@oomol-lab/open-flow 0.1.0-beta.51 → 0.1.0-beta.52

package/dist/common/flow-encoding.js

@@ -1,3 +1,12 @@
+//#region src/openapi/common/authBindings.ts
+/** Never allow credentials to enter a Revision as literal node inputs. */
+function assertOpenApiAuthBindings(document) {
+	for (const graph of [document.graph, ...Object.values(document.subflows).map((subflow) => subflow.graph)]) for (const node of Object.values(graph.nodes)) {
+		if (node.kind != "task" || node.taskId == null || document.tasks[node.taskId]?.executor.kind != "openapi") continue;
+		for (const [handle, mapping] of Object.entries(node.inputs)) if (handle.startsWith("auth.") && (mapping.kind == "value" || mapping.kind == "sources" && mapping.sources.some((source) => source.kind == "flow"))) throw new TypeError("OpenAPI authentication accepts deployment variables and upstream outputs only.");
+	}
+}
+//#endregion
 //#region ../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/util.js
 function getEnumValues(entries) {
 	const numericValues = Object.values(entries).filter((v) => typeof v === "number");
@@ -5709,6 +5718,24 @@ var managed = object({
 			action: text,
 			connectionId: text.optional()
 		}),
+		object({
+			kind: literal("openapi"),
+			sourceUrl: text,
+			method: text,
+			path: text,
+			serverUrl: text,
+			document: json,
+			auth: array(object({
+				id: text,
+				type: _enum([
+					"bearer",
+					"basic",
+					"apiKey"
+				]),
+				name: text.optional(),
+				in: _enum(["header", "query"]).optional()
+			}))
+		}),
 		object({
 			kind: literal("llm"),
 			mode: _enum(["chat", "json"])
@@ -6154,6 +6181,7 @@ function decodeRevisionContent(value) {
 	checkJsonDepth(value);
 	const content = revision.parse(value);
 	checkErrorModelVersion(content);
+	assertOpenApiAuthBindings(content.document);
 	return content;
 }
 function decodeRevisionEnvelope(value) {
@@ -6165,6 +6193,7 @@ function decodeRevisionEnvelope(value) {
 	} : value;
 	const content = envelope.parse(candidate);
 	checkErrorModelVersion(content);
+	assertOpenApiAuthBindings(content.document);
 	return {
 		modelVersion: content.modelVersion,
 		document: content.document,
@@ -6330,6 +6359,11 @@ var shapes = {
 		before: text.optional(),
 		value: text.optional()
 	},
+	"task.openapi.set": {
+		taskId: text,
+		before: managed,
+		value: managed
+	},
 	"task.agent.set": {
 		taskId: text,
 		before: managed,