@keystrokehq/platform 0.1.6 → 0.1.9

package/dist/{dist-BtAOWi5K.cjs → dist-KeJkUQxy.cjs}

@@ -25,6 +25,8 @@ let dockerode = require("dockerode");
 dockerode = __toESM(dockerode, 1);
 let node_fs_promises = require("node:fs/promises");
 let _keystrokehq_database = require("@keystrokehq/database");
+let node_events = require("node:events");
+node_events = __toESM(node_events, 1);
 let zod = require("zod");
 let node_async_hooks = require("node:async_hooks");
 let _keystrokehq_platform_database = require("@keystrokehq/platform-database");
@@ -37,8 +39,6 @@ zod_v4 = __toESM(zod_v4, 1);
 let node_process = require("node:process");
 node_process = __toESM(node_process, 1);
 require("node:stream");
-let node_events = require("node:events");
-node_events = __toESM(node_events, 1);
 let node_assert = require("node:assert");
 node_assert = __toESM(node_assert, 1);
 let node_timers_promises = require("node:timers/promises");
@@ -5276,18 +5276,19 @@ object({
 	source: _enum([
 		"custom",
 		"mcp",
-		"openapi"
+		"openapi",
+		"graphql"
 	]).default("custom"),
-	mcpUrl: string().url().optional(),
+	url: string().url().optional(),
 	authKind: AppAuthKindSchema$1.optional(),
 	fields: optionalCredentialFieldsSchema$1.optional(),
 	credentialScheme: AppCredentialSchemeSchema$1.optional(),
 	oauthScopes: array(OAuthScopeOptionSchema$1).optional()
 }).superRefine((data, ctx) => {
-	if (data.source === "mcp" && !data.mcpUrl) ctx.addIssue({
+	if ((data.source === "mcp" || data.source === "openapi" || data.source === "graphql") && !data.url) ctx.addIssue({
 		code: "custom",
-		message: "mcpUrl is required for MCP apps",
-		path: ["mcpUrl"]
+		message: "url is required for this app source",
+		path: ["url"]
 	});
 	if (!(data.authKind ?? (data.source === "custom" ? "api_key" : void 0))) {
 		ctx.addIssue({
@@ -5313,7 +5314,7 @@ object({
 	category: string().min(1),
 	authKind: AppAuthKindSchema$1,
 	source: AppSourceSchema$1,
-	mcpUrl: string().url().nullable().optional(),
+	url: string().url().nullable().optional(),
 	credentialFields: optionalCredentialFieldsSchema$1.optional(),
 	credentialScheme: AppCredentialSchemeSchema$1.optional(),
 	oauthScopes: array(OAuthScopeOptionSchema$1).optional(),
@@ -5333,7 +5334,7 @@ object({
 	source: AppSourceSchema$1,
 	credentialFields: AppCredentialFieldsSchema$1.optional(),
 	credentialScheme: AppCredentialSchemeSchema$1.optional(),
-	mcpUrl: string().url().nullable().optional(),
+	url: string().url().nullable().optional(),
 	createdAt: string().min(1),
 	updatedAt: string().min(1)
 });
@@ -5352,8 +5353,8 @@ object({
 	credentialFields: AppCredentialFieldsSchema$1.optional(),
 	/** Composio auth scheme when credentialFields are present. */
 	credentialScheme: AppCredentialSchemeSchema$1.optional(),
-	/** Direct MCP server URL when source is mcp. */
-	mcpUrl: string().url().nullable().optional(),
+	/** Endpoint URL for MCP, OpenAPI, or GraphQL custom apps. */
+	url: string().url().nullable().optional(),
 	/** When present, the app supports agent gateway bindings (external channels). */
 	gateway: AppGatewaySchema$1.optional()
 });
@@ -5387,7 +5388,7 @@ object({
 		credentialFields: record(string(), AppCredentialFieldSchema$1).optional(),
 		credentialScheme: AppCredentialSchemeSchema$1.optional(),
 		oauthScopes: array(OAuthScopeOptionSchema$1),
-		mcpUrl: string().url(),
+		url: string().url(),
 		oauth: McpAuthProbeOAuthSchema$1.optional(),
 		serverName: string().optional(),
 		serverDescription: string().optional()
@@ -5411,7 +5412,21 @@ object({
 		credentialFields: record(string(), AppCredentialFieldSchema$1).optional(),
 		credentialScheme: AppCredentialSchemeSchema$1.optional(),
 		oauthScopes: array(OAuthScopeOptionSchema$1),
-		openapiUrl: string().url(),
+		url: string().url(),
+		name: string().optional(),
+		description: string().optional(),
+		homepageUrl: string().optional()
+	})
+});
+object({ url: string().url() });
+object({
+	detected: boolean(),
+	template: object({
+		authKind: AppAuthKindSchema$1,
+		credentialFields: record(string(), AppCredentialFieldSchema$1).optional(),
+		credentialScheme: AppCredentialSchemeSchema$1.optional(),
+		oauthScopes: array(OAuthScopeOptionSchema$1),
+		url: string().url(),
 		name: string().optional(),
 		description: string().optional(),
 		homepageUrl: string().optional()
@@ -6975,11 +6990,11 @@ async function waitForHealth(baseUrl, options = {}) {
 		try {
 			if ((await fetchImpl(url, { signal: AbortSignal.timeout(2e3) })).ok) return;
 		} catch {}
-		await sleep$1(intervalMs);
+		await sleep$2(intervalMs);
 	}
 	throw new Error(`Project server health check timed out after ${timeoutMs}ms (${url})`);
 }
-function sleep$1(ms) {
+function sleep$2(ms) {
 	return new Promise((resolve) => {
 		setTimeout(resolve, ms);
 	});
@@ -8713,18 +8728,19 @@ const CreateCustomAppRequestSchema = zod.z.object({
 	source: zod.z.enum([
 		"custom",
 		"mcp",
-		"openapi"
+		"openapi",
+		"graphql"
 	]).default("custom"),
-	mcpUrl: zod.z.string().url().optional(),
+	url: zod.z.string().url().optional(),
 	authKind: AppAuthKindSchema.optional(),
 	fields: optionalCredentialFieldsSchema.optional(),
 	credentialScheme: AppCredentialSchemeSchema.optional(),
 	oauthScopes: zod.z.array(OAuthScopeOptionSchema).optional()
 }).superRefine((data, ctx) => {
-	if (data.source === "mcp" && !data.mcpUrl) ctx.addIssue({
+	if ((data.source === "mcp" || data.source === "openapi" || data.source === "graphql") && !data.url) ctx.addIssue({
 		code: "custom",
-		message: "mcpUrl is required for MCP apps",
-		path: ["mcpUrl"]
+		message: "url is required for this app source",
+		path: ["url"]
 	});
 	if (!(data.authKind ?? (data.source === "custom" ? "api_key" : void 0))) {
 		ctx.addIssue({
@@ -8751,7 +8767,7 @@ const CustomAppDetailSchema = zod.z.object({
 	category: zod.z.string().min(1),
 	authKind: AppAuthKindSchema,
 	source: AppSourceSchema,
-	mcpUrl: zod.z.string().url().nullable().optional(),
+	url: zod.z.string().url().nullable().optional(),
 	credentialFields: optionalCredentialFieldsSchema.optional(),
 	credentialScheme: AppCredentialSchemeSchema.optional(),
 	oauthScopes: zod.z.array(OAuthScopeOptionSchema).optional(),
@@ -8773,7 +8789,7 @@ zod.z.object({
 	source: AppSourceSchema,
 	credentialFields: AppCredentialFieldsSchema.optional(),
 	credentialScheme: AppCredentialSchemeSchema.optional(),
-	mcpUrl: zod.z.string().url().nullable().optional(),
+	url: zod.z.string().url().nullable().optional(),
 	createdAt: zod.z.string().min(1),
 	updatedAt: zod.z.string().min(1)
 });
@@ -8796,8 +8812,8 @@ const AppCatalogEntrySchema = zod.z.object({
 	credentialFields: AppCredentialFieldsSchema.optional(),
 	/** Composio auth scheme when credentialFields are present. */
 	credentialScheme: AppCredentialSchemeSchema.optional(),
-	/** Direct MCP server URL when source is mcp. */
-	mcpUrl: zod.z.string().url().nullable().optional(),
+	/** Endpoint URL for MCP, OpenAPI, or GraphQL custom apps. */
+	url: zod.z.string().url().nullable().optional(),
 	/** When present, the app supports agent gateway bindings (external channels). */
 	gateway: AppGatewaySchema.optional()
 });
@@ -8832,7 +8848,7 @@ const McpDiscoverResponseSchema = zod.z.object({
 		credentialFields: zod.z.record(zod.z.string(), AppCredentialFieldSchema).optional(),
 		credentialScheme: AppCredentialSchemeSchema.optional(),
 		oauthScopes: zod.z.array(OAuthScopeOptionSchema),
-		mcpUrl: zod.z.string().url(),
+		url: zod.z.string().url(),
 		oauth: McpAuthProbeOAuthSchema.optional(),
 		serverName: zod.z.string().optional(),
 		serverDescription: zod.z.string().optional()
@@ -8849,7 +8865,7 @@ const StartMcpOAuthConnectionInputSchema = zod.z.object({
 });
 const StartMcpOAuthConnectionResultSchema = zod.z.object({ authorizeUrl: zod.z.string().url() });
 function mcpProbeToAppTemplate(probe) {
-	const mcpUrl = probe.url;
+	const url = probe.url;
 	if (probe.mode === "oauth" && probe.oauth) return {
 		authKind: "oauth",
 		oauthScopes: probe.oauth.scopes.map((name) => ({
@@ -8857,7 +8873,7 @@ function mcpProbeToAppTemplate(probe) {
 			description: name,
 			defaultSelected: true
 		})),
-		mcpUrl,
+		url,
 		oauth: probe.oauth
 	};
 	if (probe.mode === "token") return {
@@ -8868,32 +8884,32 @@ function mcpProbeToAppTemplate(probe) {
 			label: "Token"
 		} },
 		oauthScopes: [],
-		mcpUrl
+		url
 	};
 	return {
 		authKind: "api_key",
 		credentialFields: {},
 		oauthScopes: [],
-		mcpUrl
+		url
 	};
 }
-function isRecord$1(value) {
+function isRecord$1$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function trimString(value) {
+function trimString$1(value) {
 	if (typeof value !== "string") return;
 	const trimmed = value.trim();
 	return trimmed.length > 0 ? trimmed : void 0;
 }
 function securitySchemesFromSpec(spec) {
-	if (isRecord$1(spec.components) && isRecord$1(spec.components.securitySchemes)) return spec.components.securitySchemes;
-	if (isRecord$1(spec.securityDefinitions)) return spec.securityDefinitions;
+	if (isRecord$1$1(spec.components) && isRecord$1$1(spec.components.securitySchemes)) return spec.components.securitySchemes;
+	if (isRecord$1$1(spec.securityDefinitions)) return spec.securityDefinitions;
 }
 function primarySecuritySchemeName(spec) {
 	const security = spec.security;
 	if (Array.isArray(security) && security.length > 0) {
 		const first = security[0];
-		if (isRecord$1(first)) {
+		if (isRecord$1$1(first)) {
 			const keys = Object.keys(first);
 			if (keys.length > 0) return keys[0];
 		}
@@ -8908,28 +8924,28 @@ function homepageUrlFromSpec(spec) {
 	const servers = spec.servers;
 	if (Array.isArray(servers) && servers.length > 0) {
 		const first = servers[0];
-		if (isRecord$1(first)) {
-			const url = trimString(first.url);
+		if (isRecord$1$1(first)) {
+			const url = trimString$1(first.url);
 			if (url) return url.replace(/\/+$/, "");
 		}
 	}
 	if (typeof spec.swagger === "string") {
 		const schemes = spec.schemes;
 		const scheme = Array.isArray(schemes) && typeof schemes[0] === "string" ? schemes[0] : "https";
-		const host = trimString(spec.host);
+		const host = trimString$1(spec.host);
 		const basePath = typeof spec.basePath === "string" ? spec.basePath : "";
 		if (host) return `${scheme}://${host}${basePath}`.replace(/\/+$/, "");
 	}
 }
 function oauthScopesFromOas3Scheme(scheme) {
 	const flows = scheme.flows;
-	if (!isRecord$1(flows)) return [];
+	if (!isRecord$1$1(flows)) return [];
 	const scopes = [];
-	for (const flow of Object.values(flows)) if (isRecord$1(flow) && isRecord$1(flow.scopes)) scopes.push(...Object.keys(flow.scopes));
+	for (const flow of Object.values(flows)) if (isRecord$1$1(flow) && isRecord$1$1(flow.scopes)) scopes.push(...Object.keys(flow.scopes));
 	return scopes;
 }
 function oauthScopesFromSwagger2Scheme(scheme) {
-	if (!isRecord$1(scheme.scopes)) return [];
+	if (!isRecord$1$1(scheme.scopes)) return [];
 	return Object.keys(scheme.scopes);
 }
 function oauthScopeOptions(scopeNames) {
@@ -8940,7 +8956,7 @@ function oauthScopeOptions(scopeNames) {
 	}));
 }
 function apiKeyPlacement(scheme) {
-	const name = trimString(scheme.name) ?? "api_key";
+	const name = trimString$1(scheme.name) ?? "api_key";
 	if ((typeof scheme.in === "string" ? scheme.in.toLowerCase() : "header") === "query") return {
 		kind: "query",
 		name
@@ -8982,7 +8998,7 @@ function mapSecurityScheme(scheme) {
 		credentialScheme: "API_KEY",
 		credentialFields: { token: {
 			secret: true,
-			label: trimString(scheme.name) ?? "API Key",
+			label: trimString$1(scheme.name) ?? "API Key",
 			placement: apiKeyPlacement(scheme)
 		} },
 		oauthScopes: []
@@ -9014,18 +9030,18 @@ function mapSecurityScheme(scheme) {
 	};
 }
 /** Map a parsed OpenAPI/Swagger document to a custom app template. */
-function openApiSpecToAppTemplate(spec, openapiUrl) {
-	if (!isRecord$1(spec)) throw new Error("Invalid OpenAPI spec");
-	const info = isRecord$1(spec.info) ? spec.info : {};
-	const name = trimString(info.title);
-	const description = trimString(info.description);
+function openApiSpecToAppTemplate(spec, url) {
+	if (!isRecord$1$1(spec)) throw new Error("Invalid OpenAPI spec");
+	const info = isRecord$1$1(spec.info) ? spec.info : {};
+	const name = trimString$1(info.title);
+	const description = trimString$1(info.description);
 	const homepageUrl = homepageUrlFromSpec(spec);
 	const schemes = securitySchemesFromSpec(spec);
 	const schemeName = primarySecuritySchemeName(spec);
 	let authPart = mapSecurityScheme({ type: "none" });
-	if (schemeName && schemes && isRecord$1(schemes[schemeName])) authPart = mapSecurityScheme(schemes[schemeName]);
+	if (schemeName && schemes && isRecord$1$1(schemes[schemeName])) authPart = mapSecurityScheme(schemes[schemeName]);
 	return {
-		openapiUrl,
+		url,
 		name,
 		description,
 		homepageUrl,
@@ -9043,7 +9059,125 @@ const OpenApiDiscoverResponseSchema = zod.z.object({
 		credentialFields: zod.z.record(zod.z.string(), AppCredentialFieldSchema).optional(),
 		credentialScheme: AppCredentialSchemeSchema.optional(),
 		oauthScopes: zod.z.array(OAuthScopeOptionSchema),
-		openapiUrl: zod.z.string().url(),
+		url: zod.z.string().url(),
+		name: zod.z.string().optional(),
+		description: zod.z.string().optional(),
+		homepageUrl: zod.z.string().optional()
+	})
+});
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function trimString(value) {
+	if (typeof value !== "string") return;
+	const trimmed = value.trim();
+	return trimmed.length > 0 ? trimmed : void 0;
+}
+function displayNameFromUrl(value) {
+	try {
+		const hostname = new URL(value).hostname.replace(/^www\./, "");
+		const parts = hostname.split(".").filter(Boolean);
+		let label = parts[0] ?? hostname;
+		if ((label === "mcp" || label === "api" || label === "graphql") && parts.length > 1) label = parts[1] ?? label;
+		if (!label) return;
+		return label.charAt(0).toUpperCase() + label.slice(1);
+	} catch {
+		return;
+	}
+}
+function homepageUrlFromEndpoint(endpointUrl) {
+	try {
+		return new URL(endpointUrl).origin;
+	} catch {
+		return;
+	}
+}
+function typeDescription(schema) {
+	if (!schema) return;
+	return trimString(schema.description);
+}
+function authFromProbe(authProbe) {
+	if (authProbe === "basic") return {
+		authKind: "api_key",
+		credentialScheme: "BASIC",
+		credentialFields: {
+			username: { label: "Username" },
+			password: {
+				secret: true,
+				label: "Password"
+			}
+		},
+		oauthScopes: []
+	};
+	if (authProbe === "none") return {
+		authKind: "api_key",
+		credentialFields: {},
+		oauthScopes: []
+	};
+	return {
+		authKind: "api_key",
+		credentialScheme: "BEARER_TOKEN",
+		credentialFields: { token: {
+			secret: true,
+			label: "Token",
+			placement: DEFAULT_MCP_API_KEY_PLACEMENT
+		} },
+		oauthScopes: []
+	};
+}
+/** Infer auth requirements from an unauthenticated probe response. */
+function inferGraphqlAuthFromProbe(status, wwwAuthenticate, body) {
+	if (status === 401) {
+		if ((wwwAuthenticate?.toLowerCase() ?? "").includes("basic")) return "basic";
+		return "bearer";
+	}
+	if (status === 403) return "bearer";
+	if (isGraphqlAuthError(body)) return "bearer";
+	return "none";
+}
+const AUTH_ERROR_PATTERN = /auth|unauthorized|unauthenticated|access token|credentials|not authenticated/i;
+function isGraphqlAuthError(body) {
+	if (!isRecord(body) || !Array.isArray(body.errors)) return false;
+	return body.errors.some((error) => {
+		if (!isRecord(error)) return false;
+		const message = typeof error.message === "string" ? error.message : "";
+		const extensions = isRecord(error.extensions) ? error.extensions : void 0;
+		const extensionHint = extensions ? `${extensions.code ?? ""} ${extensions.type ?? ""}` : "";
+		return AUTH_ERROR_PATTERN.test(message) || /AUTH/i.test(extensionHint);
+	});
+}
+/** Map a GraphQL introspection result to a custom app template. */
+function graphqlIntrospectionToAppTemplate(introspection, endpointUrl, authProbe = "bearer") {
+	const root = isRecord(introspection) ? introspection : {};
+	const data = isRecord(root.data) ? root.data : root;
+	const schema = isRecord(data.__schema) ? data.__schema : void 0;
+	const queryType = schema && isRecord(schema.queryType) ? schema.queryType : void 0;
+	const mutationType = schema && isRecord(schema.mutationType) ? schema.mutationType : void 0;
+	const queryName = trimString(queryType?.name);
+	const name = queryName === "Query" ? displayNameFromUrl(endpointUrl) : queryName;
+	const description = typeDescription(queryType) || typeDescription(mutationType) || (name ? `GraphQL API for ${name}.` : void 0);
+	const homepageUrl = homepageUrlFromEndpoint(endpointUrl);
+	const authPart = authFromProbe(authProbe);
+	return {
+		url: endpointUrl,
+		name,
+		description,
+		homepageUrl,
+		authKind: authPart.authKind,
+		credentialFields: authPart.credentialFields,
+		credentialScheme: authPart.credentialScheme,
+		oauthScopes: authPart.oauthScopes
+	};
+}
+const GraphqlDiscoverRequestSchema = zod.z.object({ url: zod.z.string().url() });
+const GraphqlDiscoverResponseSchema = zod.z.object({
+	detected: zod.z.boolean(),
+	template: zod.z.object({
+		authKind: AppAuthKindSchema,
+		credentialFields: zod.z.record(zod.z.string(), AppCredentialFieldSchema).optional(),
+		credentialScheme: AppCredentialSchemeSchema.optional(),
+		oauthScopes: zod.z.array(OAuthScopeOptionSchema),
+		url: zod.z.string().url(),
 		name: zod.z.string().optional(),
 		description: zod.z.string().optional(),
 		homepageUrl: zod.z.string().optional()
@@ -29699,9 +29833,9 @@ async function discoverMcpApp(url) {
 	};
 }
 async function beginMcpOAuthConnect(options) {
-	const mcpUrl = options.app.mcpUrl?.trim();
-	if (!mcpUrl || options.app.source !== "mcp" || options.app.authKind !== "oauth") throw new Error("App is not a direct MCP OAuth app");
-	const discovered = await discoverOAuthServerInfo(new URL(mcpUrl), {});
+	const appUrl = options.app.url?.trim();
+	if (!appUrl || options.app.source !== "mcp" || options.app.authKind !== "oauth") throw new Error("App is not a direct MCP OAuth app");
+	const discovered = await discoverOAuthServerInfo(new URL(appUrl), {});
 	const metadata = discovered.authorizationServerMetadata;
 	if (!metadata?.authorization_endpoint || !metadata.token_endpoint) throw new Error("MCP server does not expose OAuth authorization metadata");
 	const oauth = {
@@ -29732,9 +29866,9 @@ async function beginMcpOAuthConnect(options) {
 		tokenStrategy: "refresh",
 		clientId: clientInformation.client_id,
 		clientSecret: oauthClientSecretForStorage(clientInformation.client_secret),
-		metadata: oauthAppMetadata(oauth, mcpUrl, { tokenEndpointAuthMethod: clientInformation.token_endpoint_auth_method })
+		metadata: oauthAppMetadata(oauth, appUrl, { tokenEndpointAuthMethod: clientInformation.token_endpoint_auth_method })
 	});
-	const resourceUrl = oauth.resource ? new URL(oauth.resource) : new URL(mcpUrl);
+	const resourceUrl = oauth.resource ? new URL(oauth.resource) : new URL(appUrl);
 	const statePayload = {
 		codeVerifier: "",
 		appSlug: options.app.slug,
@@ -29747,7 +29881,7 @@ async function beginMcpOAuthConnect(options) {
 		authorizationServerUrl: discovered.authorizationServerUrl,
 		resource: oauth.resource,
 		oauthMetadata: oauth,
-		mcpUrl,
+		mcpUrl: appUrl,
 		redirectUri: options.redirectUri,
 		clientId: clientInformation.client_id,
 		clientSecret: clientInformation.client_secret,
@@ -29824,11 +29958,11 @@ async function completeMcpOAuthConnect(options) {
 	};
 }
 const MAX_SPEC_BYTES = 5 * 1024 * 1024;
-function isRecord(value) {
+function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isOpenApiSpec(value) {
-	return isRecord(value) && (typeof value.openapi === "string" || typeof value.swagger === "string");
+	return isRecord$1(value) && (typeof value.openapi === "string" || typeof value.swagger === "string");
 }
 async function discoverOpenApiApp(url) {
 	const response = await fetch(url, { redirect: "follow" });
@@ -29849,6 +29983,76 @@ async function discoverOpenApiApp(url) {
 		template: openApiSpecToAppTemplate(parsed, url)
 	};
 }
+const MAX_RESPONSE_BYTES = 5 * 1024 * 1024;
+const INTROSPECTION_QUERY = `query IntrospectionQuery {
+  __schema {
+    queryType { name description }
+    mutationType { name description }
+  }
+}`;
+const USAGE_AUTH_PROBE_QUERY = "query { __typename }";
+async function postGraphql(endpointUrl, query) {
+	const response = await fetch(endpointUrl, {
+		method: "POST",
+		redirect: "follow",
+		headers: {
+			"content-type": "application/json",
+			accept: "application/json"
+		},
+		body: JSON.stringify({ query })
+	});
+	const contentLength = response.headers.get("content-length");
+	if (contentLength && Number(contentLength) > MAX_RESPONSE_BYTES) throw new Error("GraphQL introspection response is too large");
+	const text = await response.text();
+	if (text.length > MAX_RESPONSE_BYTES) throw new Error("GraphQL introspection response is too large");
+	let body;
+	try {
+		body = JSON.parse(text);
+	} catch {
+		throw new Error("GraphQL endpoint did not return JSON");
+	}
+	return {
+		response,
+		body,
+		text
+	};
+}
+function introspectionDisabled(body) {
+	if (!isRecord(body) || !Array.isArray(body.errors)) return false;
+	return body.errors.some((error) => {
+		if (!isRecord(error)) return false;
+		return (typeof error.message === "string" ? error.message.toLowerCase() : "").includes("introspection");
+	});
+}
+function parseEndpointUrl(url) {
+	const trimmed = url.trim();
+	const parsed = new URL(trimmed);
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new Error("GraphQL endpoint must use http or https");
+	return parsed;
+}
+async function discoverGraphqlApp(url) {
+	const endpointUrl = parseEndpointUrl(url).toString();
+	const { response, body } = await postGraphql(endpointUrl, INTROSPECTION_QUERY);
+	const authProbe = inferGraphqlAuthFromProbe(response.status, response.headers.get("www-authenticate"), body);
+	if (!(isRecord(body) && isRecord(body.data) && isRecord(body.data.__schema))) {
+		if (response.status === 401 || response.status === 403) return {
+			detected: true,
+			template: graphqlIntrospectionToAppTemplate({ data: {} }, endpointUrl, authProbe)
+		};
+		if (response.ok && introspectionDisabled(body)) throw new Error("Introspection is disabled on this endpoint");
+		throw new Error(`Failed to introspect GraphQL endpoint (${response.status})`);
+	}
+	let resolvedAuthProbe = authProbe;
+	if (resolvedAuthProbe === "none") {
+		const usageProbe = await postGraphql(endpointUrl, USAGE_AUTH_PROBE_QUERY);
+		const usageAuth = inferGraphqlAuthFromProbe(usageProbe.response.status, usageProbe.response.headers.get("www-authenticate"), usageProbe.body);
+		if (usageAuth !== "none") resolvedAuthProbe = usageAuth;
+	}
+	return {
+		detected: true,
+		template: graphqlIntrospectionToAppTemplate(body, endpointUrl, resolvedAuthProbe)
+	};
+}
 //#endregion
 //#region ../../packages/workflow/dist/index.mjs
 const zodSchema$1 = zod.z.custom((v) => v instanceof zod.z.ZodType, "must be a Zod schema");
@@ -29893,6 +30097,18 @@ registerWorkflowRunGetter(() => {
 */
 const cronScheduleSchema = zod.z.string().trim().min(1, "cron schedule must be a non-empty string").refine(isParseableCron, "must be a valid cron expression").brand();
 /**
+* Resolves the effective schedule for an attachment, applying overrides by
+* precedence: per-attachment override → global override → the authored
+* schedule. Pure string precedence — no cron parsing.
+*/
+function resolveCronSchedule(attachmentId, schedule, options) {
+	return options.attachmentScheduleOverrides?.[attachmentId] ?? options.cronScheduleOverride ?? schedule;
+}
+/** The next time the schedule fires at or after `from`. */
+function nextTriggerRunAt(schedule, from = /* @__PURE__ */ new Date()) {
+	return toCron(schedule).getNextDate(from);
+}
+/**
 * Single touchpoint for the `cron-schedule` library — every parse, validation,
 * and next-run calculation in this package goes through here.
 */
@@ -42762,7 +42978,7 @@ function createDatabaseJobQueue() {
 				while (running) try {
 					const job = await (0, _keystrokehq_database.claimNextJob)(workerId);
 					if (!job) {
-						await sleep(pollIntervalMs);
+						await sleep$1(pollIntervalMs);
 						continue;
 					}
 					try {
@@ -42776,7 +42992,7 @@ function createDatabaseJobQueue() {
 						}
 					}
 				} catch {
-					await sleep(pollIntervalMs);
+					await sleep$1(pollIntervalMs);
 				}
 			};
 			loop();
@@ -42789,9 +43005,126 @@ function createDatabaseJobQueue() {
 		subscribeCancel: (handler) => cancelChannel.subscribeCancel(handler)
 	};
 }
+function sleep$1(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function enqueueTriggerJob(jobQueue, row, scheduledAt) {
+	const input = {
+		kind: "trigger",
+		targetId: row.slug,
+		runId: crypto.randomUUID(),
+		trigger: row.kind,
+		payload: {},
+		projectId: row.projectId
+	};
+	if (scheduledAt) input.scheduledAt = scheduledAt;
+	return jobQueue.enqueue(input);
+}
+async function claimDue(scope, asOf, resolveNextRunAt, limit) {
+	if (scope === "organization") return (0, _keystrokehq_database.claimDueTriggersForOrg)(asOf, resolveNextRunAt, limit);
+	return (0, _keystrokehq_database.claimDueTriggers)(asOf, resolveNextRunAt, limit).then((rows) => rows.map((row) => ({
+		...row,
+		projectId: (0, _keystrokehq_database.getProjectScopeId)()
+	})));
+}
+function createScheduleTicker(ctx) {
+	const pollIntervalMs = ctx.pollIntervalMs ?? 1e3;
+	const batchSize = ctx.batchSize ?? 10;
+	async function fireDueSchedules(asOf = /* @__PURE__ */ new Date()) {
+		const claimed = await claimDue(ctx.scope ?? "project", asOf, (schedule) => nextTriggerRunAt(schedule, asOf), batchSize);
+		for (const row of claimed) {
+			if (row.kind !== "cron" && row.kind !== "poll") continue;
+			await enqueueTriggerJob(ctx.jobQueue, {
+				slug: row.slug,
+				kind: row.kind,
+				projectId: row.projectId
+			}, asOf);
+		}
+		return claimed.length;
+	}
+	async function startScheduleTicker(options = {}) {
+		const intervalMs = options.pollIntervalMs ?? pollIntervalMs;
+		const limit = options.batchSize ?? batchSize;
+		const scope = options.scope ?? ctx.scope ?? "project";
+		let running = true;
+		const loop = async () => {
+			while (running) {
+				try {
+					const claimed = await claimDue(scope, /* @__PURE__ */ new Date(), (schedule) => nextTriggerRunAt(schedule, /* @__PURE__ */ new Date()), limit);
+					for (const row of claimed) {
+						if (row.kind !== "cron" && row.kind !== "poll") continue;
+						await enqueueTriggerJob(ctx.jobQueue, {
+							slug: row.slug,
+							kind: row.kind,
+							projectId: row.projectId
+						});
+					}
+				} catch {}
+				await sleep(intervalMs);
+			}
+		};
+		loop();
+		return async () => {
+			running = false;
+		};
+	}
+	return {
+		fireDueSchedules,
+		startScheduleTicker
+	};
+}
 function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
+function resolveTriggerSchedule(triggerSlug, schedule, overrides) {
+	return resolveCronSchedule(triggerSlug, schedule, {
+		cronScheduleOverride: overrides?.global,
+		attachmentScheduleOverrides: overrides?.byTrigger
+	});
+}
+async function syncTriggerSchedules(options) {
+	const now = /* @__PURE__ */ new Date();
+	const projectSlugs = options.schedules.map((schedule) => schedule.triggerSlug);
+	const ephemeralSlugs = await (0, _keystrokehq_database.selectActiveEphemeralScheduledTriggerSlugs)();
+	const slugs = [...projectSlugs, ...ephemeralSlugs];
+	if (slugs.length === 0) {
+		await (0, _keystrokehq_database.disableAllTriggerSchedules)(now);
+		return;
+	}
+	await (0, _keystrokehq_database.disableTriggerSchedulesNotInSlugs)(slugs, now);
+	for (const spec of options.schedules) {
+		const schedule = resolveTriggerSchedule(spec.triggerSlug, spec.schedule, options.scheduleOverrides);
+		const existing = await (0, _keystrokehq_database.selectTriggerBySlug)(spec.triggerSlug);
+		if (!existing) continue;
+		const nextRunAt = !(existing.schedule !== schedule) && existing.enabled === 1 ? existing.nextRunAt : nextTriggerRunAt(schedule, now);
+		const enabled = (await (0, _keystrokehq_database.listExecutableAttachmentsByTriggerIds)([existing.id])).length > 0;
+		await (0, _keystrokehq_database.upsertTriggerScheduleFields)({
+			triggerSlug: spec.triggerSlug,
+			schedule,
+			nextRunAt: nextRunAt ?? now,
+			enabled,
+			updatedAt: now
+		});
+	}
+}
+/** Postgres poll loop — default trigger scheduler for pg-boss, polling, and memory paths. */
+function createDatabaseTriggerScheduler(options) {
+	const ticker = createScheduleTicker({
+		jobQueue: options.jobQueue,
+		scope: options.scope,
+		pollIntervalMs: options.pollIntervalMs,
+		batchSize: options.batchSize
+	});
+	return {
+		sync: (syncOptions) => syncTriggerSchedules(syncOptions),
+		start: (startOptions) => ticker.startScheduleTicker(startOptions),
+		fireDue: (asOf) => ticker.fireDueSchedules(asOf),
+		async remove(triggerSlug) {
+			await (0, _keystrokehq_database.setTriggerScheduleEnabled)(triggerSlug, false, /* @__PURE__ */ new Date());
+		},
+		async upsert(_spec) {}
+	};
+}
 let boss;
 function resolveDatabaseUrl(url) {
 	const resolved = url ?? (0, _keystrokehq_database.resolvePostgresUrlFromEnv)(process.env);
@@ -42844,6 +43177,8 @@ function buildPgBossJobQueue(boss, options) {
 	const queueName = options.queueName ?? "keystroke";
 	const cancelChannel = (0, _keystrokehq_database.createPostgresCancelChannel)(options.connectionString, pgCancelChannelName(options.cancelScope ?? "platform", options.cancelScope === "organization" ? options.organizationId : options.projectId));
 	return {
+		boss,
+		queueName,
 		async enqueue(input) {
 			const jobId = await boss.send(queueName, {
 				...input,
@@ -42925,9 +43260,129 @@ async function createSharedPgBossJobQueue(boss, options) {
 		cancelScope: "platform"
 	});
 }
+/**
+* pg-boss schedule key for one trigger. Mirrors {@link bullmqTriggerSchedulerId}
+* so the firing backend is interchangeable: `trigger-<projectId>-<slug>`. pg-boss
+* keys allow hyphens, so colons (legal in ids) are swapped for `-`.
+*/
+function pgBossTriggerScheduleKey(spec) {
+	return `trigger-${(spec.projectId ?? (0, _keystrokehq_database.getProjectScopeId)()).replaceAll(":", "-")}-${spec.triggerSlug.replaceAll(":", "-")}`;
+}
+/** Key prefix scoping reconcile cleanup to the active project (org queues are shared). */
+function pgBossTriggerScheduleKeyPrefix(projectId) {
+	return `trigger-${(projectId ?? (0, _keystrokehq_database.getProjectScopeId)()).replaceAll(":", "-")}-`;
+}
+function triggerJobData(spec) {
+	return {
+		kind: "trigger",
+		targetId: spec.triggerSlug,
+		runId: "",
+		trigger: spec.kind,
+		payload: {},
+		projectId: spec.projectId ?? (0, _keystrokehq_database.getProjectScopeId)()
+	};
+}
+function rowToSpec(row) {
+	if (row.kind !== "cron" && row.kind !== "poll") return;
+	if (!row.schedule) return;
+	return {
+		triggerSlug: row.slug,
+		kind: row.kind,
+		schedule: row.schedule,
+		projectId: row.projectId
+	};
+}
+/**
+* Trigger scheduler backed by pg-boss native cron scheduling. Mirrors
+* {@link createBullmqTriggerScheduler}: `boss.schedule` registers a recurring job
+* onto the project/org queue (no per-second DB poll), and reconcile keeps the
+* `pgboss.schedule` table in sync with the `triggers` table (source of truth).
+*
+* Granularity: pg-boss cron is minute-level (it checks schedules every ~30s and
+* dedupes per minute), so sub-minute schedules effectively fire at most once per
+* minute — unlike the DB ticker's 1s loop.
+*/
+function createPgBossTriggerScheduler(_ctx, queue) {
+	async function upsertScheduler(spec, overrides) {
+		const schedule = resolveTriggerSchedule(spec.triggerSlug, spec.schedule, overrides);
+		const key = pgBossTriggerScheduleKey(spec);
+		await queue.boss.schedule(queue.queueName, schedule, triggerJobData({
+			...spec,
+			schedule
+		}), { key });
+	}
+	async function reconcileFromDatabase(overrides) {
+		const projectPrefix = pgBossTriggerScheduleKeyPrefix();
+		const rows = await (0, _keystrokehq_database.listEnabledScheduledTriggers)();
+		const expectedKeys = /* @__PURE__ */ new Set();
+		const failures = [];
+		for (const row of rows) {
+			const spec = rowToSpec(row);
+			if (!spec) continue;
+			expectedKeys.add(pgBossTriggerScheduleKey(spec));
+			try {
+				await upsertScheduler(spec, overrides);
+			} catch (error) {
+				failures.push({
+					triggerSlug: spec.triggerSlug,
+					error
+				});
+				console.error(`[pg-boss-trigger-scheduler] failed to schedule ${spec.triggerSlug}`, error);
+			}
+		}
+		const schedules = await queue.boss.getSchedules(queue.queueName);
+		for (const schedule of schedules) {
+			const key = schedule.key;
+			if (!key || !key.startsWith(projectPrefix)) continue;
+			if (!expectedKeys.has(key)) try {
+				await queue.boss.unschedule(queue.queueName, key);
+			} catch (error) {
+				failures.push({
+					triggerSlug: key,
+					error
+				});
+				console.error(`[pg-boss-trigger-scheduler] failed to unschedule stale ${key}`, error);
+			}
+		}
+		if (failures.length > 0) throw new Error(`pg-boss trigger scheduler reconcile failed for ${failures.length} trigger(s)`);
+	}
+	return {
+		async sync(syncOptions) {
+			await syncTriggerSchedules(syncOptions);
+			await reconcileFromDatabase(syncOptions.scheduleOverrides);
+		},
+		async start(_options) {
+			return async () => void 0;
+		},
+		fireDue: async () => 0,
+		upsert: upsertScheduler,
+		async remove(triggerSlug, projectId) {
+			await queue.boss.unschedule(queue.queueName, pgBossTriggerScheduleKey({
+				triggerSlug,
+				projectId
+			}));
+		}
+	};
+}
 function resolveUrl(ctx) {
 	return ctx.url ?? (0, _keystrokehq_database.resolveProjectDatabaseUrlFromEnv)(process.env) ?? _keystrokehq_database.DEFAULT_DATABASE_URL;
 }
+/** DB poll-loop trigger scheduler — used by the SQLite/self-host polling backend. */
+function createPollingTriggerScheduler(ctx, queue) {
+	const scope = ctx.scope === "organization" ? "organization" : "project";
+	return Promise.resolve(createDatabaseTriggerScheduler({
+		jobQueue: queue,
+		scope
+	}));
+}
+function isPgBossJobQueue(queue) {
+	return "boss" in queue && "queueName" in queue;
+}
+/** Native pg-boss cron scheduler; falls back to the DB ticker if the queue isn't pg-boss. */
+function createPgBossTriggerSchedulerForPlugin(ctx, queue) {
+	if (!isPgBossJobQueue(queue)) return createPollingTriggerScheduler(ctx, queue);
+	return Promise.resolve(createPgBossTriggerScheduler(ctx, queue));
+}
 /** Postgres pg-boss backend. Platform scope shares one queue; org scope gets one queue per org. */
 function pgBossSchedulerPlugin() {
 	return defineSchedulerPlugin({
@@ -42954,7 +43409,8 @@ function pgBossSchedulerPlugin() {
 				queueName: pgBossProjectQueueName(projectId),
 				projectId
 			});
-		}
+		},
+		createTriggerScheduler: createPgBossTriggerSchedulerForPlugin
 	});
 }
 /** DB-table queue (Drizzle `jobs`), for SQLite / self-host. */
@@ -42963,7 +43419,8 @@ function pollingSchedulerPlugin() {
 		name: "polling",
 		async createJobQueue() {
 			return createDatabaseJobQueue();
-		}
+		},
+		createTriggerScheduler: createPollingTriggerScheduler
 	});
 }
 /** Auto-selects pg-boss (postgres) or polling (sqlite) by dialect. */
@@ -42973,6 +43430,10 @@ function defaultSchedulerPlugin() {
 		async createJobQueue(ctx) {
 			if ((0, _keystrokehq_database.inferDialect)(resolveUrl(ctx), ctx.dialect) === "postgres") return pgBossSchedulerPlugin().createJobQueue(ctx);
 			return pollingSchedulerPlugin().createJobQueue(ctx);
+		},
+		async createTriggerScheduler(ctx, queue) {
+			if ((0, _keystrokehq_database.inferDialect)(resolveUrl(ctx), ctx.dialect) === "postgres") return pgBossSchedulerPlugin().createTriggerScheduler(ctx, queue);
+			return pollingSchedulerPlugin().createTriggerScheduler(ctx, queue);
 		}
 	});
 }
@@ -43545,6 +44006,18 @@ Object.defineProperty(exports, "GetCustomAppResponseSchema", {
 		return GetCustomAppResponseSchema;
 	}
 });
+Object.defineProperty(exports, "GraphqlDiscoverRequestSchema", {
+	enumerable: true,
+	get: function() {
+		return GraphqlDiscoverRequestSchema;
+	}
+});
+Object.defineProperty(exports, "GraphqlDiscoverResponseSchema", {
+	enumerable: true,
+	get: function() {
+		return GraphqlDiscoverResponseSchema;
+	}
+});
 Object.defineProperty(exports, "HistoryRunCancelResponseSchema", {
 	enumerable: true,
 	get: function() {
@@ -44115,6 +44588,12 @@ Object.defineProperty(exports, "deriveCredentialInstanceSlug", {
 		return deriveCredentialInstanceSlug;
 	}
 });
+Object.defineProperty(exports, "discoverGraphqlApp", {
+	enumerable: true,
+	get: function() {
+		return discoverGraphqlApp;
+	}
+});
 Object.defineProperty(exports, "discoverMcpApp", {
 	enumerable: true,
 	get: function() {
@@ -44368,4 +44847,4 @@ Object.defineProperty(exports, "validationErrorResponse", {
 	}
 });
 
-//# sourceMappingURL=dist-BtAOWi5K.cjs.map
+//# sourceMappingURL=dist-KeJkUQxy.cjs.map