@keystrokehq/platform 1.0.11 → 1.0.13

package/dist/{dist-ChqR_h8h.cjs → dist-CCtsJoyT.cjs}

@@ -1291,6 +1291,11 @@ const OrganizationSlugSchema = zod.z.string().trim().toLowerCase().min(2, "Slug
 * fail to load.
 */
 const ClaimableOrganizationSlugSchema = OrganizationSlugSchema.refine((slug) => !RESERVED_ORGANIZATION_SLUGS.has(slug), "This slug is reserved");
+const ORGANIZATION_NAME_APOSTROPHE_PATTERN = /[''\u2018\u2019]/g;
+/** Normalize a display name into slug-shaped text (may be empty or too short to claim). */
+function normalizeOrganizationNameToSlugBase(name) {
+	return name.trim().toLowerCase().replace(ORGANIZATION_NAME_APOSTROPHE_PATTERN, "").replace(/[^a-z0-9]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+}
 /** Same format as organization slugs — org-scoped, no global reserved list. */
 const ProjectSlugSchema = OrganizationSlugSchema;
 const PROJECT_SLUG_TAKEN_MESSAGE = "That slug is already taken.";
@@ -1447,7 +1452,8 @@ const storedRouteManifestEntryV2Schema = zod.z.discriminatedUnion("kind", [
 		systemPrompt: zod.z.string(),
 		toolCount: zod.z.number().int().nonnegative(),
 		credentialCount: zod.z.number().int().nonnegative(),
-		credentialKeys: zod.z.array(zod.z.string()).default([])
+		appSlugs: zod.z.array(zod.z.string()).default([]),
+		toolSlugs: zod.z.array(zod.z.string()).default([])
 	}),
 	zod.z.object({
 		kind: zod.z.literal("workflow"),
@@ -1502,6 +1508,12 @@ const DERIVED_ENTRY_KINDS = new Set([
 function webhookEndpointFromPath(path) {
 	return path.replace(/^\/triggers\//, "").replace(/^\/+|\/+$/g, "");
 }
+function legacyAgentAppSlugs(entry) {
+	if (Array.isArray(entry.appSlugs)) return entry.appSlugs;
+	if (Array.isArray(entry.credentialSlugs)) return entry.credentialSlugs;
+	if (Array.isArray(entry.credentialKeys)) return entry.credentialKeys;
+	return [];
+}
 /** TODO remove after all artifacts rebuilt — upcasts legacy v1 manifests to v2. */
 function normalizeEntryToV2(entry) {
 	const kind = entry.kind;
@@ -1521,7 +1533,8 @@ function normalizeEntryToV2(entry) {
 			systemPrompt: typeof entry.systemPrompt === "string" ? entry.systemPrompt : "",
 			toolCount: typeof entry.toolCount === "number" ? entry.toolCount : 0,
 			credentialCount: typeof entry.credentialCount === "number" ? entry.credentialCount : 0,
-			credentialKeys: Array.isArray(entry.credentialKeys) ? entry.credentialKeys : []
+			appSlugs: legacyAgentAppSlugs(entry),
+			toolSlugs: Array.isArray(entry.toolSlugs) ? entry.toolSlugs : []
 		};
 	}
 	if (kind === "workflow") {
@@ -1581,10 +1594,32 @@ function normalizeEntryToV2(entry) {
 	return null;
 }
 /** TODO remove after all artifacts rebuilt — upcasts legacy v1 manifests to v2. */
+function normalizeV2ManifestInput(value) {
+	if (!value || typeof value !== "object") return value;
+	const raw = value;
+	if (raw.version !== 2 || !Array.isArray(raw.entries)) return value;
+	return {
+		...raw,
+		entries: raw.entries.map((entry) => {
+			if (!entry || typeof entry !== "object" || entry.kind !== "agent") return entry;
+			const agent = entry;
+			if (Array.isArray(agent.appSlugs)) return entry;
+			const appSlugs = legacyAgentAppSlugs(agent);
+			if (appSlugs.length === 0) return entry;
+			const { credentialKeys: _credentialKeys, credentialSlugs: _credentialSlugs, ...rest } = agent;
+			return {
+				...rest,
+				appSlugs,
+				toolSlugs: Array.isArray(agent.toolSlugs) ? agent.toolSlugs : []
+			};
+		})
+	};
+}
+/** TODO remove after all artifacts rebuilt — upcasts legacy v1 manifests to v2. */
 function normalizeStoredRouteManifestToV2(value) {
 	if (!value || typeof value !== "object") throw new Error("Invalid route manifest");
 	const raw = value;
-	if (raw.version === 2) return storedRouteManifestV2Schema.parse(value);
+	if (raw.version === 2) return storedRouteManifestV2Schema.parse(normalizeV2ManifestInput(value));
 	const entriesRaw = Array.isArray(raw.entries) ? raw.entries : [];
 	const entries = [];
 	for (const entry of entriesRaw) {
@@ -1945,6 +1980,24 @@ function buildCredentialInstanceLabel(options) {
 		default: return options.scopeType;
 	}
 }
+/** Pick a friendly slug unused within a credential scope bucket. */
+function deriveCredentialInstanceSlug(options) {
+	const taken = new Set(options.takenSlugs);
+	const explicit = options.explicitSlug?.trim();
+	if (explicit) return explicit;
+	const fromName = options.name?.trim();
+	if (fromName) {
+		const base = normalizeOrganizationNameToSlugBase(fromName) || options.appSlug;
+		if (!taken.has(base)) return base;
+		let suffix = 2;
+		while (taken.has(`${base}-${suffix}`)) suffix += 1;
+		return `${base}-${suffix}`;
+	}
+	if (!taken.has(options.appSlug)) return options.appSlug;
+	let suffix = 2;
+	while (taken.has(`${options.appSlug}-${suffix}`)) suffix += 1;
+	return `${options.appSlug}-${suffix}`;
+}
 /** Pick a label that is unused within a credential scope, suffixing when needed. */
 function resolveUniqueCredentialInstanceLabel(options) {
 	const taken = new Set([...options.takenLabels].map((label) => label ?? null));
@@ -2060,6 +2113,45 @@ const UpdateCredentialRequestSchema = zod.z.object({
 const ListCredentialsResponseSchema = zod.z.array(AppCredentialSummarySchema);
 const GetCredentialResponseSchema = AppCredentialSummarySchema;
 const CreateCredentialsResponseSchema = zod.z.array(AppCredentialSummarySchema);
+const CredentialAssignmentTargetTypeSchema = zod.z.enum(["workflow", "agent"]);
+const CredentialAssignmentRecordSchema = zod.z.object({
+	id: zod.z.string(),
+	targetType: CredentialAssignmentTargetTypeSchema,
+	targetKey: zod.z.string(),
+	consumerId: zod.z.string(),
+	credentialSlug: zod.z.string(),
+	instanceId: zod.z.string(),
+	credential: zod.z.string().optional(),
+	scopeType: zod.z.enum([
+		"organization",
+		"project",
+		"user"
+	]).optional(),
+	createdAt: zod.z.string(),
+	updatedAt: zod.z.string()
+});
+zod.z.object({ assignments: zod.z.array(CredentialAssignmentRecordSchema) });
+zod.z.object({
+	targetType: CredentialAssignmentTargetTypeSchema,
+	targetKey: zod.z.string().min(1),
+	/** Omit or '*' for wildcard assignment. */
+	consumerId: zod.z.string().optional(),
+	credential: zod.z.string().min(1)
+});
+zod.z.object({
+	targetType: CredentialAssignmentTargetTypeSchema,
+	targetKey: zod.z.string().min(1)
+});
+zod.z.object({
+	targetType: CredentialAssignmentTargetTypeSchema,
+	targetKey: zod.z.string().min(1)
+});
+const CredentialConsumerSummarySchema = zod.z.object({
+	consumerId: zod.z.string(),
+	label: zod.z.string(),
+	appSlugs: zod.z.array(zod.z.string())
+});
+zod.z.object({ consumers: zod.z.array(CredentialConsumerSummarySchema) });
 const McpConnectionStatusSchema = zod.z.enum([
 	"INITIATED",
 	"ACTIVE",
@@ -2081,12 +2173,20 @@ zod.z.object({
 	entityId: zod.z.string(),
 	instanceId: zod.z.string()
 });
+const McpCredentialAssignmentTargetSchema = zod.z.object({
+	type: CredentialAssignmentTargetTypeSchema,
+	key: zod.z.string().trim().min(1)
+});
 zod.z.object({
 	app: zod.z.string().trim().min(1),
 	tool: zod.z.string().trim().min(1),
 	arguments: zod.z.record(zod.z.string(), zod.z.unknown()).default({}),
 	/** Pinned provider toolkit version, sourced from the app definition; forwarded to the provider. */
-	version: zod.z.string().trim().min(1)
+	version: zod.z.string().trim().min(1),
+	/** When set, platform MCP resolve checks credential assignments before scope defaults. */
+	assignmentTarget: McpCredentialAssignmentTargetSchema.optional(),
+	/** Tool/step consumer id for assignment lookup (action slug or workflow step correlation id). */
+	consumerId: zod.z.string().trim().min(1).optional()
 });
 const TeamRequestTypeSchema = zod.z.enum([
 	"org-deletion",
@@ -2686,7 +2786,9 @@ zod.z.object({
 });
 const CredentialInstanceRecordSchema = zod.z.object({
 	id: zod.z.string(),
-	key: zod.z.string(),
+	appSlug: zod.z.string(),
+	slug: zod.z.string(),
+	name: zod.z.string().nullable(),
 	scopeType: CredentialScopeTypeSchema,
 	scopeId: zod.z.string().nullable(),
 	label: zod.z.string().nullable(),
@@ -2696,6 +2798,8 @@ const CredentialInstanceRecordSchema = zod.z.object({
 zod.z.object({ instances: zod.z.array(CredentialInstanceRecordSchema) });
 zod.z.object({
 	key: zod.z.string().min(1),
+	slug: zod.z.string().min(1).optional(),
+	name: zod.z.string().nullable().optional(),
 	scopeType: CredentialScopeTypeSchema,
 	scopeId: zod.z.string().nullable().optional(),
 	label: zod.z.string().nullable().optional(),
@@ -2703,6 +2807,8 @@ zod.z.object({
 	value: zod.z.record(zod.z.string(), zod.z.unknown()).refine((value) => Object.keys(value).length > 0, { message: "value must be a non-empty object" })
 });
 zod.z.object({
+	slug: zod.z.string().min(1).optional(),
+	name: zod.z.string().nullable().optional(),
 	label: zod.z.string().nullable().optional(),
 	isDefault: zod.z.boolean().optional(),
 	value: zod.z.record(zod.z.string(), zod.z.unknown()).refine((value) => Object.keys(value).length > 0, { message: "value must be a non-empty object" }).optional()
@@ -3392,11 +3498,11 @@ zod.z.object({
 new node_async_hooks.AsyncLocalStorage();
 new node_async_hooks.AsyncLocalStorage();
 new AbortController().signal;
-const REGISTRY_KEY$1 = Symbol.for("keystroke.workflowRunGetter");
+const REGISTRY_KEY$2 = Symbol.for("keystroke.workflowRunGetter");
 function registry$1() {
 	const globalScope = globalThis;
-	if (!globalScope[REGISTRY_KEY$1]) globalScope[REGISTRY_KEY$1] = {};
-	return globalScope[REGISTRY_KEY$1];
+	if (!globalScope[REGISTRY_KEY$2]) globalScope[REGISTRY_KEY$2] = {};
+	return globalScope[REGISTRY_KEY$2];
 }
 function registerWorkflowRunGetter(fn) {
 	registry$1().getter = fn;
@@ -3467,9 +3573,16 @@ function createSecretStore() {
 }
 async function setCredentialInstanceSecret(options) {
 	const now = /* @__PURE__ */ new Date();
-	const isDefault = options.isDefault ?? true;
+	const siblings = await (0, _keystrokehq_database.selectCredentialInstancesForScope)(options.key, options.scopeType, options.scopeId);
+	const isDefault = options.isDefault ?? siblings.length === 0;
+	const name = options.name ?? options.label ?? null;
+	const slug = options.slug ?? deriveCredentialInstanceSlug({
+		appSlug: options.key,
+		name,
+		takenSlugs: siblings.map((row) => row.slug)
+	});
 	if (isDefault) await (0, _keystrokehq_database.clearCredentialInstanceDefaults)({
-		slug: options.key,
+		appSlug: options.key,
 		scopeType: options.scopeType,
 		scopeId: options.scopeId,
 		exceptId: options.id
@@ -3477,10 +3590,12 @@ async function setCredentialInstanceSecret(options) {
 	if ((0, _keystrokehq_platform_database.getOrganizationScopeId)() !== void 0) {
 		await (0, _keystrokehq_database.upsertCredentialInstance)({
 			id: options.id,
-			slug: options.key,
+			appSlug: options.key,
+			slug,
+			name,
 			scopeType: options.scopeType,
 			scopeId: options.scopeId,
-			label: options.label ?? null,
+			label: name,
 			isDefault,
 			authKind: "api_key",
 			ciphertext: null,
@@ -3497,10 +3612,12 @@ async function setCredentialInstanceSecret(options) {
 	}
 	await (0, _keystrokehq_database.upsertCredentialInstance)({
 		id: options.id,
-		slug: options.key,
+		appSlug: options.key,
+		slug,
+		name,
 		scopeType: options.scopeType,
 		scopeId: options.scopeId,
-		label: options.label ?? null,
+		label: name,
 		isDefault,
 		authKind: "api_key",
 		ciphertext: (0, _keystrokehq_database.encryptCredentialPayload)(JSON.stringify(options.value)),
@@ -26605,4 +26722,4 @@ Object.defineProperty(exports, "validationErrorResponse", {
 	}
 });
 
-//# sourceMappingURL=dist-ChqR_h8h.cjs.map
+//# sourceMappingURL=dist-CCtsJoyT.cjs.map