@keystrokehq/platform 0.1.147 → 0.1.149

package/dist/{dist-BIKIpPhu.mjs → dist-Cy5yFN73.mjs}

@@ -1,11 +1,11 @@
-import { Ci as inferGraphqlAuthFromProbe, Hi as mcpProbeToAppTemplate, Ki as openApiSpecToAppTemplate, Si as graphqlIntrospectionToAppTemplate, _a as credentialInputSchema, bi as deriveCredentialInstanceSlug, ki as isRecord, ya as requiredDisplayTextSchema } from "./project-draft-notifier-IV-0I5b0.mjs";
+import { Ai as isRecord, Ci as graphqlIntrospectionToAppTemplate, Ui as mcpProbeToAppTemplate, ba as requiredDisplayTextSchema, qi as openApiSpecToAppTemplate, va as credentialInputSchema, wi as inferGraphqlAuthFromProbe, xi as deriveCredentialInstanceSlug } from "./project-draft-notifier-epPD70Eo.mjs";
 import { createRequire } from "node:module";
 import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { DEFAULT_DATABASE_URL, claimDueTriggers, claimDueTriggersForOrg, claimNextJob, clearCredentialInstanceDefaults, createPostgresCancelChannel, decryptCredentialPayload, disableAllTriggerSchedules, disableTriggerSchedulesNotInSlugs, encryptCredentialPayload, enqueueJob, ensureOAuthCredentialInstance, failAgentSession, failWorkflowRun, getProjectScopeId, getServerTenantScopeId, inferDialect, isDatabaseInitialized, listCredentialAssignmentsByTarget, listEnabledScheduledTriggers, listExecutableAttachmentsByTriggerIds, markJobComplete, markJobFailed, requeueExpiredLeases, resolvePostgresUrlFromEnv, resolveProjectDatabaseUrlFromEnv, scheduleJobRetry, selectActiveEphemeralScheduledTriggerSlugs, selectCredentialInstanceById, selectCredentialInstancesByAppSlug, selectCredentialInstancesByIds, selectCredentialInstancesForScope, selectCredentialInstancesForScopes, selectTriggerBySlug, setTriggerScheduleEnabled, triggerTimezoneFromConfig, upsertCredentialInstance, upsertTriggerScheduleFields } from "@keystrokehq/database";
 import EventEmitter$1, { EventEmitter } from "node:events";
 import { z } from "zod";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { deleteManagedServiceCredential, deleteSecretValuesForRef, ensureOAuthApp, getDecryptedOAuthAppById, getDecryptedOAuthAppBySlug, getDecryptedOAuthConnectionById, getManagedServiceCredential, getOrganizationScopeId, insertManagedServiceCredential, putOAuthPendingState, resolveOAuthAccessToken, saveOAuthConnection, selectSecretValue, takeOAuthPendingState, updateManagedServiceCredentialValue, upsertSecretValue } from "@keystrokehq/platform-database";
+import { deleteManagedServiceCredential, deleteSecretValuesForRef, ensureOAuthApp, getDecryptedOAuthAppById, getDecryptedOAuthAppBySlug, getDecryptedOAuthConnectionById, getManagedServiceCredential, getOrganizationScopeId, insertManagedServiceCredential, listDecryptedOAuthConnections, putOAuthPendingState, resolveOAuthAccessToken, saveOAuthConnection, selectSecretValue, takeOAuthPendingState, updateManagedServiceCredentialValue, upsertSecretValue } from "@keystrokehq/platform-database";
 import * as z$1 from "zod/v4";
 import "zod/v3";
 import * as z4mini from "zod/v4-mini";
@@ -8576,7 +8576,7 @@ function isWorkflow(value) {
 new AsyncLocalStorage();
 new AsyncLocalStorage();
 //#endregion
-//#region ../../packages/credentials/dist/store-DAvicuW4.mjs
+//#region ../../packages/credentials/dist/store-BlAXCv9q.mjs
 function normalizeRow(row) {
 	const { projectId: _projectId, ...rest } = row;
 	return rest;
@@ -27209,8 +27209,84 @@ var CredentialAccessUnavailableError = class extends Error {
 		this.consumer = options.consumer;
 	}
 };
+const COMPOSIO_PROXY_TOKEN_PREFIX = "composio:";
+/**
+* Composio → first-party OAuth dual-read helpers.
+*
+* Resolve falls back from a legacy `keystroke` row when a native package asks
+* for a non-keystroke shape:
+* - `oauth_managed` → this module (mirrored `oauth_connections`)
+* - `api_key` → dual-written instance secrets (field bag; see resolve-vault)
+*
+* Old packages that still ask for `keystroke` keep Composio descriptors.
+* New native installs write `oauth_managed` / `api_key` rows directly.
+*/
+function isComposioProxyAccessToken(token) {
+	return token.trim().startsWith(COMPOSIO_PROXY_TOKEN_PREFIX);
+}
+/** True when the stored token cannot call the provider API directly. */
+function isUnusableMirroredAccessToken(token) {
+	const trimmed = token?.trim();
+	if (!trimmed) return true;
+	if (isComposioProxyAccessToken(trimmed)) return true;
+	if (trimmed === "REDACTED" || trimmed.includes("REDACTED")) return true;
+	if (trimmed.endsWith("...")) return true;
+	return false;
+}
+function mirrorChronologyMs(connection) {
+	const mirroredAt = connection.metadata?.composioMirroredAt;
+	if (typeof mirroredAt === "string") {
+		const parsed = Date.parse(mirroredAt);
+		if (!Number.isNaN(parsed)) return parsed;
+	}
+	return connection.updatedAt.getTime();
+}
+/**
+* Legacy Composio mirrors can leave several rows with the same
+* `composioConnectionId`. Prefer a usable token, then the newest
+* `composioMirroredAt` (fallback: `updatedAt`).
+*
+* When `appSlug` is set, prefer `metadata.composioToolkit` matches and never
+* select a row whose toolkit is a different app.
+*/
+function pickMirroredOAuthConnectionId(connections, composioConnectionId, options) {
+	const id = composioConnectionId.trim();
+	if (!id) return null;
+	let matches = connections.filter((connection) => {
+		const mirroredId = connection.metadata?.composioConnectionId;
+		return typeof mirroredId === "string" && mirroredId.trim() === id;
+	});
+	if (matches.length === 0) return null;
+	const appSlug = options?.appSlug?.trim().toLowerCase();
+	if (appSlug) {
+		const toolkitMatches = matches.filter((connection) => {
+			const toolkit = connection.metadata?.composioToolkit;
+			return typeof toolkit === "string" && toolkit.trim().toLowerCase() === appSlug;
+		});
+		if (toolkitMatches.length > 0) matches = toolkitMatches;
+		else {
+			matches = matches.filter((connection) => {
+				const toolkit = connection.metadata?.composioToolkit;
+				return typeof toolkit !== "string" || toolkit.trim() === "";
+			});
+			if (matches.length === 0) return null;
+		}
+	}
+	const usable = matches.filter((connection) => !isUnusableMirroredAccessToken(connection.accessToken));
+	const pool = usable.length > 0 ? usable : matches;
+	let best = pool[0];
+	for (const candidate of pool.slice(1)) if (mirrorChronologyMs(candidate) > mirrorChronologyMs(best)) best = candidate;
+	return best.id;
+}
 function createLocalCredentialBackend(options = {}) {
 	const { tokenRefresh, resolveSandboxAccessToken } = options;
+	async function getOAuthAccessToken(connectionId) {
+		const connection = await getDecryptedOAuthConnectionById(connectionId);
+		if (!connection) throw new Error(`OAuth connection not found: ${connectionId}`);
+		const app = await getDecryptedOAuthAppById(connection.appId);
+		if (!app) throw new Error(`OAuth app not found for connection: ${connectionId}`);
+		return { accessToken: await resolveOAuthAccessToken(connection, app, tokenRefresh) };
+	}
 	return {
 		async resolveApiKey(instanceId, schema) {
 			const row = await selectCredentialInstanceById(instanceId);
@@ -27229,12 +27305,11 @@ function createLocalCredentialBackend(options = {}) {
 				chainAttempted: ["api_key"]
 			});
 		},
-		async getOAuthAccessToken(connectionId) {
-			const connection = await getDecryptedOAuthConnectionById(connectionId);
-			if (!connection) throw new Error(`OAuth connection not found: ${connectionId}`);
-			const app = await getDecryptedOAuthAppById(connection.appId);
-			if (!app) throw new Error(`OAuth app not found for connection: ${connectionId}`);
-			return { accessToken: await resolveOAuthAccessToken(connection, app, tokenRefresh) };
+		getOAuthAccessToken,
+		async getOAuthAccessTokenFromMirror({ appSlug, composioConnectionId }) {
+			const connectionId = pickMirroredOAuthConnectionId(await listDecryptedOAuthConnections(), composioConnectionId, { appSlug });
+			if (!connectionId) return null;
+			return getOAuthAccessToken(connectionId);
 		},
 		async resolveKeystrokeSandbox({ instanceId, connectionId, appSlug, schema }) {
 			const secret = await readCredentialInstanceSecret(instanceId);
@@ -33017,4 +33092,4 @@ function defaultSchedulerPlugin() {
 //#endregion
 export { setManagedServiceCredential as C, __toESM as E, setCredentialInstanceSecretValue as S, __require as T, withMcpReadClient as _, completeMcpOAuthConnect as a, readCredentialInstanceSecret as b, describeCredentialBindings as c, discoverOpenApiApp as d, isDiscoveryError as f, PublicHttpUrlError as g, withCredentialAssignments as h, beginMcpOAuthConnect as i, discoverGraphqlApp as l, verifyOAuthState as m, cronPayloadSchema as n, createOAuthState as o, resolveConnectedMcpAuthHeaders as p, McpOAuthConnectError as r, decodeOAuthState as s, defaultSchedulerPlugin as t, discoverMcpApp as u, deleteCredentialInstanceSecret as v, __commonJSMin as w, setCredentialInstanceSecret as x, deleteManagedServiceCredential$1 as y };
 
-//# sourceMappingURL=dist-BIKIpPhu.mjs.map
+//# sourceMappingURL=dist-Cy5yFN73.mjs.map