMemoryFileId as Bn, PROJECT_SLUG_TAKEN_MESSAGE as Bt, defaultSchedulerPlugin as C, UpdateProjectMemberResponseSchema as Cn, ListAppsResponseSchema as Ct, discoverGraphqlApp as D, UploadProjectSourceResponseSchema as Dn, ListOrganizationsResponseSchema as Dt, decodeOAuthState as E, UploadProjectSourceManifestRequestSchema as En, ListOrganizationMembersResponseSchema as Et, AcceptOrganizationInvitationResponseSchema as F, WorkspaceTriggerDetailSchema as Fn, OpenApiDiscoverRequestSchema as Ft, CreateApiKeyRequestSchema as G, displayCredentialAppName as Gn, PresignProjectSourceRequestSchema as Gt, AppSlugAvailabilityQuerySchema as H, buildCredentialInstanceLabel as Hn, PresignChatAttachmentResponseSchema as Ht, ActiveOrganizationResponseSchema as I, WorkspaceTriggerFileSchema as In, OpenApiDiscoverResponseSchema as It, CreateCredentialsResponseSchema as J, mapOrganizationInvitation as Jn, PresignUserAvatarResponseSchema as Jt, CreateApiKeyResponseSchema as K, isAllowedChatAttachmentMediaType as Kn, PresignProjectSourceResponseSchema as Kt, AgentMemoryFileSummarySchema as L, WorkspaceTriggerListResponseSchema as Ln, OrganizationSidebarBrandingPatchSchema as Lt, readCredentialInstanceSecret as M, WorkflowSummaryDetailResponseSchema as Mn, ListProjectsResponseSchema as Mt, setCredentialInstanceSecret as N, WorkflowSummaryListResponseSchema as Nn, McpDiscoverRequestSchema as Nt, discoverMcpApp as O, UserAvatarPatchSchema as On, ListProjectDeploymentsResponseSchema as Ot, ACTIVE_ORG_HEADER as P, WorkflowSummarySchema as Pn, McpDiscoverResponseSchema as Pt, CreateOrganizationResponseSchema as Q, mapProjectDeployment as Qn, ProjectSlugAvailabilityQuerySchema as Qt, AgentSummaryDetailResponseSchema as R, WorkspaceTriggerOverviewSchema as Rn, OrganizationSidebarBrandingSchema as Rt, createJobQueue as S, UpdateProjectMemberRequestSchema as Sn, ListApiKeysResponseSchema as St, completeMcpOAuthConnect as T, UpdateProjectSettingsRequestSchema as Tn, ListOrganizationInvitationsResponseSchema as Tt, AppSlugAvailabilityResponseSchema as U, chatAttachmentExtension as Un, PresignOrgLogoRequestSchema as Ut, AgentWorkspaceFileSummarySchema as V, agentWorkspaceFileId as Vn, PresignChatAttachmentRequestSchema as Vt, CompleteProjectArtifactResponseSchema as W, deriveCredentialInstanceSlug as Wn, PresignOrgLogoResponseSchema as Wt, CreateCustomAppResponseSchema as X, mapProject as Xn, ProjectResponseSchema as Xt, CreateCustomAppRequestSchema as Y, mapOrganizationMember as Yn, ProjectReachabilityResponseSchema as Yt, CreateOrganizationRequestSchema as Z, mapProjectArtifact as Zn, ProjectSettingsResponseSchema as Zt, orgLogoStorageKey as _, TriggerRunListQuerySchema as _n, __toESM as _r, InviteOrganizationMembersResponseSchema as _t, extractRouteManifestFromArtifact as a, SkillSummaryListResponseSchema as an, organizationSlugErrorCodeFromMessage as ar, DownloadActiveProjectArtifactResponseSchema as at, publicKeystrokeAssetsObjectUrl as b, UpdateOrganizationMemberResponseSchema as bn, ListAgentMemoryFilesResponseSchema as bt, isKeystrokeAssetsOrgLogoPublicUrl as c, SlugAvailabilityResponseSchema as cn, projectFileId as cr, GetCredentialResponseSchema as ct, isStorageNotFoundError as d, StoredProjectSourceManifestSchema as dn, validateCredentialValueAgainstFields as dr, GraphqlDiscoverResponseSchema as dt, ProjectSourceResourcesSchema as en, mapProjectSettings as er, CreateProjectRequestSchema as et, isUserAvatarStorageKey as f, SubmitMarketingContactRequestSchema as fn, validationErrorResponse as fr, HistoryRunCancelResponseSchema as ft, minioStoragePlugin as g, TriggerAttachmentUpdateRequestSchema as gn, __require as gr, InviteOrganizationMembersRequestSchema as gt, loadProjectSourceFiles as h, SubmitTeamRequestResponseSchema as hn, __commonJSMin as hr, HistoryRunListResponseSchema as ht, ensureKeystrokeAssetsBucket as i, SkillSummaryDetailResponseSchema as in, organizationInvitationAcceptPath as ir, DeclineOrganizationInvitationResponseSchema as it, deleteCredentialInstanceSecret as j, UserPreferencesSchema as jn, ListProjectMetricsResponseSchema as jt, discoverOpenApiApp as k, UserAvatarSchema as kn, ListProjectFilesResponseSchema as kt, isOrgLogoStorageKey as l, StartMcpOAuthConnectionInputSchema as ln, resolveExternalPlatformOrigin as lr, GetCustomAppResponseSchema as lt, keystrokeAssetsOrgLogoKeyFromPublicUrl as m, SubmitTeamRequestRequestSchema as mn, pingProjectTarget as mr, HistoryRunListQuerySchema as mt, chatAttachmentStorageKey as n, RecentResourceListResponseSchema as nn, mergeUserPreferences as nr, DEFAULT_CLOUD_PLATFORM_ORIGIN as nt, isChatAttachmentStorageKey as o, SkillSummarySchema as on, parseAppSlug as or, DownloadActiveProjectSourceResponseSchema as ot, keystrokeAssetsAvatarKeyFromPublicUrl as p, SubmitMarketingContactResponseSchema as pn, defaultHostingPlugin as pr, HistoryRunDetailResponseSchema as pt, CreateCredentialsRequestSchema as q, listenPortFromPublicUrl as qn, PresignUserAvatarRequestSchema as qt, createAssetsStorageClient as r, RecentResourceSchema as rn, normalizeUserPreferences as rr, DEFAULT_TRIGGER_OVERVIEW_MODEL as rt, isKeystrokeAssetsAvatarPublicUrl as s, SlugAvailabilityQuerySchema as sn, parseStoredRouteManifest as sr, ErrorResponseSchema as st, RouteManifestNotFoundError as t, PublicModelsResponseSchema as tn, mapUserOrganization as tr, CreateProjectResponseSchema as tt, isStorageBucketNotFoundError as u, StartMcpOAuthConnectionResultSchema as un, resolveUniqueCredentialInstanceLabel as ur, GraphqlDiscoverRequestSchema as ut, projectArtifactKey as v, UpdateCredentialRequestSchema as vn, InviteProjectMembersRequestSchema as vt, beginMcpOAuthConnect as w, UpdateProjectRequestSchema as wn, ListCredentialsResponseSchema as wt, userAvatarStorageKey as x, UpdateOrganizationRequestSchema as xn, ListAgentWorkspaceFilesResponseSchema as xt, projectSourceBlobKey as y, UpdateOrganizationMemberRequestSchema as yn, InviteProjectMembersResponseSchema as yt, AgentSummaryListResponseSchema as z, WorkspaceTriggerRunListResponseSchema as zn, PLATFORM_RESOURCE_UNSUPPORTED_TEXT as zt };
+export { CreateOrganizationRequestSchema as $, chatAttachmentExtension as $n, ProjectReachabilityResponseSchema as $t, discoverOpenApiApp as A, UploadProjectSourceManifestRequestSchema as An, ListOrganizationMembersResponseSchema as At, AgentSummaryDetailResponseSchema as B, WorkflowRunInputsSchema as Bn, OpenApiDiscoverResponseSchema as Bt, defaultSchedulerPlugin as C, UpdateOrganizationMemberRequestSchema as Cn, validateWorkflowRunInputValues as Cr, InviteProjectMembersResponseSchema as Ct, describeCredentialBinding as D, UpdateProjectMemberResponseSchema as Dn, __commonJSMin as Dr, ListAppsResponseSchema as Dt, decodeOAuthState as E, UpdateProjectMemberRequestSchema as En, pingProjectTarget as Er, ListApiKeysResponseSchema as Et, setCredentialInstanceSecret as F, UserPreferencesSchema as Fn, ListProjectMetricsResponseSchema as Ft, AppSlugAvailabilityResponseSchema as G, WorkspaceTriggerFileSchema as Gn, PresignChatAttachmentRequestSchema as Gt, AgentSummarySchema as H, WorkflowSummaryListResponseSchema as Hn, OrganizationSidebarBrandingSchema as Ht, ACTIVE_ORG_HEADER as I, WorkflowCanvasCredentialBindingsSchema as In, ListProjectsResponseSchema as It, CreateApiKeyResponseSchema as J, WorkspaceTriggerRunListResponseSchema as Jn, PresignOrgLogoResponseSchema as Jt, CompleteProjectArtifactResponseSchema as K, WorkspaceTriggerListResponseSchema as Kn, PresignChatAttachmentResponseSchema as Kt, AcceptOrganizationInvitationResponseSchema as L, WorkflowCanvasRunSchema as Ln, McpDiscoverRequestSchema as Lt, PublicHttpUrlError as M, UserAvatarPatchSchema as Mn, ListProjectDeploymentsResponseSchema as Mt, deleteCredentialInstanceSecret as N, UserAvatarSchema as Nn, ListProjectFilesResponseSchema as Nt, discoverGraphqlApp as O, UpdateProjectRequestSchema as On, __require as Or, ListCredentialsResponseSchema as Ot, readCredentialInstanceSecret as P, UserPreferencesPatchSchema as Pn, ListProjectMembersResponseSchema as Pt, CreateCustomAppResponseSchema as Q, buildCredentialInstanceLabel as Qn, PresignUserAvatarResponseSchema as Qt, ActiveOrganizationResponseSchema as R, WorkflowCanvasSchema as Rn, McpDiscoverResponseSchema as Rt, createJobQueue as S, UpdateCredentialRequestSchema as Sn, validateCredentialValueAgainstFields as Sr, InviteProjectMembersRequestSchema as St, completeMcpOAuthConnect as T, UpdateOrganizationRequestSchema as Tn, defaultHostingPlugin as Tr, ListAgentWorkspaceFilesResponseSchema as Tt, AgentWorkspaceFileSummarySchema as U, WorkflowSummarySchema as Un, PLATFORM_RESOURCE_UNSUPPORTED_TEXT as Ut, AgentSummaryListResponseSchema as V, WorkflowSummaryDetailResponseSchema as Vn, OrganizationSidebarBrandingPatchSchema as Vt, AppSlugAvailabilityQuerySchema as W, WorkspaceTriggerDetailSchema as Wn, PROJECT_SLUG_TAKEN_MESSAGE as Wt, CreateCredentialsResponseSchema as X, agentMemoryFileId as Xn, PresignProjectSourceResponseSchema as Xt, CreateCredentialsRequestSchema as Y, WorkspaceWorkflowOverviewSchema as Yn, PresignProjectSourceRequestSchema as Yt, CreateCustomAppRequestSchema as Z, agentWorkspaceFileId as Zn, PresignUserAvatarRequestSchema as Zt, orgLogoStorageKey as _, SubmitMarketingContactResponseSchema as _n, parseAppSlug as _r, HistoryRunDetailResponseSchema as _t, extractRouteManifestFromArtifact as a, PublicModelsResponseSchema as an, mapOrganizationInvitation as ar, DEFAULT_TRIGGER_OVERVIEW_MODEL as at, publicKeystrokeAssetsObjectUrl as b, TriggerAttachmentUpdateRequestSchema as bn, resolveExternalPlatformOrigin as br, InviteOrganizationMembersRequestSchema as bt, isKeystrokeAssetsOrgLogoPublicUrl as c, SkillSummaryDetailResponseSchema as cn, mapProjectArtifact as cr, DeclineOrganizationInvitationResponseSchema as ct, isStorageNotFoundError as d, SlugAvailabilityQuerySchema as dn, mapProjectSettings as dr, ErrorResponseSchema as dt, ProjectResponseSchema as en, deriveCredentialInstanceSlug as er, CreateOrganizationResponseSchema as et, isUserAvatarStorageKey as f, SlugAvailabilityResponseSchema as fn, mapUserOrganization as fr, GetCredentialResponseSchema as ft, minioStoragePlugin as g, SubmitMarketingContactRequestSchema as gn, organizationSlugErrorCodeFromMessage as gr, HistoryRunCancelResponseSchema as gt, loadProjectSourceFiles as h, StoredProjectSourceManifestSchema as hn, organizationInvitationAcceptPath as hr, GraphqlDiscoverResponseSchema as ht, ensureKeystrokeAssetsBucket as i, ProjectSourceResourcesSchema as in, listenPortFromPublicUrl as ir, DEFAULT_CLOUD_PLATFORM_ORIGIN as it, withCredentialAssignments as j, UploadProjectSourceResponseSchema as jn, ListOrganizationsResponseSchema as jt, discoverMcpApp as k, UpdateProjectSettingsRequestSchema as kn, __toESM as kr, ListOrganizationInvitationsResponseSchema as kt, isOrgLogoStorageKey as l, SkillSummaryListResponseSchema as ln, mapProjectDeployment as lr, DownloadActiveProjectArtifactResponseSchema as lt, keystrokeAssetsOrgLogoKeyFromPublicUrl as m, StartMcpOAuthConnectionResultSchema as mn, normalizeUserPreferences as mr, GraphqlDiscoverRequestSchema as mt, chatAttachmentStorageKey as n, ProjectSlugAvailabilityQuerySchema as nn, isAllowedChatAttachmentMediaType as nr, CreateProjectRequestSchema as nt, isChatAttachmentStorageKey as o, RecentResourceListResponseSchema as on, mapOrganizationMember as or, DEFAULT_WORKFLOW_CANVAS_MODEL as ot, keystrokeAssetsAvatarKeyFromPublicUrl as p, StartMcpOAuthConnectionInputSchema as pn, mergeUserPreferences as pr, GetCustomAppResponseSchema as pt, CreateApiKeyRequestSchema as q, WorkspaceTriggerOverviewSchema as qn, PresignOrgLogoRequestSchema as qt, createAssetsStorageClient as r, ProjectSlugAvailabilityResponseSchema as rn, jsonSchemaToWorkflowInputSchema as rr, CreateProjectResponseSchema as rt, isKeystrokeAssetsAvatarPublicUrl as s, RecentResourceSchema as sn, mapProject as sr, DEFAULT_WORKFLOW_OVERVIEW_MODEL as st, RouteManifestNotFoundError as t, ProjectSettingsResponseSchema as tn, displayCredentialAppName as tr, CreateProjectArtifactResponseSchema as tt, isStorageBucketNotFoundError as u, SkillSummarySchema as un, mapProjectMember as ur, DownloadActiveProjectSourceResponseSchema as ut, projectArtifactKey as v, SubmitTeamRequestRequestSchema as vn, parseStoredRouteManifest as vr, HistoryRunListQuerySchema as vt, beginMcpOAuthConnect as w, UpdateOrganizationMemberResponseSchema as wn, validationErrorResponse as wr, ListAgentMemoryFilesResponseSchema as wt, userAvatarStorageKey as x, TriggerRunListQuerySchema as xn, resolveUniqueCredentialInstanceLabel as xr, InviteOrganizationMembersResponseSchema as xt, projectSourceBlobKey as y, SubmitTeamRequestResponseSchema as yn, projectFileId as yr, HistoryRunListResponseSchema as yt, AgentMemoryFileSummarySchema as z, WorkflowRunInputsPutBodySchema as zn, OpenApiDiscoverRequestSchema as zt };
 
-//# sourceMappingURL=dist-DEUmH1sy.mjs.map
+//# sourceMappingURL=dist-Dfoa0fsU.mjs.map