@keystrokehq/platform 1.0.11 → 1.0.13

package/dist/{dist-Ccqkv6G-.mjs → dist-DMbNZqSO.mjs}

@@ -1,7 +1,7 @@
 import { createRequire } from "node:module";
 import Docker from "dockerode";
 import { mkdir } from "node:fs/promises";
-import { DEFAULT_DATABASE_URL, claimNextJob, clearCredentialInstanceDefaults, createPostgresCancelChannel, encryptCredentialPayload, enqueueJob, failWorkflowRun, getProjectScopeId, inferDialect, markJobComplete, markJobFailed, requeueExpiredLeases, resolvePostgresUrlFromEnv, resolveProjectDatabaseUrlFromEnv, scheduleJobRetry, upsertCredentialInstance } from "@keystrokehq/database";
+import { DEFAULT_DATABASE_URL, claimNextJob, clearCredentialInstanceDefaults, createPostgresCancelChannel, encryptCredentialPayload, enqueueJob, failWorkflowRun, getProjectScopeId, inferDialect, markJobComplete, markJobFailed, requeueExpiredLeases, resolvePostgresUrlFromEnv, resolveProjectDatabaseUrlFromEnv, scheduleJobRetry, selectCredentialInstancesForScope, upsertCredentialInstance } from "@keystrokehq/database";
 import { z } from "zod";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { deleteSecretValuesForRef, getOrganizationScopeId, selectSecretValue, upsertSecretValue } from "@keystrokehq/platform-database";
@@ -1286,6 +1286,11 @@ const OrganizationSlugSchema = z.string().trim().toLowerCase().min(2, "Slug must
 * fail to load.
 */
 const ClaimableOrganizationSlugSchema = OrganizationSlugSchema.refine((slug) => !RESERVED_ORGANIZATION_SLUGS.has(slug), "This slug is reserved");
+const ORGANIZATION_NAME_APOSTROPHE_PATTERN = /[''\u2018\u2019]/g;
+/** Normalize a display name into slug-shaped text (may be empty or too short to claim). */
+function normalizeOrganizationNameToSlugBase(name) {
+	return name.trim().toLowerCase().replace(ORGANIZATION_NAME_APOSTROPHE_PATTERN, "").replace(/[^a-z0-9]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+}
 /** Same format as organization slugs — org-scoped, no global reserved list. */
 const ProjectSlugSchema = OrganizationSlugSchema;
 const PROJECT_SLUG_TAKEN_MESSAGE = "That slug is already taken.";
@@ -1442,7 +1447,8 @@ const storedRouteManifestEntryV2Schema = z.discriminatedUnion("kind", [
 		systemPrompt: z.string(),
 		toolCount: z.number().int().nonnegative(),
 		credentialCount: z.number().int().nonnegative(),
-		credentialKeys: z.array(z.string()).default([])
+		appSlugs: z.array(z.string()).default([]),
+		toolSlugs: z.array(z.string()).default([])
 	}),
 	z.object({
 		kind: z.literal("workflow"),
@@ -1497,6 +1503,12 @@ const DERIVED_ENTRY_KINDS = new Set([
 function webhookEndpointFromPath(path) {
 	return path.replace(/^\/triggers\//, "").replace(/^\/+|\/+$/g, "");
 }
+function legacyAgentAppSlugs(entry) {
+	if (Array.isArray(entry.appSlugs)) return entry.appSlugs;
+	if (Array.isArray(entry.credentialSlugs)) return entry.credentialSlugs;
+	if (Array.isArray(entry.credentialKeys)) return entry.credentialKeys;
+	return [];
+}
 /** TODO remove after all artifacts rebuilt — upcasts legacy v1 manifests to v2. */
 function normalizeEntryToV2(entry) {
 	const kind = entry.kind;
@@ -1516,7 +1528,8 @@ function normalizeEntryToV2(entry) {
 			systemPrompt: typeof entry.systemPrompt === "string" ? entry.systemPrompt : "",
 			toolCount: typeof entry.toolCount === "number" ? entry.toolCount : 0,
 			credentialCount: typeof entry.credentialCount === "number" ? entry.credentialCount : 0,
-			credentialKeys: Array.isArray(entry.credentialKeys) ? entry.credentialKeys : []
+			appSlugs: legacyAgentAppSlugs(entry),
+			toolSlugs: Array.isArray(entry.toolSlugs) ? entry.toolSlugs : []
 		};
 	}
 	if (kind === "workflow") {
@@ -1576,10 +1589,32 @@ function normalizeEntryToV2(entry) {
 	return null;
 }
 /** TODO remove after all artifacts rebuilt — upcasts legacy v1 manifests to v2. */
+function normalizeV2ManifestInput(value) {
+	if (!value || typeof value !== "object") return value;
+	const raw = value;
+	if (raw.version !== 2 || !Array.isArray(raw.entries)) return value;
+	return {
+		...raw,
+		entries: raw.entries.map((entry) => {
+			if (!entry || typeof entry !== "object" || entry.kind !== "agent") return entry;
+			const agent = entry;
+			if (Array.isArray(agent.appSlugs)) return entry;
+			const appSlugs = legacyAgentAppSlugs(agent);
+			if (appSlugs.length === 0) return entry;
+			const { credentialKeys: _credentialKeys, credentialSlugs: _credentialSlugs, ...rest } = agent;
+			return {
+				...rest,
+				appSlugs,
+				toolSlugs: Array.isArray(agent.toolSlugs) ? agent.toolSlugs : []
+			};
+		})
+	};
+}
+/** TODO remove after all artifacts rebuilt — upcasts legacy v1 manifests to v2. */
 function normalizeStoredRouteManifestToV2(value) {
 	if (!value || typeof value !== "object") throw new Error("Invalid route manifest");
 	const raw = value;
-	if (raw.version === 2) return storedRouteManifestV2Schema.parse(value);
+	if (raw.version === 2) return storedRouteManifestV2Schema.parse(normalizeV2ManifestInput(value));
 	const entriesRaw = Array.isArray(raw.entries) ? raw.entries : [];
 	const entries = [];
 	for (const entry of entriesRaw) {
@@ -1940,6 +1975,24 @@ function buildCredentialInstanceLabel(options) {
 		default: return options.scopeType;
 	}
 }
+/** Pick a friendly slug unused within a credential scope bucket. */
+function deriveCredentialInstanceSlug(options) {
+	const taken = new Set(options.takenSlugs);
+	const explicit = options.explicitSlug?.trim();
+	if (explicit) return explicit;
+	const fromName = options.name?.trim();
+	if (fromName) {
+		const base = normalizeOrganizationNameToSlugBase(fromName) || options.appSlug;
+		if (!taken.has(base)) return base;
+		let suffix = 2;
+		while (taken.has(`${base}-${suffix}`)) suffix += 1;
+		return `${base}-${suffix}`;
+	}
+	if (!taken.has(options.appSlug)) return options.appSlug;
+	let suffix = 2;
+	while (taken.has(`${options.appSlug}-${suffix}`)) suffix += 1;
+	return `${options.appSlug}-${suffix}`;
+}
 /** Pick a label that is unused within a credential scope, suffixing when needed. */
 function resolveUniqueCredentialInstanceLabel(options) {
 	const taken = new Set([...options.takenLabels].map((label) => label ?? null));
@@ -2055,6 +2108,45 @@ const UpdateCredentialRequestSchema = z.object({
 const ListCredentialsResponseSchema = z.array(AppCredentialSummarySchema);
 const GetCredentialResponseSchema = AppCredentialSummarySchema;
 const CreateCredentialsResponseSchema = z.array(AppCredentialSummarySchema);
+const CredentialAssignmentTargetTypeSchema = z.enum(["workflow", "agent"]);
+const CredentialAssignmentRecordSchema = z.object({
+	id: z.string(),
+	targetType: CredentialAssignmentTargetTypeSchema,
+	targetKey: z.string(),
+	consumerId: z.string(),
+	credentialSlug: z.string(),
+	instanceId: z.string(),
+	credential: z.string().optional(),
+	scopeType: z.enum([
+		"organization",
+		"project",
+		"user"
+	]).optional(),
+	createdAt: z.string(),
+	updatedAt: z.string()
+});
+z.object({ assignments: z.array(CredentialAssignmentRecordSchema) });
+z.object({
+	targetType: CredentialAssignmentTargetTypeSchema,
+	targetKey: z.string().min(1),
+	/** Omit or '*' for wildcard assignment. */
+	consumerId: z.string().optional(),
+	credential: z.string().min(1)
+});
+z.object({
+	targetType: CredentialAssignmentTargetTypeSchema,
+	targetKey: z.string().min(1)
+});
+z.object({
+	targetType: CredentialAssignmentTargetTypeSchema,
+	targetKey: z.string().min(1)
+});
+const CredentialConsumerSummarySchema = z.object({
+	consumerId: z.string(),
+	label: z.string(),
+	appSlugs: z.array(z.string())
+});
+z.object({ consumers: z.array(CredentialConsumerSummarySchema) });
 const McpConnectionStatusSchema = z.enum([
 	"INITIATED",
 	"ACTIVE",
@@ -2076,12 +2168,20 @@ z.object({
 	entityId: z.string(),
 	instanceId: z.string()
 });
+const McpCredentialAssignmentTargetSchema = z.object({
+	type: CredentialAssignmentTargetTypeSchema,
+	key: z.string().trim().min(1)
+});
 z.object({
 	app: z.string().trim().min(1),
 	tool: z.string().trim().min(1),
 	arguments: z.record(z.string(), z.unknown()).default({}),
 	/** Pinned provider toolkit version, sourced from the app definition; forwarded to the provider. */
-	version: z.string().trim().min(1)
+	version: z.string().trim().min(1),
+	/** When set, platform MCP resolve checks credential assignments before scope defaults. */
+	assignmentTarget: McpCredentialAssignmentTargetSchema.optional(),
+	/** Tool/step consumer id for assignment lookup (action slug or workflow step correlation id). */
+	consumerId: z.string().trim().min(1).optional()
 });
 const TeamRequestTypeSchema = z.enum([
 	"org-deletion",
@@ -2681,7 +2781,9 @@ z.object({
 });
 const CredentialInstanceRecordSchema = z.object({
 	id: z.string(),
-	key: z.string(),
+	appSlug: z.string(),
+	slug: z.string(),
+	name: z.string().nullable(),
 	scopeType: CredentialScopeTypeSchema,
 	scopeId: z.string().nullable(),
 	label: z.string().nullable(),
@@ -2691,6 +2793,8 @@ const CredentialInstanceRecordSchema = z.object({
 z.object({ instances: z.array(CredentialInstanceRecordSchema) });
 z.object({
 	key: z.string().min(1),
+	slug: z.string().min(1).optional(),
+	name: z.string().nullable().optional(),
 	scopeType: CredentialScopeTypeSchema,
 	scopeId: z.string().nullable().optional(),
 	label: z.string().nullable().optional(),
@@ -2698,6 +2802,8 @@ z.object({
 	value: z.record(z.string(), z.unknown()).refine((value) => Object.keys(value).length > 0, { message: "value must be a non-empty object" })
 });
 z.object({
+	slug: z.string().min(1).optional(),
+	name: z.string().nullable().optional(),
 	label: z.string().nullable().optional(),
 	isDefault: z.boolean().optional(),
 	value: z.record(z.string(), z.unknown()).refine((value) => Object.keys(value).length > 0, { message: "value must be a non-empty object" }).optional()
@@ -3387,11 +3493,11 @@ z.object({
 new AsyncLocalStorage();
 new AsyncLocalStorage();
 new AbortController().signal;
-const REGISTRY_KEY$1 = Symbol.for("keystroke.workflowRunGetter");
+const REGISTRY_KEY$2 = Symbol.for("keystroke.workflowRunGetter");
 function registry$1() {
 	const globalScope = globalThis;
-	if (!globalScope[REGISTRY_KEY$1]) globalScope[REGISTRY_KEY$1] = {};
-	return globalScope[REGISTRY_KEY$1];
+	if (!globalScope[REGISTRY_KEY$2]) globalScope[REGISTRY_KEY$2] = {};
+	return globalScope[REGISTRY_KEY$2];
 }
 function registerWorkflowRunGetter(fn) {
 	registry$1().getter = fn;
@@ -3462,9 +3568,16 @@ function createSecretStore() {
 }
 async function setCredentialInstanceSecret(options) {
 	const now = /* @__PURE__ */ new Date();
-	const isDefault = options.isDefault ?? true;
+	const siblings = await selectCredentialInstancesForScope(options.key, options.scopeType, options.scopeId);
+	const isDefault = options.isDefault ?? siblings.length === 0;
+	const name = options.name ?? options.label ?? null;
+	const slug = options.slug ?? deriveCredentialInstanceSlug({
+		appSlug: options.key,
+		name,
+		takenSlugs: siblings.map((row) => row.slug)
+	});
 	if (isDefault) await clearCredentialInstanceDefaults({
-		slug: options.key,
+		appSlug: options.key,
 		scopeType: options.scopeType,
 		scopeId: options.scopeId,
 		exceptId: options.id
@@ -3472,10 +3585,12 @@ async function setCredentialInstanceSecret(options) {
 	if (getOrganizationScopeId() !== void 0) {
 		await upsertCredentialInstance({
 			id: options.id,
-			slug: options.key,
+			appSlug: options.key,
+			slug,
+			name,
 			scopeType: options.scopeType,
 			scopeId: options.scopeId,
-			label: options.label ?? null,
+			label: name,
 			isDefault,
 			authKind: "api_key",
 			ciphertext: null,
@@ -3492,10 +3607,12 @@ async function setCredentialInstanceSecret(options) {
 	}
 	await upsertCredentialInstance({
 		id: options.id,
-		slug: options.key,
+		appSlug: options.key,
+		slug,
+		name,
 		scopeType: options.scopeType,
 		scopeId: options.scopeId,
-		label: options.label ?? null,
+		label: name,
 		isDefault,
 		authKind: "api_key",
 		ciphertext: encryptCredentialPayload(JSON.stringify(options.value)),
@@ -25773,4 +25890,4 @@ function minioStoragePlugin(options = {}) {
 //#endregion
 export { InviteOrganizationMembersResponseSchema as $, UserAvatarSchema as $t, AppSlugAvailabilityResponseSchema as A, __require as An, RecentResourceListResponseSchema as At, CreateProjectArtifactResponseSchema as B, SubmitTeamRequestRequestSchema as Bt, AcceptOrganizationInvitationResponseSchema as C, projectFileId as Cn, PresignUserAvatarResponseSchema as Ct, AgentSummaryListResponseSchema as D, defaultHostingPlugin as Dn, ProjectSlugAvailabilityQuerySchema as Dt, AgentSummaryDetailResponseSchema as E, validationErrorResponse as En, ProjectSettingsResponseSchema as Et, CreateCredentialsResponseSchema as F, SlugAvailabilityQuerySchema as Ft, ErrorResponseSchema as G, UpdateOrganizationRequestSchema as Gt, CreateProjectResponseSchema as H, UpdateCredentialRequestSchema as Ht, CreateCustomAppRequestSchema as I, SlugAvailabilityResponseSchema as It, HistoryRunCancelResponseSchema as J, UpdateProjectRequestSchema as Jt, GetCredentialResponseSchema as K, UpdateProjectMemberRequestSchema as Kt, CreateCustomAppResponseSchema as L, StoredProjectSourceManifestSchema as Lt, CreateApiKeyRequestSchema as M, SkillSummaryDetailResponseSchema as Mt, CreateApiKeyResponseSchema as N, SkillSummaryListResponseSchema as Nt, AgentSummarySchema as O, pingProjectTarget as On, ProjectSlugAvailabilityResponseSchema as Ot, CreateCredentialsRequestSchema as P, SkillSummarySchema as Pt, InviteOrganizationMembersRequestSchema as Q, UserAvatarPatchSchema as Qt, CreateOrganizationRequestSchema as R, SubmitMarketingContactRequestSchema as Rt, ACTIVE_ORG_HEADER as S, parseStoredRouteManifest as Sn, PresignUserAvatarRequestSchema as St, AgentMemoryFileSummarySchema as T, validateCredentialValueAgainstFields as Tn, ProjectResponseSchema as Tt, DeclineOrganizationInvitationResponseSchema as U, UpdateOrganizationMemberRequestSchema as Ut, CreateProjectRequestSchema as V, SubmitTeamRequestResponseSchema as Vt, DownloadActiveProjectArtifactResponseSchema as W, UpdateOrganizationMemberResponseSchema as Wt, HistoryRunListQuerySchema as X, UploadProjectSourceManifestRequestSchema as Xt, HistoryRunDetailResponseSchema as Y, UpdateProjectSettingsRequestSchema as Yt, HistoryRunListResponseSchema as Z, UploadProjectSourceResponseSchema as Zt, createJobQueue as _, mergeUserPreferences as _n, PROJECT_SLUG_TAKEN_MESSAGE as _t, isKeystrokeAssetsAvatarPublicUrl as a, agentMemoryFileId as an, ListCredentialsResponseSchema as at, readCredentialInstanceSecret as b, organizationSlugErrorCodeFromMessage as bn, PresignProjectSourceRequestSchema as bt, isUserAvatarStorageKey as c, listenPortFromPublicUrl as cn, ListOrganizationsResponseSchema as ct, minioStoragePlugin as d, mapProject as dn, ListProjectMembersResponseSchema as dt, UserPreferencesPatchSchema as en, InviteProjectMembersRequestSchema as et, orgLogoStorageKey as f, mapProjectArtifact as fn, ListProjectMetricsResponseSchema as ft, userAvatarStorageKey as g, mapUserOrganization as gn, PLATFORM_RESOURCE_UNSUPPORTED_TEXT as gt, publicKeystrokeAssetsObjectUrl as h, mapProjectSettings as hn, OrganizationSidebarBrandingSchema as ht, extractRouteManifestFromArtifact as i, WorkflowSummarySchema as in, ListAppsResponseSchema as it, CompleteProjectArtifactResponseSchema as j, __toESM as jn, RecentResourceSchema as jt, AppSlugAvailabilityQuerySchema as k, __commonJSMin as kn, ProjectSourceResourcesSchema as kt, keystrokeAssetsAvatarKeyFromPublicUrl as l, mapOrganizationInvitation as ln, ListProjectDeploymentsResponseSchema as lt, projectSourceBlobKey as m, mapProjectMember as mn, OrganizationSidebarBrandingPatchSchema as mt, createAssetsStorageClient as n, WorkflowSummaryDetailResponseSchema as nn, ListAgentMemoryFilesResponseSchema as nt, isKeystrokeAssetsOrgLogoPublicUrl as o, buildCredentialInstanceLabel as on, ListOrganizationInvitationsResponseSchema as ot, projectArtifactKey as p, mapProjectDeployment as pn, ListProjectsResponseSchema as pt, GetCustomAppResponseSchema as q, UpdateProjectMemberResponseSchema as qt, ensureKeystrokeAssetsBucket as r, WorkflowSummaryListResponseSchema as rn, ListApiKeysResponseSchema as rt, isOrgLogoStorageKey as s, displayCredentialAppName as sn, ListOrganizationMembersResponseSchema as st, RouteManifestNotFoundError as t, UserPreferencesSchema as tn, InviteProjectMembersResponseSchema as tt, keystrokeAssetsOrgLogoKeyFromPublicUrl as u, mapOrganizationMember as un, ListProjectFilesResponseSchema as ut, defaultSchedulerPlugin as v, normalizeUserPreferences as vn, PresignOrgLogoRequestSchema as vt, ActiveOrganizationResponseSchema as w, resolveUniqueCredentialInstanceLabel as wn, ProjectReachabilityResponseSchema as wt, setCredentialInstanceSecret as x, parseAppSlug as xn, PresignProjectSourceResponseSchema as xt, deleteCredentialInstanceSecret as y, organizationInvitationAcceptPath as yn, PresignOrgLogoResponseSchema as yt, CreateOrganizationResponseSchema as z, SubmitMarketingContactResponseSchema as zt };
 
-//# sourceMappingURL=dist-Ccqkv6G-.mjs.map
+//# sourceMappingURL=dist-DMbNZqSO.mjs.map