@keystrokehq/keystroke 1.0.8 → 1.0.9

package/dist/{dist-DOMwPx7V.cjs → dist-HI6bM6LK.cjs}

@@ -683,7 +683,8 @@ const storedRouteManifestEntryV2Schema = zod.z.discriminatedUnion("kind", [
 		systemPrompt: zod.z.string(),
 		toolCount: zod.z.number().int().nonnegative(),
 		credentialCount: zod.z.number().int().nonnegative(),
-		credentialKeys: zod.z.array(zod.z.string()).default([])
+		appSlugs: zod.z.array(zod.z.string()).default([]),
+		toolSlugs: zod.z.array(zod.z.string()).default([])
 	}),
 	zod.z.object({
 		kind: zod.z.literal("workflow"),
@@ -1117,6 +1118,45 @@ zod.z.object({
 }).refine((input) => input.label !== void 0 || input.isDefault !== void 0 || input.value !== void 0, { message: "At least one field is required" });
 zod.z.array(AppCredentialSummarySchema);
 zod.z.array(AppCredentialSummarySchema);
+const CredentialAssignmentTargetTypeSchema = zod.z.enum(["workflow", "agent"]);
+const CredentialAssignmentRecordSchema = zod.z.object({
+	id: zod.z.string(),
+	targetType: CredentialAssignmentTargetTypeSchema,
+	targetKey: zod.z.string(),
+	consumerId: zod.z.string(),
+	credentialSlug: zod.z.string(),
+	instanceId: zod.z.string(),
+	credential: zod.z.string().optional(),
+	scopeType: zod.z.enum([
+		"organization",
+		"project",
+		"user"
+	]).optional(),
+	createdAt: zod.z.string(),
+	updatedAt: zod.z.string()
+});
+zod.z.object({ assignments: zod.z.array(CredentialAssignmentRecordSchema) });
+zod.z.object({
+	targetType: CredentialAssignmentTargetTypeSchema,
+	targetKey: zod.z.string().min(1),
+	/** Omit or '*' for wildcard assignment. */
+	consumerId: zod.z.string().optional(),
+	credential: zod.z.string().min(1)
+});
+zod.z.object({
+	targetType: CredentialAssignmentTargetTypeSchema,
+	targetKey: zod.z.string().min(1)
+});
+zod.z.object({
+	targetType: CredentialAssignmentTargetTypeSchema,
+	targetKey: zod.z.string().min(1)
+});
+const CredentialConsumerSummarySchema = zod.z.object({
+	consumerId: zod.z.string(),
+	label: zod.z.string(),
+	appSlugs: zod.z.array(zod.z.string())
+});
+zod.z.object({ consumers: zod.z.array(CredentialConsumerSummarySchema) });
 const McpConnectionStatusSchema = zod.z.enum([
 	"INITIATED",
 	"ACTIVE",
@@ -1147,12 +1187,20 @@ const KeystrokeCredentialSchema = zod.z.object({
 	entityId: zod.z.string(),
 	instanceId: zod.z.string()
 });
+const McpCredentialAssignmentTargetSchema = zod.z.object({
+	type: CredentialAssignmentTargetTypeSchema,
+	key: zod.z.string().trim().min(1)
+});
 zod.z.object({
 	app: zod.z.string().trim().min(1),
 	tool: zod.z.string().trim().min(1),
 	arguments: zod.z.record(zod.z.string(), zod.z.unknown()).default({}),
 	/** Pinned provider toolkit version, sourced from the app definition; forwarded to the provider. */
-	version: zod.z.string().trim().min(1)
+	version: zod.z.string().trim().min(1),
+	/** When set, platform MCP resolve checks credential assignments before scope defaults. */
+	assignmentTarget: McpCredentialAssignmentTargetSchema.optional(),
+	/** Tool/step consumer id for assignment lookup (action slug or workflow step correlation id). */
+	consumerId: zod.z.string().trim().min(1).optional()
 });
 const TeamRequestTypeSchema = zod.z.enum([
 	"org-deletion",
@@ -1794,7 +1842,9 @@ zod.z.object({
 });
 const CredentialInstanceRecordSchema = zod.z.object({
 	id: zod.z.string(),
-	key: zod.z.string(),
+	appSlug: zod.z.string(),
+	slug: zod.z.string(),
+	name: zod.z.string().nullable(),
 	scopeType: CredentialScopeTypeSchema,
 	scopeId: zod.z.string().nullable(),
 	label: zod.z.string().nullable(),
@@ -1804,6 +1854,8 @@ const CredentialInstanceRecordSchema = zod.z.object({
 zod.z.object({ instances: zod.z.array(CredentialInstanceRecordSchema) });
 zod.z.object({
 	key: zod.z.string().min(1),
+	slug: zod.z.string().min(1).optional(),
+	name: zod.z.string().nullable().optional(),
 	scopeType: CredentialScopeTypeSchema,
 	scopeId: zod.z.string().nullable().optional(),
 	label: zod.z.string().nullable().optional(),
@@ -1811,6 +1863,8 @@ zod.z.object({
 	value: zod.z.record(zod.z.string(), zod.z.unknown()).refine((value) => Object.keys(value).length > 0, { message: "value must be a non-empty object" })
 });
 zod.z.object({
+	slug: zod.z.string().min(1).optional(),
+	name: zod.z.string().nullable().optional(),
 	label: zod.z.string().nullable().optional(),
 	isDefault: zod.z.boolean().optional(),
 	value: zod.z.record(zod.z.string(), zod.z.unknown()).refine((value) => Object.keys(value).length > 0, { message: "value must be a non-empty object" }).optional()
@@ -2334,11 +2388,11 @@ function runWithRunSignal(signal, fn) {
 function getRunSignal() {
 	return runSignalStorage.getStore() ?? NEVER_ABORT;
 }
-const REGISTRY_KEY$1 = Symbol.for("keystroke.workflowRunGetter");
+const REGISTRY_KEY$2 = Symbol.for("keystroke.workflowRunGetter");
 function registry$1() {
 	const globalScope = globalThis;
-	if (!globalScope[REGISTRY_KEY$1]) globalScope[REGISTRY_KEY$1] = {};
-	return globalScope[REGISTRY_KEY$1];
+	if (!globalScope[REGISTRY_KEY$2]) globalScope[REGISTRY_KEY$2] = {};
+	return globalScope[REGISTRY_KEY$2];
 }
 function registerWorkflowRunGetter(fn) {
 	registry$1().getter = fn;
@@ -2429,6 +2483,32 @@ async function executeAction(action, input, credentials = {}) {
 	const result = await action.run(validatedInput, credentials);
 	return action.output.parse(result);
 }
+/**
+* The store lives in a global `Symbol.for` slot rather than a module-level `const` so a single
+* `AsyncLocalStorage` instance is shared even when the bundled `@keystrokehq/keystroke` facade
+* ships its own copy of this module: the worker sets context via `runWithMcpCredentialContext`
+* and the facade reads it via `getRegisteredMcpCredentialContext` against the same instance.
+*/
+const REGISTRY_KEY$1 = Symbol.for("keystroke.mcpCredentialContextStore");
+function store() {
+	const globalScope = globalThis;
+	if (!globalScope[REGISTRY_KEY$1]) globalScope[REGISTRY_KEY$1] = new node_async_hooks.AsyncLocalStorage();
+	return globalScope[REGISTRY_KEY$1];
+}
+function getRegisteredMcpCredentialContext() {
+	return store().getStore();
+}
+/**
+* Run `fn` with MCP credential context active for its entire async execution. Nested calls merge
+* over the enclosing context, so an agent's assignment target and a per-tool consumer id compose.
+*/
+function runWithMcpCredentialContext(context, fn) {
+	const als = store();
+	return als.run({
+		...als.getStore(),
+		...context
+	}, fn);
+}
 function resolveActionTool(action, options) {
 	const consumer = options?.consumer ?? {
 		kind: "tool",
@@ -2446,7 +2526,10 @@ function resolveActionTool(action, options) {
 				if (!options?.resolveCredentials) throw new Error(`Missing credential resolver for action "${action.slug}"`);
 				credentials = await options.resolveCredentials(requirements, consumer, options.contextOverride);
 			}
-			const output = await runOutsideActionExecution(() => executeAction(action, params, credentials));
+			const output = await runWithMcpCredentialContext({
+				...options?.mcpCredentialContext,
+				consumerId: consumer.id ?? consumer.name
+			}, () => runOutsideActionExecution(() => executeAction(action, params, credentials)));
 			return {
 				content: [{
 					type: "text",
@@ -2530,6 +2613,12 @@ Object.defineProperty(exports, "getActionCredentialRequirements", {
 		return getActionCredentialRequirements;
 	}
 });
+Object.defineProperty(exports, "getRegisteredMcpCredentialContext", {
+	enumerable: true,
+	get: function() {
+		return getRegisteredMcpCredentialContext;
+	}
+});
 Object.defineProperty(exports, "getRegisteredProjectScopeId", {
 	enumerable: true,
 	get: function() {
@@ -2608,6 +2697,12 @@ Object.defineProperty(exports, "runOutsideActionExecution", {
 		return runOutsideActionExecution;
 	}
 });
+Object.defineProperty(exports, "runWithMcpCredentialContext", {
+	enumerable: true,
+	get: function() {
+		return runWithMcpCredentialContext;
+	}
+});
 Object.defineProperty(exports, "runWithRunSignal", {
 	enumerable: true,
 	get: function() {
@@ -2633,4 +2728,4 @@ Object.defineProperty(exports, "toolParameters", {
 	}
 });
 
-//# sourceMappingURL=dist-DOMwPx7V.cjs.map
+//# sourceMappingURL=dist-HI6bM6LK.cjs.map