@growthub/cli 0.13.5 → 0.13.6

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/lib/orchestration-graph.js

@@ -305,7 +305,7 @@ function findSandboxRowsForRegistry(workspaceConfig, integrationId) {
   if (!sandboxObject) return [];
   const rows = Array.isArray(sandboxObject.rows) ? sandboxObject.rows : [];
   return rows.filter((row) => {
-    const graph = parseOrchestrationGraph(row?.orchestrationGraph);
+    const graph = parseOrchestrationGraph(row?.orchestrationConfig || row?.orchestrationGraph);
     if (!graph?.nodes) return String(row?.schedulerRegistryId || "").trim() === id;
     return graph.nodes.some(
       (node) => node?.type === "api-registry-call"
@@ -359,7 +359,7 @@ function buildSandboxRowFromApiRegistry(workspaceConfig, registryRow, options =
     lastRunId: "",
     lastSourceId: "",
     lastResponse: "",
-    orchestrationGraph: serializeOrchestrationGraph(graph),
+    orchestrationConfig: serializeOrchestrationGraph(graph),
     description: String(options.description || registryRow?.description || "").trim()
   };
 }

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/lib/workspace-data-model.js

@@ -417,6 +417,7 @@ function deriveManualObjectTable(object, options = {}) {
     source,
     objectType: object.objectType || "custom",
     icon: object.icon || null,
+    locked: object.locked !== undefined ? Boolean(object.locked) : Boolean(object.objectType && object.objectType !== "custom"),
     pickerHidden: Boolean(object.pickerHidden),
     columns: hydratedColumns,
     rows: hydratedRows,
@@ -888,7 +889,7 @@ const OBJECT_TYPE_PRESETS = {
       "lastRunId",
       "lastSourceId",
       "lastResponse",
-      "orchestrationGraph",
+      "orchestrationConfig",
       "description",
       "resolverTemplateId",
       "connectorKind",

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/lib/workspace-schema.js

@@ -96,6 +96,15 @@ const KNOWN_SANDBOX_AGENT_HOSTS = [
 ];
 
 const NORMALIZED_OBJECT_FIELD_IDS = ["id", "label", "secondaryLabel", "entityType", "provider", "lane", "status"];
+
+// API Registry V1 — Nango binding fields are additive and OPTIONAL on the
+// existing `objectType: "api-registry"` row shape (whose canonical columns
+// are owned by `lib/workspace-data-model.js`). They only carry meaning when
+// the row's `connectorKind === "nango"`. The HTTP, MCP, Chrome, and tool
+// connectorKinds keep working unchanged.
+const KNOWN_NANGO_MODES = ["cloud", "self-hosted"];
+const NANGO_PROVIDER_CONFIG_KEY_MAX = 64;
+const NANGO_PROVIDER_CONFIG_KEY_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_.-]*$/;
 const WORKSPACE_TEMPLATE_KIND = "growthub-workspace-template";
 const WORKSPACE_TEMPLATE_VERSION = 1;
 const WORKSPACE_TEMPLATE_SOURCE = "growthub-custom-workspace-starter-v1";
@@ -1016,9 +1025,11 @@ function validateSandboxEnvironmentRow(row, path, errors) {
       errors.push(`${path}.intelligenceAdapterMode must be one of ${INTELLIGENCE_ADAPTER_MODES.join(", ")}`);
     }
   }
-  if (row.orchestrationGraph !== undefined && row.orchestrationGraph !== null && row.orchestrationGraph !== "") {
-    if (typeof row.orchestrationGraph !== "string" && (typeof row.orchestrationGraph !== "object" || Array.isArray(row.orchestrationGraph))) {
-      errors.push(`${path}.orchestrationGraph must be a JSON string or plain object`);
+  for (const field of ["orchestrationConfig", "orchestrationGraph"]) {
+    if (row[field] !== undefined && row[field] !== null && row[field] !== "") {
+      if (typeof row[field] !== "string" && (typeof row[field] !== "object" || Array.isArray(row[field]))) {
+        errors.push(`${path}.${field} must be a JSON string or plain object`);
+      }
     }
   }
   if (row.envRefs !== undefined && typeof row.envRefs !== "string" && !Array.isArray(row.envRefs)) {
@@ -1115,6 +1126,88 @@ function validateSandboxEnvironmentRow(row, path, errors) {
   }
 }
 
+/**
+ * Validate the OPTIONAL Nango binding fields that may appear on an
+ * `objectType: "api-registry"` row when `connectorKind === "nango"`.
+ *
+ * The canonical api-registry columns (`integrationId`, `authRef`, `baseUrl`,
+ * `endpoint`, `method`, `status`, `connectorKind`, `resolverTemplateId`, ...)
+ * are owned by `lib/workspace-data-model.js` and validated by their own
+ * shape. This function only inspects the Nango extension fields and is a
+ * no-op for HTTP / MCP / Chrome / tool / custom rows.
+ */
+function validateApiRegistryRow(row, path, errors) {
+  if (!isPlainObject(row)) return;
+  // Defensive: any api-registry row is forbidden from persisting raw
+  // credentials. The auth ref lives in `authRef` (an env-ref name) and the
+  // actual secret stays in env. This guard applies to ALL connectorKinds.
+  const FORBIDDEN_TOKEN_FIELDS = [
+    "secret",
+    "secretKey",
+    "apiKey",
+    "token",
+    "authToken",
+    "accessToken",
+    "refreshToken",
+    "bearer",
+    "password"
+  ];
+  for (const forbidden of FORBIDDEN_TOKEN_FIELDS) {
+    if (Object.prototype.hasOwnProperty.call(row, forbidden)) {
+      errors.push(`${path}.${forbidden} is not allowed on an api-registry row — store the env-ref name in authRef and keep the secret in env`);
+    }
+  }
+  if (row.connectorKind !== "nango") return;
+  // Nango-specific binding fields. All are optional individually, but
+  // `providerConfigKey` must resolve at runtime — either explicitly or by
+  // falling back to `integrationId`. Validate format only when present.
+  if (row.providerConfigKey !== undefined && row.providerConfigKey !== null && row.providerConfigKey !== "") {
+    if (
+      typeof row.providerConfigKey !== "string"
+      || row.providerConfigKey.length > NANGO_PROVIDER_CONFIG_KEY_MAX
+      || !NANGO_PROVIDER_CONFIG_KEY_PATTERN.test(row.providerConfigKey)
+    ) {
+      errors.push(`${path}.providerConfigKey must be alphanumeric (with _.- separators), starting alphanumeric, and <= ${NANGO_PROVIDER_CONFIG_KEY_MAX} chars`);
+    }
+  }
+  if (row.nangoMode !== undefined && row.nangoMode !== "" && !KNOWN_NANGO_MODES.includes(row.nangoMode)) {
+    errors.push(`${path}.nangoMode must be one of ${KNOWN_NANGO_MODES.join(", ")}`);
+  }
+  if (row.nangoHostUrl !== undefined && row.nangoHostUrl !== null && row.nangoHostUrl !== "" && typeof row.nangoHostUrl !== "string") {
+    errors.push(`${path}.nangoHostUrl must be a string when present`);
+  }
+  if (row.nangoEnvironment !== undefined && row.nangoEnvironment !== null && row.nangoEnvironment !== "" && typeof row.nangoEnvironment !== "string") {
+    errors.push(`${path}.nangoEnvironment must be a string when present`);
+  }
+  if (row.connectionIds !== undefined) {
+    if (typeof row.connectionIds === "string") {
+      // Allow comma-separated form for hand-edits — splitting/normalization
+      // happens at the resolver boundary, not in the validator.
+    } else if (!Array.isArray(row.connectionIds)) {
+      errors.push(`${path}.connectionIds must be a comma-separated string or an array of strings`);
+    } else {
+      row.connectionIds.forEach((value, index) => {
+        if (typeof value !== "string" || !value.trim()) {
+          errors.push(`${path}.connectionIds[${index}] must be a non-empty string`);
+        }
+      });
+    }
+  }
+  if (row.enabledActions !== undefined) {
+    if (typeof row.enabledActions === "string") {
+      // Comma-separated form is allowed.
+    } else if (!Array.isArray(row.enabledActions)) {
+      errors.push(`${path}.enabledActions must be a comma-separated string or an array of strings`);
+    } else {
+      row.enabledActions.forEach((value, index) => {
+        if (typeof value !== "string" || !value.trim()) {
+          errors.push(`${path}.enabledActions[${index}] must be a non-empty string`);
+        }
+      });
+    }
+  }
+}
+
 const NAV_FOLDERS_OBJECT_ID = "nav-folders";
 const NAV_FOLDER_NAME_MAX = 60;
 const NAV_ITEM_LABEL_MAX = 80;
@@ -1265,6 +1358,9 @@ function validateDataModelConfig(dataModel, errors) {
         if (object.objectType === "sandbox-environment") {
           validateSandboxEnvironmentRow(row, `${prefix}.rows[${rowIndex}]`, errors);
         }
+        if (object.objectType === "api-registry") {
+          validateApiRegistryRow(row, `${prefix}.rows[${rowIndex}]`, errors);
+        }
         if (object.id === NAV_FOLDERS_OBJECT_ID) {
           validateNavFolderRow(row, `${prefix}.rows[${rowIndex}]`, errors);
         }
@@ -1536,11 +1632,14 @@ export {
   KNOWN_FIELDS,
   KNOWN_FILTER_CONJUNCTIONS,
   KNOWN_FILTER_OPERATORS,
+  KNOWN_NANGO_MODES,
   KNOWN_SANDBOX_AGENT_HOSTS,
   KNOWN_SANDBOX_RUN_LOCALITY,
   KNOWN_SANDBOX_RUNTIMES,
   KNOWN_SORT_DIRECTIONS,
   KNOWN_WIDGET_KINDS,
+  NANGO_PROVIDER_CONFIG_KEY_MAX,
+  NANGO_PROVIDER_CONFIG_KEY_PATTERN,
   DEFAULT_SANDBOX_ADAPTER,
   SANDBOX_DEFAULT_TIMEOUT_MS,
   SANDBOX_MAX_TIMEOUT_MS,

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/package.json

@@ -10,6 +10,7 @@
     "lint": "next lint"
   },
   "dependencies": {
+    "@nangohq/node": "^0.70.4",
     "@tanstack/react-table": "^8.21.3",
     "lucide-react": "^0.468.0",
     "next": "^16.2.6",

package/assets/worker-kits/growthub-custom-workspace-starter-v1/bundles/growthub-custom-workspace-starter-v1.json

@@ -40,6 +40,7 @@
     "templates/deployment-plan.md",
     "templates/project.md",
     "templates/self-eval.md",
+    "templates/seeded-configs/project-management.config.json",
     "helpers/README.md",
     "skills/README.md",
     "examples/workspace-sample.md",

package/assets/worker-kits/growthub-custom-workspace-starter-v1/kit.json

@@ -44,6 +44,7 @@
     "templates/project.md",
     "templates/self-eval.md",
     "templates/seeded-configs/alignment-loop.config.json",
+    "templates/seeded-configs/project-management.config.json",
     "helpers/README.md",
     "helpers/propose-capability.mjs",
     "helpers/promote-capability.mjs",
@@ -169,6 +170,7 @@
       "templates/deployment-handoff.md",
       "templates/supabase-setup-plan.md",
       "templates/seeded-configs/alignment-loop.config.json",
+      "templates/seeded-configs/project-management.config.json",
       "helpers",
       "helpers/README.md",
       "helpers/propose-capability.mjs",

package/assets/worker-kits/growthub-custom-workspace-starter-v1/templates/seeded-configs/project-management.config.json

@@ -0,0 +1,276 @@
+{
+  "name": "Project Management Workspace Template",
+  "description": "Opinionated project-management workspace template for API-backed task workflows. This seed is sanitized: it stores no provider secrets, no OAuth connection ids, and no user task data.",
+  "dataModel": {
+    "objects": [
+      {
+        "id": "api-registry",
+        "label": "API Registry",
+        "source": "API Registry",
+        "objectType": "api-registry",
+        "icon": "Code2",
+        "locked": true,
+        "columns": [
+          "integrationId",
+          "authRef",
+          "baseUrl",
+          "endpoint",
+          "method",
+          "status",
+          "lastTested",
+          "lastResponse",
+          "entityTypes",
+          "description",
+          "connectorKind",
+          "resolverTemplateId",
+          "schemaVersion",
+          "capabilities",
+          "executionLane",
+          "providerConfigKey",
+          "connectionIds",
+          "nangoMode",
+          "nangoEnvironment"
+        ],
+        "records": [
+          {
+            "integrationId": "asana-active-tasks",
+            "authRef": "NANGO_SECRET_KEY",
+            "baseUrl": "http://127.0.0.1:3000",
+            "endpoint": "/api/workspace/integrations/nango/proxy",
+            "method": "POST",
+            "status": "template",
+            "lastTested": "",
+            "lastResponse": "",
+            "entityTypes": "tasks",
+            "description": "Template API Registry row for pulling active project tasks through a provider-auth proxy. Set providerConfigKey and connectionIds in the exported workspace after OAuth.",
+            "connectorKind": "nango",
+            "resolverTemplateId": "nango-proxy-v1",
+            "schemaVersion": "1",
+            "capabilities": "read:tasks",
+            "executionLane": "project-management",
+            "providerConfigKey": "asana",
+            "connectionIds": "",
+            "nangoMode": "cloud",
+            "nangoEnvironment": "dev"
+          }
+        ],
+        "binding": {
+          "mode": "manual",
+          "source": "Data Model"
+        },
+        "fieldSettings": {
+          "hidden": [
+            "lastResponse"
+          ]
+        }
+      },
+      {
+        "id": "project-task-source",
+        "label": "Project Task Source",
+        "source": "Project Task Source",
+        "objectType": "data-source",
+        "icon": "Globe",
+        "locked": true,
+        "columns": [
+          "Name",
+          "registryId",
+          "endpoint",
+          "authRef",
+          "baseUrl",
+          "method",
+          "status",
+          "lastTested",
+          "lastResponse",
+          "sourceStorage",
+          "sourceId",
+          "entityType",
+          "description"
+        ],
+        "records": [
+          {
+            "Name": "Active project tasks",
+            "registryId": "asana-active-tasks",
+            "endpoint": "/api/workspace/integrations/nango/proxy",
+            "authRef": "NANGO_SECRET_KEY",
+            "baseUrl": "http://127.0.0.1:3000",
+            "method": "POST",
+            "status": "template",
+            "lastTested": "",
+            "lastResponse": "",
+            "sourceStorage": "workspace-source-records",
+            "sourceId": "project-active-tasks",
+            "entityType": "tasks",
+            "description": "Source binding for task deltas returned by the project-management workflow."
+          }
+        ],
+        "binding": {
+          "mode": "manual",
+          "source": "Data Model"
+        },
+        "fieldSettings": {
+          "hidden": [
+            "lastResponse"
+          ]
+        }
+      },
+      {
+        "id": "sandbox-environments",
+        "label": "Sandbox Environments",
+        "source": "Sandbox Environments",
+        "objectType": "sandbox-environment",
+        "icon": "Terminal",
+        "locked": true,
+        "columns": [
+          "Name",
+          "lifecycleStatus",
+          "version",
+          "runLocality",
+          "schedulerRegistryId",
+          "runtime",
+          "adapter",
+          "agentHost",
+          "localModel",
+          "localEndpoint",
+          "intelligenceAdapterMode",
+          "envRefs",
+          "networkAllow",
+          "allowList",
+          "instructions",
+          "command",
+          "timeoutMs",
+          "status",
+          "lastTested",
+          "lastRunId",
+          "lastSourceId",
+          "lastResponse",
+          "orchestrationConfig",
+          "description"
+        ],
+        "records": [
+          {
+            "Name": "project-active-tasks-workflow",
+            "lifecycleStatus": "draft",
+            "version": "1",
+            "runLocality": "local",
+            "schedulerRegistryId": "",
+            "runtime": "node",
+            "adapter": "local-process",
+            "agentHost": "",
+            "localModel": "",
+            "localEndpoint": "",
+            "intelligenceAdapterMode": "",
+            "envRefs": "NANGO_SECRET_KEY",
+            "networkAllow": "true",
+            "allowList": "127.0.0.1,localhost,api.nango.dev,app.asana.com",
+            "instructions": "Template workflow for pulling active tasks from a project-management provider through API Registry. Fill projectGid, workspaceGid, providerConfigKey, and connectionIds in the exported workspace before running.",
+            "command": "",
+            "timeoutMs": "60000",
+            "status": "template",
+            "lastTested": "",
+            "lastRunId": "",
+            "lastSourceId": "",
+            "lastResponse": "",
+            "orchestrationConfig": "{\n  \"version\": 1,\n  \"provider\": \"growthub-native\",\n  \"nodes\": [\n    {\n      \"id\": \"input\",\n      \"type\": \"input\",\n      \"label\": \"Project input\",\n      \"config\": {\n        \"inputMode\": \"manual\",\n        \"samplePayload\": {\n          \"projectGid\": \"PROJECT_GID_PLACEHOLDER\",\n          \"workspaceGid\": \"WORKSPACE_GID_PLACEHOLDER\"\n        }\n      }\n    },\n    {\n      \"id\": \"active-tasks-call\",\n      \"type\": \"api-registry-call\",\n      \"label\": \"Pull active project tasks\",\n      \"config\": {\n        \"registryId\": \"asana-active-tasks\",\n        \"integrationId\": \"asana-active-tasks\",\n        \"method\": \"POST\",\n        \"baseUrl\": \"http://127.0.0.1:3000\",\n        \"endpoint\": \"/api/workspace/integrations/nango/proxy\",\n        \"authRef\": \"NANGO_SECRET_KEY\",\n        \"bodyTemplate\": {\n          \"providerConfigKey\": \"asana\",\n          \"connectionId\": \"CONNECTION_ID_PLACEHOLDER\",\n          \"method\": \"GET\",\n          \"path\": \"/api/1.0/projects/{{input.projectGid}}/tasks\",\n          \"params\": {\n            \"completed_since\": \"now\",\n            \"limit\": \"20\",\n            \"opt_fields\": \"gid,name,completed,assignee.name,due_on,permalink_url,created_at,modified_at,memberships.section.name\"\n          }\n        },\n        \"deltaTags\": [\n          \"routing\",\n          \"input\",\n          \"output\"\n        ]\n      }\n    },\n    {\n      \"id\": \"normalize-active-tasks\",\n      \"type\": \"transform-filter\",\n      \"label\": \"Normalize active tasks\",\n      \"config\": {\n        \"rootPath\": \"data\",\n        \"filter\": {\n          \"completed\": false\n        },\n        \"fieldMap\": {\n          \"gid\": \"gid\",\n          \"name\": \"name\",\n          \"completed\": \"completed\",\n          \"assignee\": \"assignee.name\",\n          \"due_on\": \"due_on\",\n          \"section\": \"memberships.0.section.name\",\n          \"permalink_url\": \"permalink_url\",\n          \"modified_at\": \"modified_at\"\n        },\n        \"deltaTags\": [\n          \"evaluation\",\n          \"output\"\n        ]\n      }\n    },\n    {\n      \"id\": \"result\",\n      \"type\": \"tool-result\",\n      \"label\": \"Persist task response\",\n      \"config\": {\n        \"saveStatus\": true,\n        \"saveResponse\": true,\n        \"sourceId\": \"project-active-tasks\",\n        \"deltaTags\": [\n          \"output\"\n        ]\n      }\n    }\n  ],\n  \"edges\": [\n    {\n      \"from\": \"input\",\n      \"to\": \"active-tasks-call\",\n      \"passes\": \"input\"\n    },\n    {\n      \"from\": \"active-tasks-call\",\n      \"to\": \"normalize-active-tasks\",\n      \"passes\": \"response\"\n    },\n    {\n      \"from\": \"normalize-active-tasks\",\n      \"to\": \"result\",\n      \"passes\": \"normalized-output\"\n    }\n  ]\n}",
+            "description": "Draft project-management workflow template. No secrets or provider data are stored in this row."
+          }
+        ],
+        "binding": {
+          "mode": "manual",
+          "source": "Data Model"
+        },
+        "fieldSettings": {
+          "hidden": [
+            "lastResponse"
+          ]
+        }
+      }
+    ]
+  },
+  "dashboards": [
+    {
+      "id": "project-management-template",
+      "name": "Project Management",
+      "description": "Template dashboard for active project tasks. Run the workflow after configuring provider OAuth to hydrate real rows.",
+      "tabs": [
+        {
+          "id": "tab-project-tasks",
+          "label": "Active Tasks",
+          "widgets": [
+            {
+              "id": "project-active-tasks-view",
+              "kind": "view",
+              "title": "Active project tasks",
+              "position": {
+                "x": 0,
+                "y": 0,
+                "w": 9,
+                "h": 8
+              },
+              "config": {
+                "source": "Project Task Source",
+                "layout": "Table",
+                "columns": [
+                  "gid",
+                  "name",
+                  "assignee",
+                  "due_on",
+                  "section",
+                  "modified_at",
+                  "permalink_url"
+                ],
+                "rows": []
+              }
+            }
+          ]
+        }
+      ],
+      "activeTabId": "tab-project-tasks",
+      "version": "1"
+    }
+  ],
+  "canvas": {
+    "id": "workspace-canvas",
+    "name": "Project Management",
+    "scope": "workspace",
+    "layout": {
+      "columns": 12,
+      "rowHeight": 64,
+      "gap": 16,
+      "responsive": true
+    },
+    "widgets": [
+      {
+        "id": "project-active-tasks-view",
+        "kind": "view",
+        "title": "Active project tasks",
+        "position": {
+          "x": 0,
+          "y": 0,
+          "w": 9,
+          "h": 8
+        },
+        "config": {
+          "source": "Project Task Source",
+          "layout": "Table",
+          "columns": [
+            "gid",
+            "name",
+            "assignee",
+            "due_on",
+            "section",
+            "modified_at",
+            "permalink_url"
+          ],
+          "rows": []
+        }
+      }
+    ]
+  },
+  "provenance": {
+    "mirrors": "growthub-custom-workspace-starter-v1",
+    "template": "project-management",
+    "templateKind": "workspace-template",
+    "privacy": "sanitized-no-secrets-no-provider-data",
+    "note": "Official Workspace 2 seed. Configure provider OAuth and project identifiers after export."
+  }
+}