
Security News
Insecure Agents Podcast: How to Keep AI Agents From Bypassing Security Controls
Socket CTO Ahmad Nassri discusses how to keep AI agents from bypassing package blocks, limit credential access, and monitor their actions.
@workflow/builders
Advanced tools
Shared builder infrastructure for Workflow SDK. This package provides the base builder class and utilities used by framework-specific integrations.
This package contains the core build logic for transforming workflow source files into deployable bundles. It is used by:
@workflow/cli - For standalone/basic builds@workflow/next - For Next.js integration@workflow/nitro - For Nitro/Nuxt integrationThis package is typically not used directly. Instead, use one of the framework-specific packages that extend BaseBuilder:
import { BaseBuilder } from '@workflow/builders';
class MyBuilder extends BaseBuilder {
async build(): Promise<void> {
// Implement builder-specific logic
}
}
Builder configurations can provide an optional onAfterTransform observer for
tooling that derives metadata from the exact SWC output used by a build:
import type { WorkflowAfterTransformHook } from '@workflow/builders';
// Pass as `onAfterTransform` in the builder configuration.
const onAfterTransform: WorkflowAfterTransformHook = async ({
mode,
filename,
absolutePath,
source,
code,
workflowManifest,
}) => {
// Observe the accepted transform result.
};
The observer is awaited after the transform's manifest entries have been accepted. It cannot replace the generated code, and throwing aborts the build. A source file may be observed multiple times across transform modes, bundles, and watch rebuilds, so consumers should deduplicate results when necessary.
The builder system uses:
"use workflow", "use step")MIT
FAQs
Shared builder infrastructure for Workflow SDK
The npm package @workflow/builders receives a total of 1,272,840 weekly downloads. As such, @workflow/builders popularity was classified as popular.
We found that @workflow/builders demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Security News
Socket CTO Ahmad Nassri discusses how to keep AI agents from bypassing package blocks, limit credential access, and monitor their actions.

Security News
GPT-6 Astra tried to plant malicious code in simulated open source projects using fake GitHub accounts and deceptive PRs during an assigned CTF challenge.

Security News
upm uses Node.js to deliver fast npm installs in about 250 KB, with a JavaScript API and security defaults.